# Feature SI-22 - User interface for OIDC (OpenID Connect) provider configuration

Project: Stream Integration Basics
Status: closed
URL: https://community.openproject.org/work_packages/SI-22

## Planning

| Attribute | Value |
| --- | --- |
| Date |  |
| Priority | Medium |
| Target versions | 15.0.0 |
| Votes |  |
| List |  |
| Roadmap |  |
| Relevance |  |

## OPEN POINTS / FEEDBACK

| ID | Subject | Status | Decision |
| --- | --- | --- | --- |
| SI-16 | Should OIDC provider configs be stored in the database? | resolved | Yes, we should. |
| SI-20 | Should it be one general form or multiple forms? | resolved | Multiple forms |
| SI-21 | Should we use OIDC discovery endpoint to prefill form? | resolved | Yes |
| SI-23 | Should it be a major release? 15.0 or 14.6? | resolved | Should be released with 15.0 |
| SI-30 | Where should OIDC configuration deletion happen? | resolved | On OIDC show page. |
| SI-31 | Do we really need gray header section in the form? | decided | We keep the sections similar to similar |
| SI-34 | How to deal with deleting SSO providers | decided | First, implement a danger zone warning like in File storage. Step 2: Parimal will Primerise the danger zone in a separate WP. |
| SI-38 | Should the menu point be called 'OIDC providers' or 'OpenID providers'? | decided | We will use "OpenID providers" |

## Features and Chunks

| ID | Subject | Type | Status | Assignee | Target versions | Spent time |
| --- | --- | --- | --- | --- | --- | --- |
| SI-17 | Create AuthProvider model to store OIDC and SAML configurations. | Implementation | closed |  |  |  |
| SI-18 | Implement seeder to populate auth_providers table with oidc configuration data. | Implementation | closed | Pavel Balashou |  |  |
| SI-19 | Implement a form for OIDC providers. | Implementation | closed | Pavel Balashou |  |  |

## Bugs and other work packages

| ID | Type | Subject | Status | Assignee | Target versions | Spent time | Module |
| --- | --- | --- | --- | --- | --- | --- | --- |
| SI-36 | Bug | Typo in OpenID setup text | closed |  | 15.0.0 |  |  |
| SI-37 | Bug | Blank state is not uptodate for OpenID | rejected |  |  |  |  |

## Technical Details

| Attribute | Value |
| --- | --- |
| Module |  |
| Feature Flag |  |
| Requires doc change | Yes |
| Enterprise plan |  |

## Details

| Attribute | Value |
| --- | --- |
| Pull preview |  |
| Mockups | https://www.figma.com/design/RZn5wOqQlfNFREwHXf9dfX/OpenID-Connect-(OIDC)-Admin-Settings?node-id=0-1 |
| Accessibility | No |

## People

| Attribute | Value |
| --- | --- |
| Assignee |  |
| Accountable | Dominic Bräunlein |
| Product manager |  |
| Developers | OP Dev Titan Team |
| Designer | Parimal Satyal |
| Ordered by |  |
| Signed off by |  |
| Interest by |  |

## Estimates and progress

| Attribute | Value |
| --- | --- |
| PD (min) |  |
| PD (max) |  |
| Work |  |
| Labor costs |  |

## Description

<br>

**As** an OpenProject admin  
**I want to** be able to configure OpenID provider using a user interface  
**so that** I don't have to use a command line and can see potential errors more easily.

**Acceptance criteria**

  - **Navigation**
    
      - OpenID provider configurations are accessible under Administration -\> Authentication -\> OIDC providers

  - **Index page**
    
      - When no OIDC providers are setup show a BlankSlate
    
      - When OIDC providers are setup show all complete and incomplete OIDC providers
        
          - Show name, type, users, "created by" and "created on"
    
      - When a provider is incomplete (see below required fields) show the "incomplete" tag

  - **Add Button**
    
      - The admin can add a new OIDC provider" by clicking on the "Add OIDC provider" button
        
          - This button is a drop down like for adding a storage
        
          - The dropdown shows following options
            
              - Google
            
              - Microsoft Entra
            
              - Custom

  - **Create form**
    
      - Basic details
        
          - Name needs to be filled by admin
    
      - Automatic configuration
        
          - The user should be able to optionally use a Discovery endpoint
        
          - After entering the URL, the form will fetch data from the OpenID Discovery endpoint
        
          - After getting a successful response the form copies the fetched values into the form (see attributes above)
        
          - After a unsuccessful response show an error message
        
          - This endpoint will fill the inputs in the next section (Advanced configuration)
        
          - Advanced configuration
            
              - Show a info box when the information was supplied through automatic configuration
            
              - The inputs are editable
            
              - All inputs
                
                  - authorization\_endpoint (required)
                
                  - userinfo\_endpoint (required)
                
                  - token\_endpoint (required)
                
                  - end\_session\_endpoint
                
                  - jwks\_uri
                
                  - issuer (required)
                
                  - optiional logo
    
      - Client Details
        
          - Admin needs to fill "Client ID" and "Client Secret"
        
          - "Limit self-registration" is optional
    
      - Attribute mapping
        
          - Optional definition of attributes in userinfo endpoint to map to OpenProject attributes
        
          - login, email, first and last names
    
      - When "Google" was chosen
        
          - The Google discovery endpoint is already known. Therefore the UX should be simplified.
        
          - Automatic and Advanced configuration sections are not shown
    
      - When  "Entra" was chosen
        
          - An extra input called Tenant" (string - default value "common") is shown in "Basic details"
        
          - Entra discovery endpoint can be constructed from tenant. By default it should be `common`.
        
          - Admin should be able to change tenant.