**As** an administrator
**I want Begin of the insertionthe** health status feature to support storages configured for common OIDC tokens,End of the insertion Begin of the deletion to** receive feedback on configuration errors during setupEnd of the deletion
**so that** I understand, whether the interaction between OpenProject, the IDP and Nextcloud will work.

**Acceptance criteria**

Begin of the insertionWhen an admin performs the connection validation / health status on a storage that's using a common OIDC provider:

End of the insertion * If no OIDC provider is configured on OpenProject's Begin of the insertionside or the admin is not logged in through OIDC,End of the insertion Begin of the deletion side,End of the deletion it shows Begin of the insertionan errorEnd of the insertion Begin of the deletion a warningEnd of the deletion

* Including a link to docs for setting up an OIDC provider

* Including a link to docs for specific requirements for an OIDC provider used in this scenario

* If Begin of the insertionuserEnd of the insertion Begin of the deletion an OIDC providerEnd of the deletion is Begin of the insertionloggedEnd of the insertion Begin of the deletion configured, show warning if provider is not set-up to request the offline\_access scope

* Including a link to docs for specific requirements for an OIDC provider usedEnd of the deletion in Begin of the insertionthrough OIDC,End of the insertion Begin of the deletion this scenario

* Once a Nextcloud client ID has been entered,End of the deletion check suitability of access token for currently logged in user (usually the admin)

* If the token is deemed usable for use in Nextcloud:

* Show success (roughly: "IDP token is usable to access storage")

* If the token is not deemed usable for use in Nextcloud

* ... and if IDP offers no token exchange:

* show error (roughly: "IDP token does not seem suitable to access storage")

* ... and if IDP offers token exchange capability: Try to exchange token

* if exchange succeeds: show success (roughly: "IDP token could be exchanged for token to access storage")

* if exchange fails: show error (roughly: "Attempted token exchange failed") Begin of the insertion

* Show an _additional_ warning if OIDC provider of current user is not set-up to request the offline\_access scope

* Including a link to docs for specific requirements for an OIDC provider used in this scenarioEnd of the insertion