**As** an administrator
**I want to** have a UI to manage SCIM clients,
**so that** certain aspects of SCIM integration can be configured.

**Acceptance criteria**

* There is a UI to configure SCIM clients at `/admin/settings/authentication` Begin of the insertion

End of the insertion Begin of the deletion

End of the deletion * Begin of the insertion_Note parimal: border box approach + blankslate_

* End of the insertion Each SCIM client automatically creates an associated service account

* `scim_v2` scope is validated during SCIM Client authentication

* It should be communicated to admins that JWTs must contain the scope, for instance

* Per SCIM client we can configure:

* Name

* Begin of the insertionAuthenticationEnd of the insertion Begin of the deletion Associated OIDCEnd of the deletion provider Begin of the insertion

End of the insertion Begin of the deletion

End of the deletion * Begin of the insertionSelect box with options (values come the db), _eg. Keycloak, Nextcloud Hub_

* End of the insertion Authentication method

* Begin of the insertionExternal:

End of the insertion Begin of the deletion SSO, requires ID of client in JWTs

End of the deletion * Begin of the insertionSSO: 1 input ("Subject claim")

* Caption: _For example, for Keycloak, this is the UUID of the service account associatedEnd of the insertion Begin of the deletion OAuth2, provides userEnd of the deletion with Begin of the insertionthe SCIM client. Check the documentation to how to find the subject claim for your use case._

* Internal, two optiond

* OAuth2:

* outputsEnd of the insertion client ID and secret Begin of the insertion_(regular style comparable to storages)_

End of the insertion Begin of the deletion

End of the deletion * Static access Begin of the insertiontoken

* outputs token ID

* info: expires in 1 year, can be renewed

* Configured SCIMs clients are visible in a borderBox list, with actions:

* Delete (Danger dialog, _come up with text_)

* Edit

* Edit page is like create page

* For generated access tokens, there's a list of available ones with two info:

* Token generation date

* Expiry date

* Actions: delete

* Note: the context of the token (so the actual token value itself) cannot be shown, it's a one-time thing

* The admin can generate additional tokens (create action)


End of the insertion Begin of the deletion token, requires expiration


End of the deletion **Permissions and visibility considerations**

* Administrators


**Translation considerations**

* Begin of the insertion_TODO: check existing keys_


**Out of scope**

* Choosing TTL of generated tokens

* Reminder emails to admins about expiring and/or expired tokens

* Identity of who generated or deleted tokens (for auditing)End of the insertion Begin of the deletion _TODO_End of the deletion