**As** an OpenProject admin
**I want to** be able to configure OpenID provider using a user interface
**so that** I don't have to use a command line and can see potential errors more easily.

**Acceptance criteria**

* **Navigation**

* OpenID provider configurations are accessible under Administration -> Authentication -> Begin of the insertionOIDCEnd of the insertion Begin of the deletion OpenIDEnd of the deletion providers

* Begin of the insertion**Index page**

* When no OIDC providers are setup show a BlankSlate

* When OIDC providers are setup show all complete and incomplete OIDC providers

* Show name, type, users, "created by" and "created on"

* When a provider is incomplete show the "incomplete" tag



* End of the insertion **Add Button**

* The admin can add a new Begin of the insertionOIDCEnd of the insertion Begin of the deletion "OpenIDEnd of the deletion provider" by clicking on the "Add Begin of the insertionOIDCEnd of the insertion Begin of the deletion OpenIDEnd of the deletion provider" button

* Begin of the insertionThisEnd of the insertion Begin of the deletion This"Add OpenID provider"End of the deletion button is a drop down like for adding a storage

* The dropdown shows following options

* Google

* Begin of the insertionMicrosoftEnd of the insertion Entra

* Custom

* **Create form**

* Begin of the insertionOverview

* All sections are editableEnd of the insertion Begin of the deletion Following attributes need to be filled out by the adminEnd of the deletion in the Begin of the deletion OpenID providersEnd of the deletion creation form Begin of the insertion

End of the insertion Begin of the deletion

End of the deletion * Begin of the insertionBasic details

End of the insertion Begin of the deletion Manually input by the admin

End of the deletion * Begin of the insertionName, required and needs toEnd of the insertion Begin of the deletion identifier (string)

* secret (string)

* display\_name (string)

* Limit self registration (boolean)

* CanEnd of the deletion be filled by Begin of the deletion discovery endpoint or can also be filled manually by theEnd of the deletion admin Begin of the deletion

* authorization\_endpoint

* userinfo\_endpoint

* token\_endpoint

* end\_session\_endpoint

* jwks\_uri

* issuerEnd of the deletion

* Begin of the insertionAutomaticEnd of the insertion Begin of the deletion TheEnd of the deletion configuration Begin of the deletion form supports an input field:  "OpenID discovery endpoint"End of the deletion

* Begin of the insertionThe user should be able to optionally use a Discovery endpoint

* End of the insertion After entering the URL, the form will fetch data from the OpenID Discovery endpoint

* After getting a successful response the form copies the fetched values into the form (see attributes above)

* After a unsuccessful response show an error message Begin of the insertion

End of the insertion Begin of the deletion

End of the deletion * Begin of the insertionThis endpoint will fill the inputs in the next section (Advanced configuration)



* Advanced configuration

* Show a info box when the information was supplied through automatic configuration

* The inputs are editable

* All inputs

* authorization\_endpoint

* userinfo\_endpoint

* token\_endpoint

* end\_session\_endpoint

* jwks\_uri

* issuer

* Client Details

* Admin needs to fill "Client ID" and "Client Secret"

* "Limit self-registration" is optional




* End of the insertion When "Google" was chosen

* The Google discovery endpoint is already known. Therefore the UX should be simplified.

* Begin of the insertionAutomatic and Advanced configuration sectionsEnd of the insertion Begin of the deletion OpenID Discovery endpoint input is not shown

* Inputs for values that can be fetched by the discoveryEnd of the deletion are not shown

* When Begin of the insertion "Entra"End of the insertion Begin of the deletion  "Entra"End of the deletion was chosen

* An extra input Begin of the insertioncalled Tenant" (stringEnd of the insertion Begin of the deletion is shown "Tenant" (string)End of the deletion - default value Begin of the insertion"common") is shown in "Basic details"End of the insertion Begin of the deletion "common"End of the deletion

* Entra discovery endpoint can be constructed from tenant. By default it should be `common`.

* Admin should be able to change tenant.

* Begin of the insertion

End of the insertion Begin of the deletion When "Custom" was chosen

* In this case user should be able to enter OpenID Discovery endpoint explicitly.

End of the deletion * **Edit Form**

* _<tbd: are there immutable values once created?>_