# Feature SI-170 - Manage primary authentication methods

Project: Stream Integration Basics
Status: in specification
URL: https://community.openproject.org/work_packages/SI-170

## Planning

| Attribute | Value |
| --- | --- |
| Date | 2025-06-13 –  |
| Priority | Low |
| Target versions | Wish List |
| Votes |  |
| List |  |
| Roadmap |  |
| Relevance |  |

## OPEN POINTS / FEEDBACK

_No work packages_

## Features and Chunks

_No work packages_

## Bugs and other work packages

_No work packages_

## Technical Details

| Attribute | Value |
| --- | --- |
| Module |  |
| Feature Flag |  |
| Requires doc change | No |
| Enterprise plan |  |

## Details

| Attribute | Value |
| --- | --- |
| Pull preview |  |
| Mockups |  |
| Accessibility | No |

## People

| Attribute | Value |
| --- | --- |
| Assignee |  |
| Accountable | Pavel Balashou |
| Product manager |  |
| Developers | OP Dev Titan Team |
| Designer | Parimal Satyal |
| Ordered by |  |
| Signed off by |  |
| Interest by |  |

## Estimates and progress

| Attribute | Value |
| --- | --- |
| PD (min) |  |
| PD (max) |  |
| Work |  |
| Labor costs |  |

## Description

**As** a user  
**I want to** rework the "change password page",  
**so that** I can see and manage whether login through password is possible for my account.

**Context**

Initially the intention was that logging in through an SSO provider would clear one's password and only allow for login via SSO. However, there was/is a bug, that when an existing account (with password login) authenticates via SSO and the SSO provider is subsequently added to the account via the "remap existing account" feature, the password login would still be possible.

This bug turned out to be a desired feature for some customers, which leaves us in a position where it's hard to fix the bug, but we don't really support this setup either.

**Acceptance criteria**

(Suggestion from Jan to be turned into Design and then back into Acceptance criteria)

  - Rename (account preferences) menu item "Change password" to "Password & Login"

  - View of that menu is split in two sections:
    
      - 1: Password
        
          - If a password is set
            
              - Shows last time password was changed ("x days ago")
            
              - allows to open change password modal via button
            
              - allows to remove password via button
                
                  - only if SSO account exists
        
          - If no password is set
            
              - shows that no password is set
            
              - allows to create a password via button
                
                  - only if allowed by admin (to be determined where/how)
    
      - 2: SSO accounts
        
          - Lists all connected SSO accounts
        
          - allows to unlink an SSO account
            
              - only if password or other SSO account exists
            
              - only if allowed by admin (to be determined where/how)

**Permissions and visibility considerations**

  - to be determined: What should admins be able to allow/disallow here?
    
      - this potentially requires change of existing instance-level settings

**Translation considerations**

  - 
    <br>

**Out of scope**

  - admin-level mass-changes, e.g. "remove password from everyone"