**As** an administrator
**I want to** have a UI to manage SCIM clients,
**so that** certain aspects of SCIM integration can be configured.

**Acceptance criteria**

* There is a UI to configure SCIM clients at `/admin/settings/authentication` Begin of the insertion

End of the insertion Begin of the deletion

End of the deletion * Begin of the deletion _Note parimal: border box approach + blankslate_

* End of the deletion Each SCIM client automatically creates an associated service account

* Begin of the deletion `scim_v2` scope is validated during SCIM Client authentication

* It should be communicated to admins that JWTs must contain the scope, for instance

* End of the deletion Per SCIM client we can configure:

* Name

* Authentication provider

* Select box with options (values come Begin of the insertionfromEnd of the insertion the db), _eg. Keycloak, Nextcloud Hub_

* Authentication Begin of the insertionmethod. **It can be set during creation process only.**End of the insertion Begin of the deletion methodEnd of the deletion

* External:

* SSO: 1 input ("Subject claim")

* Caption: _For example, for Keycloak, this is the UUID of the service account associated with the SCIM client. Check the documentation to how to find the subject claim for your use case._ Begin of the insertion

End of the insertion Begin of the deletion

End of the deletion * Begin of the insertion??? `scim_v2` scope is validated during SCIM Client authentication

* It should be communicated to admins that JWTs must contain the scope, for instance

* End of the insertion Internal, two Begin of the insertionoptions:End of the insertion Begin of the deletion optiondEnd of the deletion

* OAuth2:

* outputs client ID and secret Begin of the insertionin a popup once after creation.End of the insertion Begin of the deletion _(regular style comparable to storages)_End of the deletion

* Static access token

* outputs token Begin of the insertionin a popup once after creationEnd of the insertion Begin of the deletion IDEnd of the deletion

* Begin of the insertionall tokens are listedEnd of the insertion Begin of the deletion info: expiresEnd of the deletion in Begin of the insertiona table on edit page

* tokenEnd of the insertion Begin of the deletion 1 year,End of the deletion can be Begin of the insertionrevoked

End of the insertion Begin of the deletion renewed

End of the deletion * Begin of the insertionit means that token is not usable anymore and marked as revoked in the token table

* tokens can be added

* For generated access tokens table has:

* Token generation date

* Who generated token

* ??? Who revoked token?

* Expiry date

* Actions: revoke

* End of the insertion Configured SCIMs clients are visible in a borderBox Begin of the insertionlist

* End of the insertion Begin of the deletion list,End of the deletion with actions: Begin of the insertion

End of the insertion Begin of the deletion

End of the deletion * Delete Begin of the insertion

End of the insertion Begin of the deletion (Danger dialog, _come up with text_)

End of the deletion * Begin of the insertionDanger dialog,

_Caption: Are you sure you want to delete this SCIM client? Users managed by this SCIM client will no longer be updated by it._

End of the insertion Begin of the deletion Edit

End of the deletion * Edit Begin of the insertion

End of the insertion Begin of the deletion page is like create page

End of the deletion * Begin of the deletion For generated access tokens, there's a list of available onesEnd of the deletion with Begin of the insertioncolumns:End of the insertion Begin of the deletion two info:End of the deletion

* Begin of the insertionNameEnd of the insertion Begin of the deletion Token generation dateEnd of the deletion

* Begin of the insertionNumber of users provisioned by that clientEnd of the insertion Begin of the deletion Expiry dateEnd of the deletion

* Begin of the insertionSCIM client creator

End of the insertion Begin of the deletion Actions: delete

End of the deletion * Begin of the insertioncreation date


End of the insertion Begin of the deletion Note: the context of the token (so the actual token value itself) cannot be shown, it's a one-time thing

* The admin can generate additional tokens (create action)


End of the deletion **Permissions and visibility considerations**

* Administrators


**Translation considerations**

* _TODO: check existing keys_


**Out of scope**

* Choosing TTL of generated tokens

* Reminder emails to admins about expiring and/or expired tokens Begin of the deletion

* Identity of who generated or deleted tokens (for auditing)End of the deletion