**As** an OpenProject admin
**I want to** be able to configure OpenID provider using a user interface
**so that** I don't have to use a command line and can see potential errors more easily.

**Acceptance criteria**

* Begin of the insertion**Navigation**

* End of the insertion OpenID provider configurations are accessible under Administration -> Authentication -> OpenID providers Begin of the insertion

End of the insertion Begin of the deletion

End of the deletion * Begin of the insertion**Add Button**

* End of the insertion The Begin of the insertionadmin can add a new "OpenID provider" by clicking on the "Add OpenID provider" button

* This"Add OpenID provider" button is a drop down like for adding a storage

* The dropdown shows following options

* Google

* Entra

* Custom

* **Create form**

* Following attributes need to be filled out by the admin in the OpenID providers creation form

* Manually input by the admin

* identifier (string)

* secret (string)

* display\_name (string)

* Limit self registration (boolean)

* Can be filled by discovery endpoint or can also be filled manually by the admin

* authorization\_endpoint

* userinfo\_endpoint

* token\_endpoint

* end\_session\_endpoint

* jwks\_uri

* issuer

* TheEnd of the insertion configuration form supports Begin of the insertionan input field:  "OpenID discovery endpoint"

End of the insertion Begin of the deletion

End of the deletion * Begin of the insertionAfter entering the URL, the form will fetchEnd of the insertion Begin of the deletion fillingEnd of the deletion data from Begin of the insertiontheEnd of the insertion OpenID Discovery endpoint Begin of the insertion

End of the insertion Begin of the deletion

End of the deletion * Begin of the insertionAfter getting a successful response the form copies the fetched values into the form (see attributes above)

* After a unsuccessful response show an error message

* When "Google" was chosenEnd of the insertion Begin of the deletion specific providers like Google and EntraEnd of the deletion

* Begin of the insertionTheEnd of the insertion Begin of the deletion ForEnd of the deletion Google discovery endpoint is already known. Therefore the UX should be simplified.

* Begin of the insertionOpenID Discovery endpoint input is not shown

* Inputs for values that can be fetched by the discovery are not shown

* When  "Entra" was chosen

* An extra input is shown "Tenant" (string) - default value "common"

* End of the insertion Begin of the deletion ForEnd of the deletion Entra discovery endpoint can be constructed from tenant. By default it should be `common`. Begin of the insertion

* AdminEnd of the insertion Begin of the deletion And useEnd of the deletion should be able to change tenant.

* Begin of the insertionWhen "Custom" was chosenEnd of the insertion Begin of the deletion custom providerEnd of the deletion

* In this case user should be able to enter OpenID Discovery endpoint Begin of the insertionexplicitly.

End of the insertion Begin of the deletion explicitly. 


These attributes can be obtained from the discovery endpoint.

End of the deletion * Begin of the insertion**Edit Form**

End of the insertion Begin of the deletion authorization\_endpoint

End of the deletion * Begin of the insertion_<tbd: are there immutable values once created?>_End of the insertion Begin of the deletion userinfo\_endpoint

* token\_endpoint

* end\_session\_endpoint

* jwks\_uri

* issuer


These attributes can't. Admin has to fill it in manually:

* identifier

* secret

* display\_nameEnd of the deletion