From 5ea26dc7eafd014e648c358a252ff95022bc8dc4 Mon Sep 17 00:00:00 2001
From: Randall Morey <randall@randallmorey.com>
Date: Tue, 25 May 2021 17:36:28 -0400
Subject: [PATCH 1/8] feature: add array fields to oidc form

---
 addons/core/translations/en-us.yaml           |   2 +
 addons/core/translations/form/en-us.yaml      |  30 ++
 .../styles/rose/components/table/_table.scss  |   8 +-
 .../form/auth-method/oidc/index.hbs           | 273 +++++++++++++++++-
 .../components/form/auth-method/oidc/index.js |  17 ++
 5 files changed, 328 insertions(+), 2 deletions(-)
 create mode 100644 ui/admin/app/components/form/auth-method/oidc/index.js

diff --git a/addons/core/translations/en-us.yaml b/addons/core/translations/en-us.yaml
index 56621bf33..5370c7e75 100644
--- a/addons/core/translations/en-us.yaml
+++ b/addons/core/translations/en-us.yaml
@@ -27,6 +27,8 @@ titles:
   abandon-confirm: Discard unsaved changes?
   toggle-color-theme: Toggle Color Theme
   welcome-to-boundary: Welcome to Boundary
+  label: Label
+  value: Value
 descriptions:
   empty-set: There are no items to display yet.  You may be able to add items or try back later.
   origin-initialization: To get started, please enter your origin URL
diff --git a/addons/core/translations/form/en-us.yaml b/addons/core/translations/form/en-us.yaml
index 974b2d313..1345b4509 100644
--- a/addons/core/translations/form/en-us.yaml
+++ b/addons/core/translations/form/en-us.yaml
@@ -70,3 +70,33 @@ disable_discovered_config_validation:
   label: Disable discovered config validation
   help: >
     If the Authorization Server's discovered configuration contains values that do not match the configuration set on this auth method, this can be set to force the local configuration to override the discovered values.  This is useful in the case of slow-changing or incorrect values announced by the Authorization Server. NOTE: For safety, not providing this value will be treated the same as "false"; that is, every time the method is updated or the state is changed, this value must be set to "true" or it will be disabled.
+idp_ca_certs:
+  label: Certificates
+  help: Optional PEM-encoded X.509 CA certificates that can be used as trust anchors when connecting to an OIDC provider.
+certificate:
+  label: Certificate
+allowed_audiences:
+  label: Allowed Audiences
+  help: Allowed audience claims for this auth method.
+claim:
+  label: Claim
+claims_scopes:
+  label: Claims Scopes
+  help: Optional claims scopes that will be requested during authentication.
+claims_scope:
+  label: Claims Scope
+account_claim_maps:
+  label: Account Claim Maps
+  help: >
+    Optional claim maps from custom claims to the standard claims of sub, name and email.  These maps are represented as key=value where the key equals the from_claim and the value equals the to_claim.  For example "oid=sub".
+account_claim_map:
+  label: Account Claim Map
+from_claim:
+  label: From Claim
+to_claim:
+  label: To Claim
+signing_algorithms:
+  label: Signing Algorithms
+  help: The signing algorithms allowed for the auth method.
+algorithm:
+  label: Algorithm
diff --git a/addons/rose/addon/styles/rose/components/table/_table.scss b/addons/rose/addon/styles/rose/components/table/_table.scss
index 81a815a24..c4a839020 100644
--- a/addons/rose/addon/styles/rose/components/table/_table.scss
+++ b/addons/rose/addon/styles/rose/components/table/_table.scss
@@ -11,13 +11,19 @@
   }
 
   // This styles are add to stop the input to apply extra margin (default on forms)
+  .rose-form-input,
   .rose-form-input-field,
   .rose-form-select,
-  .rose-form-input {
+  .rose-form-select-field {
     margin: 0;
     width: 100%;
   }
 
+  // Fix margin issue with textarea elements inside tables
+  textarea {
+    display: block;
+  }
+
   .rose-table-cell,
   .rose-table-header-cell {
     vertical-align: middle;
diff --git a/ui/admin/app/components/form/auth-method/oidc/index.hbs b/ui/admin/app/components/form/auth-method/oidc/index.hbs
index f157e5090..c7ac8ad4a 100644
--- a/ui/admin/app/components/form/auth-method/oidc/index.hbs
+++ b/ui/admin/app/components/form/auth-method/oidc/index.hbs
@@ -119,6 +119,277 @@
     {{/if}}
   </form.input>
 
+  {{! Signing Algorithms }}
+  <Rose::Form::Fieldset>
+    <:title>{{t 'form.signing_algorithms.label'}}</:title>
+    <:description>{{t 'form.signing_algorithms.help'}}</:description>
+    <:body>
+      <Rose::Table @style="condensed" as |table|>
+        <table.header as |header|>
+          <header.row @hidden={{true}} as |row|>
+            <row.headerCell>{{t 'titles.value'}}</row.headerCell>
+            <row.headerCell>{{t 'titles.actions'}}</row.headerCell>
+          </header.row>
+        </table.header>
+        <table.body as |body|>
+          {{#each @model.attributes.signing_algorithms as |algorithm i|}}
+            <body.row as |row|>
+              <row.cell>
+                <form.select
+                  @value={{algorithm.value}}
+                  @error={{@model.errors.attributes.signing_algorithms}}
+                  @contextual={{true}}
+                  @onChange={{fn (mut algorithm.value)}}
+                as |field|>
+                  <field.label>{{t 'form.algorithm.label'}}</field.label>
+                  <field.field as |select|>
+                    {{#each this.signingAlgorithms as |algorithm|}}
+                      <select.option @value={{algorithm}}>{{algorithm}}</select.option>
+                    {{/each}}
+                  </field.field>
+                  {{#if @model.errors.attributes.signing_algorithms}}
+                    <field.errors as |errors|>
+                      {{#each @model.errors.attributes.signing_algorithms as |error|}}
+                        <errors.message>{{error.message}}</errors.message>
+                      {{/each}}
+                    </field.errors>
+                  {{/if}}
+                </form.select>
+              </row.cell>
+              <row.cell @shrink={{true}}>
+                <Rose::Button
+                  @style='secondary'
+                  @iconOnly='trash'
+                  title={{t 'actions.remove'}}
+                >
+                  {{t 'actions.remove'}}
+                </Rose::Button>
+              </row.cell>
+            </body.row>
+          {{/each}}
+        </table.body>
+      </Rose::Table>
+    </:body>
+  </Rose::Form::Fieldset>
+
+  {{! Certificates }}
+  <Rose::Form::Fieldset>
+    <:title>{{t 'form.idp_ca_certs.label'}}</:title>
+    <:description>{{t 'form.idp_ca_certs.help'}}</:description>
+    <:body>
+      <Rose::Table @style="condensed" as |table|>
+        <table.header as |header|>
+          <header.row @hidden={{true}} as |row|>
+            <row.headerCell>{{t 'titles.value'}}</row.headerCell>
+            <row.headerCell>{{t 'titles.actions'}}</row.headerCell>
+          </header.row>
+        </table.header>
+        <table.body as |body|>
+          {{#each @model.attributes.idp_ca_certs as |cert i|}}
+            <body.row as |row|>
+              <row.cell>
+                <form.textarea
+                  @value={{cert.value}}
+                  @error={{@model.errors.attributes.idp_ca_certs}}
+                  @contextual={{true}}
+                as |field|>
+                  <field.label>{{t 'form.certificate.label'}}</field.label>
+                  <field.field />
+                  {{#if @model.errors.attributes.idp_ca_certs}}
+                    <field.errors as |errors|>
+                      {{#each @model.errors.attributes.idp_ca_certs as |error|}}
+                        <errors.message>{{error.message}}</errors.message>
+                      {{/each}}
+                    </field.errors>
+                  {{/if}}
+                </form.textarea>
+              </row.cell>
+              <row.cell @shrink={{true}}>
+                <Rose::Button
+                  @style='secondary'
+                  @iconOnly='trash'
+                  title={{t 'actions.remove'}}
+                >
+                  {{t 'actions.remove'}}
+                </Rose::Button>
+              </row.cell>
+            </body.row>
+          {{/each}}
+        </table.body>
+      </Rose::Table>
+    </:body>
+  </Rose::Form::Fieldset>
+
+  {{! Allowed Audiences }}
+  <Rose::Form::Fieldset>
+    <:title>{{t 'form.allowed_audiences.label'}}</:title>
+    <:description>{{t 'form.allowed_audiences.help'}}</:description>
+    <:body>
+      <Rose::Table @style="condensed" as |table|>
+        <table.header as |header|>
+          <header.row @hidden={{true}} as |row|>
+            <row.headerCell>{{t 'titles.value'}}</row.headerCell>
+            <row.headerCell>{{t 'titles.actions'}}</row.headerCell>
+          </header.row>
+        </table.header>
+        <table.body as |body|>
+          {{#each @model.attributes.allowed_audiences as |audience i|}}
+            <body.row as |row|>
+              <row.cell>
+                <form.input
+                  @type='text'
+                  @value={{audience.value}}
+                  @error={{@model.errors.attributes.allowed_audiences}}
+                  @contextual={{true}}
+                as |field|>
+                  <field.label>{{t 'form.claim.label'}}</field.label>
+                  <field.field />
+                  {{#if @model.errors.attributes.allowed_audiences}}
+                    <field.errors as |errors|>
+                      {{#each @model.errors.attributes.allowed_audiences as |error|}}
+                        <errors.message>{{error.message}}</errors.message>
+                      {{/each}}
+                    </field.errors>
+                  {{/if}}
+                </form.input>
+              </row.cell>
+              <row.cell @shrink={{true}}>
+                <Rose::Button
+                  @style='secondary'
+                  @iconOnly='trash'
+                  title={{t 'actions.remove'}}
+                >
+                  {{t 'actions.remove'}}
+                </Rose::Button>
+              </row.cell>
+            </body.row>
+          {{/each}}
+        </table.body>
+      </Rose::Table>
+    </:body>
+  </Rose::Form::Fieldset>
+
+  {{! Claims Scopes }}
+  <Rose::Form::Fieldset>
+    <:title>{{t 'form.claims_scopes.label'}}</:title>
+    <:description>{{t 'form.claims_scopes.help'}}</:description>
+    <:body>
+      <Rose::Table @style="condensed" as |table|>
+        <table.header as |header|>
+          <header.row @hidden={{true}} as |row|>
+            <row.headerCell>{{t 'titles.value'}}</row.headerCell>
+            <row.headerCell></row.headerCell>
+          </header.row>
+        </table.header>
+        <table.body as |body|>
+          {{#each @model.attributes.claims_scopes as |claimsScope i|}}
+            <body.row as |row|>
+              <row.cell>
+                <form.input
+                  @type='text'
+                  @value={{claimsScope.value}}
+                  @error={{@model.errors.attributes.claims_scopes}}
+
+                as |field|>
+                  <field.label>{{t 'form.claims_scope.label'}}</field.label>
+                  <field.field />
+                  {{#if @model.errors.attributes.claims_scopes}}
+                    <field.errors as |errors|>
+                      {{#each @model.errors.attributes.claims_scopes as |error|}}
+                        <errors.message>{{error.message}}</errors.message>
+                      {{/each}}
+                    </field.errors>
+                  {{/if}}
+                </form.input>
+              </row.cell>
+              <row.cell @shrink={{true}}>
+                <Rose::Button
+                  @style='secondary'
+                  @iconOnly='trash'
+                  title={{t 'actions.remove'}}
+                >
+                  {{t 'actions.remove'}}
+                </Rose::Button>
+              </row.cell>
+            </body.row>
+          {{/each}}
+        </table.body>
+      </Rose::Table>
+    </:body>
+  </Rose::Form::Fieldset>
+
+  {{! Account Claim Maps }}
+  <Rose::Form::Fieldset>
+    <:title>{{t 'form.account_claim_maps.label'}}</:title>
+    <:description>{{t 'form.account_claim_maps.help'}}</:description>
+    <:body>
+      <Rose::Table @style="condensed" as |table|>
+        <table.header as |header|>
+          <header.row as |row|>
+            <row.headerCell>{{t 'form.from_claim.label'}}</row.headerCell>
+            <row.headerCell>{{t 'form.to_claim.label'}}</row.headerCell>
+            <row.headerCell>{{t 'titles.actions'}}</row.headerCell>
+          </header.row>
+        </table.header>
+        <table.body as |body|>
+          {{#each @model.attributes.account_claim_maps as |claimMap i|}}
+            <body.row as |row|>
+              <row.cell>
+                <form.input
+                  @type='text'
+                  @value={{claimMap.from}}
+                  @error={{@model.errors.attributes.account_claim_maps}}
+                  @contextual={{true}}
+                as |field|>
+                  <field.label>{{t 'form.from_claim.label'}}</field.label>
+                  <field.field />
+                  {{#if @model.errors.attributes.account_claim_maps}}
+                    <field.errors as |errors|>
+                      {{#each @model.errors.attributes.account_claim_maps as |error|}}
+                        <errors.message>{{error.message}}</errors.message>
+                      {{/each}}
+                    </field.errors>
+                  {{/if}}
+                </form.input>
+              </row.cell>
+              <row.cell>
+                <form.select
+                  @value={{claimMap.to}}
+                  @error={{@model.errors.attributes.account_claim_maps}}
+                  @contextual={{true}}
+                  @onChange={{fn (mut claimMap.to)}}
+                as |field|>
+                  <field.label>{{t 'form.to_claim.label'}}</field.label>
+                  <field.field as |select|>
+                    {{#each this.toClaims as |toClaim|}}
+                      <select.option @value={{toClaim}}>{{toClaim}}</select.option>
+                    {{/each}}
+                  </field.field>
+                  {{#if @model.errors.attributes.account_claim_maps}}
+                    <field.errors as |errors|>
+                      {{#each @model.errors.attributes.account_claim_maps as |error|}}
+                        <errors.message>{{error.message}}</errors.message>
+                      {{/each}}
+                    </field.errors>
+                  {{/if}}
+                </form.select>
+              </row.cell>
+              <row.cell @shrink={{true}}>
+                <Rose::Button
+                  @style='secondary'
+                  @iconOnly='trash'
+                  title={{t 'actions.remove'}}
+                >
+                  {{t 'actions.remove'}}
+                </Rose::Button>
+              </row.cell>
+            </body.row>
+          {{/each}}
+        </table.body>
+      </Rose::Table>
+    </:body>
+  </Rose::Form::Fieldset>
+
   <form.input
     @name='max_age'
     @type='number'
@@ -165,4 +436,4 @@
     @submitText={{t 'actions.save'}}
     @cancelText={{t 'actions.cancel'}}
   />
-</Rose::Form>
\ No newline at end of file
+</Rose::Form>
diff --git a/ui/admin/app/components/form/auth-method/oidc/index.js b/ui/admin/app/components/form/auth-method/oidc/index.js
new file mode 100644
index 000000000..4e4ac6f8b
--- /dev/null
+++ b/ui/admin/app/components/form/auth-method/oidc/index.js
@@ -0,0 +1,17 @@
+import Component from '@glimmer/component';
+import { options } from 'api/models/auth-method';
+
+export default class FormAuthMethodOidcComponent extends Component {
+
+  // =attributes
+  /**
+   * @type {object}
+   */
+  signingAlgorithms = options.oidc.signing_algorithms;
+
+  /**
+   * @type {object}
+   */
+  toClaims = options.oidc.account_claim_maps.to;
+
+}

From 8c20d2980619a556ccdfa43be89f082ffec1acbe Mon Sep 17 00:00:00 2001
From: Randall Morey <randall@randallmorey.com>
Date: Wed, 26 May 2021 15:28:41 -0400
Subject: [PATCH 2/8] =?UTF-8?q?feat:=20=F0=9F=8E=B8=20add=20remove=20array?=
 =?UTF-8?q?=20item=20support=20to=20oidc=20form?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../rose/addon/components/rose/form/index.hbs |   1 +
 .../rose/components/form/_fieldset.scss       |   2 +
 .../app/components/form/auth-method/index.hbs |   1 +
 .../form/auth-method/oidc/index.hbs           | 194 +++++++++++-------
 .../components/form/auth-method/oidc/index.js |   2 -
 .../app/routes/scopes/scope/auth-methods.js   |  14 ++
 ui/admin/app/styles/app.scss                  |  12 +-
 .../scope/auth-methods/auth-method/index.hbs  |   1 +
 8 files changed, 148 insertions(+), 79 deletions(-)

diff --git a/addons/rose/addon/components/rose/form/index.hbs b/addons/rose/addon/components/rose/form/index.hbs
index 80b027371..8c545ec22 100644
--- a/addons/rose/addon/components/rose/form/index.hbs
+++ b/addons/rose/addon/components/rose/form/index.hbs
@@ -30,5 +30,6 @@
       cancel=this.handleCancel
       enableEdit=this.enableEdit
     )
+    isEditable=this.isEditable
   )}}
 </form>
diff --git a/addons/rose/addon/styles/rose/components/form/_fieldset.scss b/addons/rose/addon/styles/rose/components/form/_fieldset.scss
index 8696ad562..d0b35d2ea 100644
--- a/addons/rose/addon/styles/rose/components/form/_fieldset.scss
+++ b/addons/rose/addon/styles/rose/components/form/_fieldset.scss
@@ -2,6 +2,8 @@
 @use '../../utilities/type';
 
 .rose-form-fieldset {
+  margin-bottom: sizing.rems(m);
+  
   .rose-form-fieldset-title {
     @include type.type(l, bold);
   }
diff --git a/ui/admin/app/components/form/auth-method/index.hbs b/ui/admin/app/components/form/auth-method/index.hbs
index 478c2ea91..9ac27859f 100644
--- a/ui/admin/app/components/form/auth-method/index.hbs
+++ b/ui/admin/app/components/form/auth-method/index.hbs
@@ -4,5 +4,6 @@
     model=@model
     submit=@submit
     cancel=@cancel
+    removeItemByIndex=@removeItemByIndex
   }}
 {{/if}}
\ No newline at end of file
diff --git a/ui/admin/app/components/form/auth-method/oidc/index.hbs b/ui/admin/app/components/form/auth-method/oidc/index.hbs
index c7ac8ad4a..a0ababf3d 100644
--- a/ui/admin/app/components/form/auth-method/oidc/index.hbs
+++ b/ui/admin/app/components/form/auth-method/oidc/index.hbs
@@ -39,7 +39,6 @@
     @label={{t 'form.description.label'}}
     @helperText={{t 'form.description.help'}}
     @error={{@model.errors.description}}
-    disabled={{@model.isSaving}}
     readonly={{false}}
     as |field|
   >
@@ -124,7 +123,7 @@
     <:title>{{t 'form.signing_algorithms.label'}}</:title>
     <:description>{{t 'form.signing_algorithms.help'}}</:description>
     <:body>
-      <Rose::Table @style="condensed" as |table|>
+      <Rose::Table @style='condensed' as |table|>
         <table.header as |header|>
           <header.row @hidden={{true}} as |row|>
             <row.headerCell>{{t 'titles.value'}}</row.headerCell>
@@ -140,16 +139,22 @@
                   @error={{@model.errors.attributes.signing_algorithms}}
                   @contextual={{true}}
                   @onChange={{fn (mut algorithm.value)}}
-                as |field|>
+                  as |field|
+                >
                   <field.label>{{t 'form.algorithm.label'}}</field.label>
                   <field.field as |select|>
                     {{#each this.signingAlgorithms as |algorithm|}}
-                      <select.option @value={{algorithm}}>{{algorithm}}</select.option>
+                      <select.option
+                        @value={{algorithm}}
+                      >{{algorithm}}</select.option>
                     {{/each}}
                   </field.field>
                   {{#if @model.errors.attributes.signing_algorithms}}
                     <field.errors as |errors|>
-                      {{#each @model.errors.attributes.signing_algorithms as |error|}}
+                      {{#each
+                        @model.errors.attributes.signing_algorithms
+                        as |error|
+                      }}
                         <errors.message>{{error.message}}</errors.message>
                       {{/each}}
                     </field.errors>
@@ -158,57 +163,14 @@
               </row.cell>
               <row.cell @shrink={{true}}>
                 <Rose::Button
-                  @style='secondary'
-                  @iconOnly='trash'
-                  title={{t 'actions.remove'}}
-                >
-                  {{t 'actions.remove'}}
-                </Rose::Button>
-              </row.cell>
-            </body.row>
-          {{/each}}
-        </table.body>
-      </Rose::Table>
-    </:body>
-  </Rose::Form::Fieldset>
-
-  {{! Certificates }}
-  <Rose::Form::Fieldset>
-    <:title>{{t 'form.idp_ca_certs.label'}}</:title>
-    <:description>{{t 'form.idp_ca_certs.help'}}</:description>
-    <:body>
-      <Rose::Table @style="condensed" as |table|>
-        <table.header as |header|>
-          <header.row @hidden={{true}} as |row|>
-            <row.headerCell>{{t 'titles.value'}}</row.headerCell>
-            <row.headerCell>{{t 'titles.actions'}}</row.headerCell>
-          </header.row>
-        </table.header>
-        <table.body as |body|>
-          {{#each @model.attributes.idp_ca_certs as |cert i|}}
-            <body.row as |row|>
-              <row.cell>
-                <form.textarea
-                  @value={{cert.value}}
-                  @error={{@model.errors.attributes.idp_ca_certs}}
-                  @contextual={{true}}
-                as |field|>
-                  <field.label>{{t 'form.certificate.label'}}</field.label>
-                  <field.field />
-                  {{#if @model.errors.attributes.idp_ca_certs}}
-                    <field.errors as |errors|>
-                      {{#each @model.errors.attributes.idp_ca_certs as |error|}}
-                        <errors.message>{{error.message}}</errors.message>
-                      {{/each}}
-                    </field.errors>
-                  {{/if}}
-                </form.textarea>
-              </row.cell>
-              <row.cell @shrink={{true}}>
-                <Rose::Button
-                  @style='secondary'
+                  @style='warning'
                   @iconOnly='trash'
                   title={{t 'actions.remove'}}
+                  @disabled={{if form.isEditable false true}}
+                  {{on
+                    'click'
+                    (fn @removeItemByIndex 'attributes.signing_algorithms' i)
+                  }}
                 >
                   {{t 'actions.remove'}}
                 </Rose::Button>
@@ -225,7 +187,7 @@
     <:title>{{t 'form.allowed_audiences.label'}}</:title>
     <:description>{{t 'form.allowed_audiences.help'}}</:description>
     <:body>
-      <Rose::Table @style="condensed" as |table|>
+      <Rose::Table @style='condensed' as |table|>
         <table.header as |header|>
           <header.row @hidden={{true}} as |row|>
             <row.headerCell>{{t 'titles.value'}}</row.headerCell>
@@ -241,12 +203,16 @@
                   @value={{audience.value}}
                   @error={{@model.errors.attributes.allowed_audiences}}
                   @contextual={{true}}
-                as |field|>
+                  as |field|
+                >
                   <field.label>{{t 'form.claim.label'}}</field.label>
                   <field.field />
                   {{#if @model.errors.attributes.allowed_audiences}}
                     <field.errors as |errors|>
-                      {{#each @model.errors.attributes.allowed_audiences as |error|}}
+                      {{#each
+                        @model.errors.attributes.allowed_audiences
+                        as |error|
+                      }}
                         <errors.message>{{error.message}}</errors.message>
                       {{/each}}
                     </field.errors>
@@ -255,9 +221,14 @@
               </row.cell>
               <row.cell @shrink={{true}}>
                 <Rose::Button
-                  @style='secondary'
+                  @style='warning'
                   @iconOnly='trash'
                   title={{t 'actions.remove'}}
+                  @disabled={{if form.isEditable false true}}
+                  {{on
+                    'click'
+                    (fn @removeItemByIndex 'attributes.allowed_audiences' i)
+                  }}
                 >
                   {{t 'actions.remove'}}
                 </Rose::Button>
@@ -274,11 +245,11 @@
     <:title>{{t 'form.claims_scopes.label'}}</:title>
     <:description>{{t 'form.claims_scopes.help'}}</:description>
     <:body>
-      <Rose::Table @style="condensed" as |table|>
+      <Rose::Table @style='condensed' as |table|>
         <table.header as |header|>
           <header.row @hidden={{true}} as |row|>
             <row.headerCell>{{t 'titles.value'}}</row.headerCell>
-            <row.headerCell></row.headerCell>
+            <row.headerCell />
           </header.row>
         </table.header>
         <table.body as |body|>
@@ -289,13 +260,17 @@
                   @type='text'
                   @value={{claimsScope.value}}
                   @error={{@model.errors.attributes.claims_scopes}}
-
-                as |field|>
+                  @contextual={{true}}
+                  as |field|
+                >
                   <field.label>{{t 'form.claims_scope.label'}}</field.label>
                   <field.field />
                   {{#if @model.errors.attributes.claims_scopes}}
                     <field.errors as |errors|>
-                      {{#each @model.errors.attributes.claims_scopes as |error|}}
+                      {{#each
+                        @model.errors.attributes.claims_scopes
+                        as |error|
+                      }}
                         <errors.message>{{error.message}}</errors.message>
                       {{/each}}
                     </field.errors>
@@ -304,9 +279,14 @@
               </row.cell>
               <row.cell @shrink={{true}}>
                 <Rose::Button
-                  @style='secondary'
+                  @style='warning'
                   @iconOnly='trash'
                   title={{t 'actions.remove'}}
+                  @disabled={{if form.isEditable false true}}
+                  {{on
+                    'click'
+                    (fn @removeItemByIndex 'attributes.claims_scopes' i)
+                  }}
                 >
                   {{t 'actions.remove'}}
                 </Rose::Button>
@@ -323,7 +303,7 @@
     <:title>{{t 'form.account_claim_maps.label'}}</:title>
     <:description>{{t 'form.account_claim_maps.help'}}</:description>
     <:body>
-      <Rose::Table @style="condensed" as |table|>
+      <Rose::Table @style='condensed' as |table|>
         <table.header as |header|>
           <header.row as |row|>
             <row.headerCell>{{t 'form.from_claim.label'}}</row.headerCell>
@@ -340,12 +320,16 @@
                   @value={{claimMap.from}}
                   @error={{@model.errors.attributes.account_claim_maps}}
                   @contextual={{true}}
-                as |field|>
+                  as |field|
+                >
                   <field.label>{{t 'form.from_claim.label'}}</field.label>
                   <field.field />
                   {{#if @model.errors.attributes.account_claim_maps}}
                     <field.errors as |errors|>
-                      {{#each @model.errors.attributes.account_claim_maps as |error|}}
+                      {{#each
+                        @model.errors.attributes.account_claim_maps
+                        as |error|
+                      }}
                         <errors.message>{{error.message}}</errors.message>
                       {{/each}}
                     </field.errors>
@@ -358,16 +342,22 @@
                   @error={{@model.errors.attributes.account_claim_maps}}
                   @contextual={{true}}
                   @onChange={{fn (mut claimMap.to)}}
-                as |field|>
+                  as |field|
+                >
                   <field.label>{{t 'form.to_claim.label'}}</field.label>
                   <field.field as |select|>
                     {{#each this.toClaims as |toClaim|}}
-                      <select.option @value={{toClaim}}>{{toClaim}}</select.option>
+                      <select.option
+                        @value={{toClaim}}
+                      >{{toClaim}}</select.option>
                     {{/each}}
                   </field.field>
                   {{#if @model.errors.attributes.account_claim_maps}}
                     <field.errors as |errors|>
-                      {{#each @model.errors.attributes.account_claim_maps as |error|}}
+                      {{#each
+                        @model.errors.attributes.account_claim_maps
+                        as |error|
+                      }}
                         <errors.message>{{error.message}}</errors.message>
                       {{/each}}
                     </field.errors>
@@ -376,9 +366,14 @@
               </row.cell>
               <row.cell @shrink={{true}}>
                 <Rose::Button
-                  @style='secondary'
+                  @style='warning'
                   @iconOnly='trash'
                   title={{t 'actions.remove'}}
+                  @disabled={{if form.isEditable false true}}
+                  {{on
+                    'click'
+                    (fn @removeItemByIndex 'attributes.account_claim_maps' i)
+                  }}
                 >
                   {{t 'actions.remove'}}
                 </Rose::Button>
@@ -390,6 +385,61 @@
     </:body>
   </Rose::Form::Fieldset>
 
+  {{! Certificates }}
+  <Rose::Form::Fieldset>
+    <:title>{{t 'form.idp_ca_certs.label'}}</:title>
+    <:description>{{t 'form.idp_ca_certs.help'}}</:description>
+    <:body>
+      <Rose::Table @style='condensed' as |table|>
+        <table.header as |header|>
+          <header.row @hidden={{true}} as |row|>
+            <row.headerCell>{{t 'titles.value'}}</row.headerCell>
+            <row.headerCell>{{t 'titles.actions'}}</row.headerCell>
+          </header.row>
+        </table.header>
+        <table.body as |body|>
+          {{#each @model.attributes.idp_ca_certs as |cert i|}}
+            <body.row as |row|>
+              <row.cell>
+                <form.textarea
+                  @value={{cert.value}}
+                  @error={{@model.errors.attributes.idp_ca_certs}}
+                  @contextual={{true}}
+                  as |field|
+                >
+                  <field.label>{{t 'form.certificate.label'}}</field.label>
+                  <field.field />
+                  {{#if @model.errors.attributes.idp_ca_certs}}
+                    <field.errors as |errors|>
+                      {{#each @model.errors.attributes.idp_ca_certs as |error|}}
+                        <errors.message>{{error.message}}</errors.message>
+                      {{/each}}
+                    </field.errors>
+                  {{/if}}
+                </form.textarea>
+              </row.cell>
+              <row.cell @shrink={{true}}>
+                <Rose::Button
+                  @style='warning'
+                  @iconOnly='trash'
+                  title={{t 'actions.remove'}}
+                  @disabled={{if form.isEditable false true}}
+                  {{on
+                    'click'
+                    (fn @removeItemByIndex 'attributes.idp_ca_certs' i)
+                  }}
+                >
+                  {{t 'actions.remove'}}
+                </Rose::Button>
+              </row.cell>
+            </body.row>
+          {{/each}}
+          {{! Add field }}
+        </table.body>
+      </Rose::Table>
+    </:body>
+  </Rose::Form::Fieldset>
+
   <form.input
     @name='max_age'
     @type='number'
@@ -436,4 +486,4 @@
     @submitText={{t 'actions.save'}}
     @cancelText={{t 'actions.cancel'}}
   />
-</Rose::Form>
+</Rose::Form>
\ No newline at end of file
diff --git a/ui/admin/app/components/form/auth-method/oidc/index.js b/ui/admin/app/components/form/auth-method/oidc/index.js
index 4e4ac6f8b..fd99fc353 100644
--- a/ui/admin/app/components/form/auth-method/oidc/index.js
+++ b/ui/admin/app/components/form/auth-method/oidc/index.js
@@ -2,7 +2,6 @@ import Component from '@glimmer/component';
 import { options } from 'api/models/auth-method';
 
 export default class FormAuthMethodOidcComponent extends Component {
-
   // =attributes
   /**
    * @type {object}
@@ -13,5 +12,4 @@ export default class FormAuthMethodOidcComponent extends Component {
    * @type {object}
    */
   toClaims = options.oidc.account_claim_maps.to;
-
 }
diff --git a/ui/admin/app/routes/scopes/scope/auth-methods.js b/ui/admin/app/routes/scopes/scope/auth-methods.js
index 291a9573d..d432f9b9d 100644
--- a/ui/admin/app/routes/scopes/scope/auth-methods.js
+++ b/ui/admin/app/routes/scopes/scope/auth-methods.js
@@ -134,4 +134,18 @@ export default class ScopesScopeAuthMethodsRoute extends Route {
     }
     await authMethod.reload();
   }
+
+  /**
+   * Removes an item from array `property` at `index` on the
+   * passed `authMethod`.  This is used to manage entries in fragment array
+   * fields such as `signing_algorithms`.
+   * @param {AuthMethodModel} authMethod
+   * @param {string} property
+   * @param {number} index
+   */
+  @action
+  async removeItemByIndex(authMethod, property, index) {
+    const array = authMethod.get(property);
+    array.removeAt(index);
+  }
 }
diff --git a/ui/admin/app/styles/app.scss b/ui/admin/app/styles/app.scss
index 420258319..9defaac7b 100644
--- a/ui/admin/app/styles/app.scss
+++ b/ui/admin/app/styles/app.scss
@@ -80,11 +80,13 @@
     }
   }
 
-  fieldset {
-    margin-bottom: sizing.rems(m);
-
-    legend {
-      @extend .rose-form-label;
+  .rose-form-fieldset {
+    .rose-table {
+      .rose-form-label {
+        position: absolute;
+        top: -9999px;
+        left: -9999px;
+      }
     }
   }
 }
diff --git a/ui/admin/app/templates/scopes/scope/auth-methods/auth-method/index.hbs b/ui/admin/app/templates/scopes/scope/auth-methods/auth-method/index.hbs
index b82869296..f610fc81e 100644
--- a/ui/admin/app/templates/scopes/scope/auth-methods/auth-method/index.hbs
+++ b/ui/admin/app/templates/scopes/scope/auth-methods/auth-method/index.hbs
@@ -2,4 +2,5 @@
   @model={{@model}}
   @submit={{route-action 'save' @model}}
   @cancel={{route-action 'cancel' @model}}
+  @removeItemByIndex={{route-action 'removeItemByIndex' @model}}
 />
\ No newline at end of file

From 9fe89c9b18205faae08c062a5bb28c885e0bb07b Mon Sep 17 00:00:00 2001
From: Randall Morey <randall@randallmorey.com>
Date: Wed, 26 May 2021 17:12:51 -0400
Subject: [PATCH 3/8] feature: add addItem functionality to array fields

---
 .../app/components/form/auth-method/index.hbs |   1 +
 .../form/auth-method/oidc/index.hbs           | 117 +++++++++++++++++-
 .../components/form/auth-method/oidc/index.js |   5 +
 .../app/routes/scopes/scope/auth-methods.js   |  14 +++
 .../scope/auth-methods/auth-method/index.hbs  |   1 +
 5 files changed, 137 insertions(+), 1 deletion(-)

diff --git a/ui/admin/app/components/form/auth-method/index.hbs b/ui/admin/app/components/form/auth-method/index.hbs
index 9ac27859f..048be9d25 100644
--- a/ui/admin/app/components/form/auth-method/index.hbs
+++ b/ui/admin/app/components/form/auth-method/index.hbs
@@ -5,5 +5,6 @@
     submit=@submit
     cancel=@cancel
     removeItemByIndex=@removeItemByIndex
+    addStringItem=@addStringItem
   }}
 {{/if}}
\ No newline at end of file
diff --git a/ui/admin/app/components/form/auth-method/oidc/index.hbs b/ui/admin/app/components/form/auth-method/oidc/index.hbs
index a0ababf3d..8b82c6467 100644
--- a/ui/admin/app/components/form/auth-method/oidc/index.hbs
+++ b/ui/admin/app/components/form/auth-method/oidc/index.hbs
@@ -177,6 +177,44 @@
               </row.cell>
             </body.row>
           {{/each}}
+
+          <body.row as |row|>
+            <row.cell>
+              <form.select
+                @value={{this.newSigningAlgorithm}}
+                @label={{t
+                  'resources.auth-method.titles.new-signing-algorithm'
+                }}
+                @onChange={{fn (mut this.newSigningAlgorithm)}}
+                as |field|
+              >
+                <field.field as |select|>
+                  {{#each this.signingAlgorithms as |algorithm|}}
+                    <select.option
+                      @value={{algorithm}}
+                    >{{algorithm}}</select.option>
+                  {{/each}}
+                </field.field>
+              </form.select>
+            </row.cell>
+            <row.cell @shrink={{true}}>
+              <Rose::Button
+                @style='secondary'
+                title={{t 'actions.add'}}
+                @disabled={{if form.isEditable false true}}
+                {{on
+                  'click'
+                  (fn
+                    @addStringItem
+                    'attributes.signing_algorithms'
+                    this.newSigningAlgorithm
+                  )
+                }}
+              >
+                {{t 'actions.add'}}
+              </Rose::Button>
+            </row.cell>
+          </body.row>
         </table.body>
       </Rose::Table>
     </:body>
@@ -235,6 +273,33 @@
               </row.cell>
             </body.row>
           {{/each}}
+
+          <body.row as |row|>
+            <row.cell>
+              <form.input
+                @type='text'
+                @value={{this.newAllowedAudience}}
+                @label={{t 'resources.auth-method.titles.new-allowed-audience'}}
+              />
+            </row.cell>
+            <row.cell @shrink={{true}}>
+              <Rose::Button
+                @style='secondary'
+                title={{t 'actions.add'}}
+                @disabled={{if form.isEditable false true}}
+                {{on
+                  'click'
+                  (fn
+                    @addStringItem
+                    'attributes.allowed_audiences'
+                    this.newAllowedAudience
+                  )
+                }}
+              >
+                {{t 'actions.add'}}
+              </Rose::Button>
+            </row.cell>
+          </body.row>
         </table.body>
       </Rose::Table>
     </:body>
@@ -293,6 +358,33 @@
               </row.cell>
             </body.row>
           {{/each}}
+
+          <body.row as |row|>
+            <row.cell>
+              <form.input
+                @type='text'
+                @value={{this.newClaimsScope}}
+                @label={{t 'resources.auth-method.titles.new-claims-scope'}}
+              />
+            </row.cell>
+            <row.cell @shrink={{true}}>
+              <Rose::Button
+                @style='secondary'
+                title={{t 'actions.add'}}
+                @disabled={{if form.isEditable false true}}
+                {{on
+                  'click'
+                  (fn
+                    @addStringItem
+                    'attributes.claims_scopes'
+                    this.newClaimsScope
+                  )
+                }}
+              >
+                {{t 'actions.add'}}
+              </Rose::Button>
+            </row.cell>
+          </body.row>
         </table.body>
       </Rose::Table>
     </:body>
@@ -434,7 +526,30 @@
               </row.cell>
             </body.row>
           {{/each}}
-          {{! Add field }}
+
+          <body.row as |row|>
+            <row.cell>
+              <form.textarea
+                @value={{this.newCertificate}}
+                @label={{t 'resources.auth-method.titles.new-certificate'}}
+              />
+            </row.cell>
+            <row.cell @shrink={{true}}>
+              <Rose::Button
+                @style='secondary'
+                title={{t 'actions.add'}}
+                @disabled={{if form.isEditable false true}}
+                {{on
+                  'click'
+                  (fn
+                    @addStringItem 'attributes.idp_ca_certs' this.newCertificate
+                  )
+                }}
+              >
+                {{t 'actions.add'}}
+              </Rose::Button>
+            </row.cell>
+          </body.row>
         </table.body>
       </Rose::Table>
     </:body>
diff --git a/ui/admin/app/components/form/auth-method/oidc/index.js b/ui/admin/app/components/form/auth-method/oidc/index.js
index fd99fc353..166e33561 100644
--- a/ui/admin/app/components/form/auth-method/oidc/index.js
+++ b/ui/admin/app/components/form/auth-method/oidc/index.js
@@ -12,4 +12,9 @@ export default class FormAuthMethodOidcComponent extends Component {
    * @type {object}
    */
   toClaims = options.oidc.account_claim_maps.to;
+
+  /**
+   * @type {string}
+   */
+  newSigningAlgorithm = options.oidc.signing_algorithms[0];
 }
diff --git a/ui/admin/app/routes/scopes/scope/auth-methods.js b/ui/admin/app/routes/scopes/scope/auth-methods.js
index d432f9b9d..00666c1fb 100644
--- a/ui/admin/app/routes/scopes/scope/auth-methods.js
+++ b/ui/admin/app/routes/scopes/scope/auth-methods.js
@@ -148,4 +148,18 @@ export default class ScopesScopeAuthMethodsRoute extends Route {
     const array = authMethod.get(property);
     array.removeAt(index);
   }
+
+  /**
+   * Adds a string item to array `property` on the passed `authMethod`.
+   * This is used to manage entries in fragment string array fields such
+   * as `signing_algorithms`.
+   * @param {AuthMethodModel} authMethod
+   * @param {string} property
+   * @param {string} value
+   */
+  @action
+  async addStringItem(authMethod, property, value) {
+    const array = authMethod.get(property);
+    array.addObject({ value });
+  }
 }
diff --git a/ui/admin/app/templates/scopes/scope/auth-methods/auth-method/index.hbs b/ui/admin/app/templates/scopes/scope/auth-methods/auth-method/index.hbs
index f610fc81e..2c477bb7c 100644
--- a/ui/admin/app/templates/scopes/scope/auth-methods/auth-method/index.hbs
+++ b/ui/admin/app/templates/scopes/scope/auth-methods/auth-method/index.hbs
@@ -3,4 +3,5 @@
   @submit={{route-action 'save' @model}}
   @cancel={{route-action 'cancel' @model}}
   @removeItemByIndex={{route-action 'removeItemByIndex' @model}}
+  @addStringItem={{route-action 'addStringItem' @model}}
 />
\ No newline at end of file

From e50d0ac00b8367714b0467109501b047a43bbcb4 Mon Sep 17 00:00:00 2001
From: Randall Morey <randall@randallmorey.com>
Date: Wed, 26 May 2021 18:09:28 -0400
Subject: [PATCH 4/8] =?UTF-8?q?feat:=20=F0=9F=8E=B8=20add=20account=20clai?=
 =?UTF-8?q?m=20map=20support?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../app/components/form/auth-method/index.hbs |  1 +
 .../form/auth-method/oidc/index.hbs           | 39 +++++++++++++++++++
 .../app/routes/scopes/scope/auth-methods.js   | 15 ++++++-
 .../scope/auth-methods/auth-method/index.hbs  |  1 +
 4 files changed, 55 insertions(+), 1 deletion(-)

diff --git a/ui/admin/app/components/form/auth-method/index.hbs b/ui/admin/app/components/form/auth-method/index.hbs
index 048be9d25..77cf37d4d 100644
--- a/ui/admin/app/components/form/auth-method/index.hbs
+++ b/ui/admin/app/components/form/auth-method/index.hbs
@@ -6,5 +6,6 @@
     cancel=@cancel
     removeItemByIndex=@removeItemByIndex
     addStringItem=@addStringItem
+    addAccountClaimMapItem=@addAccountClaimMapItem
   }}
 {{/if}}
\ No newline at end of file
diff --git a/ui/admin/app/components/form/auth-method/oidc/index.hbs b/ui/admin/app/components/form/auth-method/oidc/index.hbs
index 8b82c6467..335392e08 100644
--- a/ui/admin/app/components/form/auth-method/oidc/index.hbs
+++ b/ui/admin/app/components/form/auth-method/oidc/index.hbs
@@ -472,6 +472,45 @@
               </row.cell>
             </body.row>
           {{/each}}
+
+          <body.row as |row|>
+            <row.cell>
+              <form.input
+                @type='text'
+                @value={{this.newFromClaim}}
+                @label={{t 'resources.auth-method.titles.new-from-claim'}}
+              />
+            </row.cell>
+            <row.cell>
+              <form.select
+                @value={{this.newToClaim}}
+                @label={{t 'resources.auth-method.titles.new-to-claim'}}
+                @onChange={{fn (mut this.newToClaim)}}
+                as |field|
+              >
+                <field.field as |select|>
+                  {{#each this.toClaims as |toClaim|}}
+                    <select.option
+                      @value={{toClaim}}
+                    >{{toClaim}}</select.option>
+                  {{/each}}
+                </field.field>
+              </form.select>
+            </row.cell>
+            <row.cell @shrink={{true}}>
+              <Rose::Button
+                @style='secondary'
+                title={{t 'actions.add'}}
+                @disabled={{if form.isEditable false true}}
+                {{on
+                  'click'
+                  (fn @addAccountClaimMapItem this.newFromClaim this.newToClaim)
+                }}
+              >
+                {{t 'actions.add'}}
+              </Rose::Button>
+            </row.cell>
+          </body.row>
         </table.body>
       </Rose::Table>
     </:body>
diff --git a/ui/admin/app/routes/scopes/scope/auth-methods.js b/ui/admin/app/routes/scopes/scope/auth-methods.js
index 00666c1fb..31c0778a5 100644
--- a/ui/admin/app/routes/scopes/scope/auth-methods.js
+++ b/ui/admin/app/routes/scopes/scope/auth-methods.js
@@ -151,7 +151,7 @@ export default class ScopesScopeAuthMethodsRoute extends Route {
 
   /**
    * Adds a string item to array `property` on the passed `authMethod`.
-   * This is used to manage entries in fragment string array fields such
+   * This is used to manage entries in fragment OIDC string array fields such
    * as `signing_algorithms`.
    * @param {AuthMethodModel} authMethod
    * @param {string} property
@@ -162,4 +162,17 @@ export default class ScopesScopeAuthMethodsRoute extends Route {
     const array = authMethod.get(property);
     array.addObject({ value });
   }
+
+  /**
+   * Adds an account claim map fragment to the passed OIDC `authMethod`.
+   * @param {AuthMethodModel} authMethod
+   * @param {string} property
+   * @param {string} value
+   */
+  @action
+  async addAccountClaimMapItem(authMethod, from, to) {
+    const array = authMethod.attributes.account_claim_maps;
+    const value = { from, to };
+    array.addObject(value);
+  }
 }
diff --git a/ui/admin/app/templates/scopes/scope/auth-methods/auth-method/index.hbs b/ui/admin/app/templates/scopes/scope/auth-methods/auth-method/index.hbs
index 2c477bb7c..e3302df0b 100644
--- a/ui/admin/app/templates/scopes/scope/auth-methods/auth-method/index.hbs
+++ b/ui/admin/app/templates/scopes/scope/auth-methods/auth-method/index.hbs
@@ -4,4 +4,5 @@
   @cancel={{route-action 'cancel' @model}}
   @removeItemByIndex={{route-action 'removeItemByIndex' @model}}
   @addStringItem={{route-action 'addStringItem' @model}}
+  @addAccountClaimMapItem={{route-action 'addAccountClaimMapItem' @model}}
 />
\ No newline at end of file

From 31f67e568c2613a270b38ed2f97c66849a25df2a Mon Sep 17 00:00:00 2001
From: Randall Morey <randall@randallmorey.com>
Date: Wed, 2 Jun 2021 12:09:17 -0400
Subject: [PATCH 5/8] chore: add missing translations

---
 addons/core/translations/form/en-us.yaml      | 2 +-
 addons/core/translations/resources/en-us.yaml | 7 +++++++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/addons/core/translations/form/en-us.yaml b/addons/core/translations/form/en-us.yaml
index 1345b4509..65277af78 100644
--- a/addons/core/translations/form/en-us.yaml
+++ b/addons/core/translations/form/en-us.yaml
@@ -59,7 +59,7 @@ client_id:
   help: An OAuth 2.0 Client Identifier valid at the Authorization Server.
 client_secret:
   label: Client Secret
-  description: The client secret is set-only, may not be unset, and will not appear after a successful save.
+  help: The client secret is set-only and may not be unset.
 max_age:
   label: Maximum Age
   help: The OIDC "max_age" parameter sent to the Authorization Server indicating a maximum acceptable time in seconds since the user's last authentication before requiring the user to reauthenticate. 0 indicates an immediate need to reauthenticate.
diff --git a/addons/core/translations/resources/en-us.yaml b/addons/core/translations/resources/en-us.yaml
index 7432ac466..8ab5152ac 100644
--- a/addons/core/translations/resources/en-us.yaml
+++ b/addons/core/translations/resources/en-us.yaml
@@ -30,6 +30,13 @@ auth-method:
     pending:
       title: Authentication Pending
       description: Complete authentication in the newly-opened window.
+  titles:
+    new-signing-algorithm: New Signing Algorithm
+    new-allowed-audience: New Allowed Audience
+    new-claims-scope: New Claims Scope
+    new-from-claim: New From Claim
+    new-to-claim: New To Claim
+    new-certificate: New Certificate
   types:
     password: Password
     oidc: OIDC

From 683fffaa0e9d31fe48d3292abeb392f031c5ad23 Mon Sep 17 00:00:00 2001
From: Randall Morey <randall@randallmorey.com>
Date: Wed, 2 Jun 2021 12:09:34 -0400
Subject: [PATCH 6/8] fix: correct path to logo-app

---
 ui/admin/app/index.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ui/admin/app/index.html b/ui/admin/app/index.html
index a56a21e63..1af9cc9af 100644
--- a/ui/admin/app/index.html
+++ b/ui/admin/app/index.html
@@ -12,7 +12,7 @@
     <link integrity="" rel="stylesheet" href="{{rootURL}}assets/vendor.css">
     <link integrity="" rel="stylesheet" href="{{rootURL}}assets/admin.css">
 
-    <link rel="icon" type="image/svg+xml" href="{{rootURL}}logo-app.svg">
+    <link rel="icon" type="image/svg+xml" href="{{rootURL}}core/logo-app.svg">
 
     {{content-for "head-footer"}}
   </head>

From c013b178d7e2232b54261d96059cd5c889f32dc6 Mon Sep 17 00:00:00 2001
From: Randall Morey <randall@randallmorey.com>
Date: Wed, 2 Jun 2021 12:38:15 -0400
Subject: [PATCH 7/8] =?UTF-8?q?feat:=20=F0=9F=8E=B8=20add=20oidc-account-c?=
 =?UTF-8?q?rud=20feature=20flag?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../scope/auth-methods/auth-method/-navigation.hbs | 14 +++++++++++---
 ui/admin/config/environment.js                     |  4 +++-
 2 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/ui/admin/app/templates/scopes/scope/auth-methods/auth-method/-navigation.hbs b/ui/admin/app/templates/scopes/scope/auth-methods/auth-method/-navigation.hbs
index 568445801..2694041c8 100644
--- a/ui/admin/app/templates/scopes/scope/auth-methods/auth-method/-navigation.hbs
+++ b/ui/admin/app/templates/scopes/scope/auth-methods/auth-method/-navigation.hbs
@@ -2,7 +2,15 @@
   <nav.link @route='scopes.scope.auth-methods.auth-method.index'>
     {{t 'titles.details'}}
   </nav.link>
-  <nav.link @route='scopes.scope.auth-methods.auth-method.accounts'>
-    {{t 'resources.account.title_plural'}}
-  </nav.link>
+  {{#if @model.isOIDC}}
+    {{#if (feature-flag 'oidc-account-crud')}}
+      <nav.link @route='scopes.scope.auth-methods.auth-method.accounts'>
+        {{t 'resources.account.title_plural'}}
+      </nav.link>
+    {{/if}}
+  {{else}}
+    <nav.link @route='scopes.scope.auth-methods.auth-method.accounts'>
+      {{t 'resources.account.title_plural'}}
+    </nav.link>
+  {{/if}}
 </Rose::Nav::Tabs>
\ No newline at end of file
diff --git a/ui/admin/config/environment.js b/ui/admin/config/environment.js
index 21d1e3da6..1e9db7322 100644
--- a/ui/admin/config/environment.js
+++ b/ui/admin/config/environment.js
@@ -88,7 +88,8 @@ module.exports = function (environment) {
     featureFlags: {
       'primary-auth-method': true,
       oidc: true,
-      'oidc-crud': false,
+      'oidc-crud': true,
+      'oidc-account-crud': false,
       search: false,
       filter: false,
       capabilities: false,
@@ -131,6 +132,7 @@ module.exports = function (environment) {
     ENV.featureFlags['primary-auth-method'] = true;
     ENV.featureFlags['oidc'] = true;
     ENV.featureFlags['oidc-crud'] = true;
+    //ENV.featureFlags['oidc-account-crud'] = true;
   }
 
   if (environment === 'test') {

From 66d16d84d0a9bdf8926448c86d44cd7fdfd9e90a Mon Sep 17 00:00:00 2001
From: Randall Morey <randall@randallmorey.com>
Date: Wed, 2 Jun 2021 14:23:54 -0400
Subject: [PATCH 8/8] =?UTF-8?q?fix:=20=F0=9F=90=9B=20use=20flattened=20att?=
 =?UTF-8?q?rs=20to=20capture=20oidc=20field=20errors?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 addons/api/addon/adapters/application.js      |   6 +-
 addons/api/addon/models/auth-method.js        |  21 +++
 .../form/auth-method/oidc/index.hbs           | 134 ++++++++----------
 3 files changed, 82 insertions(+), 79 deletions(-)

diff --git a/addons/api/addon/adapters/application.js b/addons/api/addon/adapters/application.js
index 279e9b73f..12112ed67 100644
--- a/addons/api/addon/adapters/application.js
+++ b/addons/api/addon/adapters/application.js
@@ -248,7 +248,11 @@ export default class ApplicationAdapter extends RESTAdapter.extend(
     // Normalize field-specific errors, if any.
     const errors = fieldErrors.map((error) => ({
       detail: error.description,
-      source: { pointer: `/data/attributes/${error.name}` },
+      // Ember Data cannot handle errors on nested attributes, so these are
+      // flattened (e.g. `attributes.foobar` becomes `attributes_foobar`).
+      // To capture these errors, add read-only fields on the model
+      // corresponding to the underscored field name.
+      source: { pointer: `/data/attributes/${error.name.replace('.', '_')}` },
     }));
     // Return a list of JSON API errors rooted under the `errors` key.
     return {
diff --git a/addons/api/addon/models/auth-method.js b/addons/api/addon/models/auth-method.js
index dc03abc0d..66f34757d 100644
--- a/addons/api/addon/models/auth-method.js
+++ b/addons/api/addon/models/auth-method.js
@@ -1,4 +1,5 @@
 import GeneratedAuthMethodModel from '../generated/models/auth-method';
+import { attr } from '@ember-data/model';
 import { fragment } from 'ember-data-model-fragments/attributes';
 import { equal } from '@ember/object/computed';
 
@@ -27,6 +28,26 @@ export const options = {
 };
 
 export default class AuthMethodModel extends GeneratedAuthMethodModel {
+  // =error attributes
+  // These attributes exist solely to capture errors on nested fields.
+  // See the application adapter's error normalization method for
+  // more information.
+
+  @attr('string', { readOnly: true }) attributes_state;
+  @attr('string', { readOnly: true }) attributes_issuer;
+  @attr('string', { readOnly: true }) attributes_client_id;
+  @attr('string', { readOnly: true }) attributes_client_secret;
+  @attr('string', { readOnly: true }) attributes_max_age;
+  @attr('string', { readOnly: true }) attributes_api_url_prefix;
+  @attr('string', { readOnly: true })
+  attributes_disable_discovered_config_validation;
+  @attr('string', { readOnly: true }) attributes_dry_run;
+  @attr('string', { readOnly: true }) attributes_account_claim_maps;
+  @attr('string', { readOnly: true }) attributes_claims_scopes;
+  @attr('string', { readOnly: true }) attributes_signing_algorithms;
+  @attr('string', { readOnly: true }) attributes_allowed_audiences;
+  @attr('string', { readOnly: true }) attributes_idp_ca_certs;
+
   // =attributes
 
   /**
diff --git a/ui/admin/app/components/form/auth-method/oidc/index.hbs b/ui/admin/app/components/form/auth-method/oidc/index.hbs
index 335392e08..e1a5592c0 100644
--- a/ui/admin/app/components/form/auth-method/oidc/index.hbs
+++ b/ui/admin/app/components/form/auth-method/oidc/index.hbs
@@ -57,13 +57,13 @@
     @value={{@model.attributes.issuer}}
     @label={{t 'form.issuer.label'}}
     @helperText={{t 'form.issuer.help'}}
-    @error={{@model.errors.attributes.issuer}}
+    @error={{@model.errors.attributes_issuer}}
     readonly={{false}}
     as |field|
   >
-    {{#if @model.errors.attributes.issuer}}
+    {{#if @model.errors.attributes_issuer}}
       <field.errors as |errors|>
-        {{#each @model.errors.attributes.issuer as |error|}}
+        {{#each @model.errors.attributes_issuer as |error|}}
           <errors.message>{{error.message}}</errors.message>
         {{/each}}
       </field.errors>
@@ -86,13 +86,13 @@
     @value={{@model.attributes.client_id}}
     @label={{t 'form.client_id.label'}}
     @helperText={{t 'form.client_id.help'}}
-    @error={{@model.errors.attributes.client_id}}
+    @error={{@model.errors.attributes_client_id}}
     readonly={{false}}
     as |field|
   >
-    {{#if @model.errors.attributes.client_id}}
+    {{#if @model.errors.attributes_client_id}}
       <field.errors as |errors|>
-        {{#each @model.errors.attributes.client_id as |error|}}
+        {{#each @model.errors.attributes_client_id as |error|}}
           <errors.message>{{error.message}}</errors.message>
         {{/each}}
       </field.errors>
@@ -105,13 +105,13 @@
     @value={{@model.attributes.client_secret}}
     @label={{t 'form.client_secret.label'}}
     @helperText={{t 'form.client_secret.help'}}
-    @error={{@model.errors.attributes.client_secret}}
+    @error={{@model.errors.attributes_client_secret}}
     readonly={{false}}
     as |field|
   >
-    {{#if @model.errors.attributes.client_secret}}
+    {{#if @model.errors.attributes_client_secret}}
       <field.errors as |errors|>
-        {{#each @model.errors.attributes.client_secret as |error|}}
+        {{#each @model.errors.attributes_client_secret as |error|}}
           <errors.message>{{error.message}}</errors.message>
         {{/each}}
       </field.errors>
@@ -123,6 +123,13 @@
     <:title>{{t 'form.signing_algorithms.label'}}</:title>
     <:description>{{t 'form.signing_algorithms.help'}}</:description>
     <:body>
+      {{#if @model.errors.attributes_signing_algorithms}}
+        <Rose::Form::Errors as |errors|>
+          {{#each @model.errors.attributes_signing_algorithms as |error|}}
+            <errors.message>{{error.message}}</errors.message>
+          {{/each}}
+        </Rose::Form::Errors>
+      {{/if}}
       <Rose::Table @style='condensed' as |table|>
         <table.header as |header|>
           <header.row @hidden={{true}} as |row|>
@@ -136,7 +143,7 @@
               <row.cell>
                 <form.select
                   @value={{algorithm.value}}
-                  @error={{@model.errors.attributes.signing_algorithms}}
+                  @error={{@model.errors.attributes_signing_algorithms}}
                   @contextual={{true}}
                   @onChange={{fn (mut algorithm.value)}}
                   as |field|
@@ -149,16 +156,6 @@
                       >{{algorithm}}</select.option>
                     {{/each}}
                   </field.field>
-                  {{#if @model.errors.attributes.signing_algorithms}}
-                    <field.errors as |errors|>
-                      {{#each
-                        @model.errors.attributes.signing_algorithms
-                        as |error|
-                      }}
-                        <errors.message>{{error.message}}</errors.message>
-                      {{/each}}
-                    </field.errors>
-                  {{/if}}
                 </form.select>
               </row.cell>
               <row.cell @shrink={{true}}>
@@ -225,6 +222,13 @@
     <:title>{{t 'form.allowed_audiences.label'}}</:title>
     <:description>{{t 'form.allowed_audiences.help'}}</:description>
     <:body>
+      {{#if @model.errors.attributes_allowed_audiences}}
+        <Rose::Form::Errors as |errors|>
+          {{#each @model.errors.attributes_allowed_audiences as |error|}}
+            <errors.message>{{error.message}}</errors.message>
+          {{/each}}
+        </Rose::Form::Errors>
+      {{/if}}
       <Rose::Table @style='condensed' as |table|>
         <table.header as |header|>
           <header.row @hidden={{true}} as |row|>
@@ -239,22 +243,12 @@
                 <form.input
                   @type='text'
                   @value={{audience.value}}
-                  @error={{@model.errors.attributes.allowed_audiences}}
+                  @error={{@model.errors.attributes_allowed_audiences}}
                   @contextual={{true}}
                   as |field|
                 >
                   <field.label>{{t 'form.claim.label'}}</field.label>
                   <field.field />
-                  {{#if @model.errors.attributes.allowed_audiences}}
-                    <field.errors as |errors|>
-                      {{#each
-                        @model.errors.attributes.allowed_audiences
-                        as |error|
-                      }}
-                        <errors.message>{{error.message}}</errors.message>
-                      {{/each}}
-                    </field.errors>
-                  {{/if}}
                 </form.input>
               </row.cell>
               <row.cell @shrink={{true}}>
@@ -310,6 +304,13 @@
     <:title>{{t 'form.claims_scopes.label'}}</:title>
     <:description>{{t 'form.claims_scopes.help'}}</:description>
     <:body>
+      {{#if @model.errors.attributes_claims_scopes}}
+        <Rose::Form::Errors as |errors|>
+          {{#each @model.errors.attributes_claims_scopes as |error|}}
+            <errors.message>{{error.message}}</errors.message>
+          {{/each}}
+        </Rose::Form::Errors>
+      {{/if}}
       <Rose::Table @style='condensed' as |table|>
         <table.header as |header|>
           <header.row @hidden={{true}} as |row|>
@@ -324,22 +325,12 @@
                 <form.input
                   @type='text'
                   @value={{claimsScope.value}}
-                  @error={{@model.errors.attributes.claims_scopes}}
+                  @error={{@model.errors.attributes_claims_scopes}}
                   @contextual={{true}}
                   as |field|
                 >
                   <field.label>{{t 'form.claims_scope.label'}}</field.label>
                   <field.field />
-                  {{#if @model.errors.attributes.claims_scopes}}
-                    <field.errors as |errors|>
-                      {{#each
-                        @model.errors.attributes.claims_scopes
-                        as |error|
-                      }}
-                        <errors.message>{{error.message}}</errors.message>
-                      {{/each}}
-                    </field.errors>
-                  {{/if}}
                 </form.input>
               </row.cell>
               <row.cell @shrink={{true}}>
@@ -395,6 +386,13 @@
     <:title>{{t 'form.account_claim_maps.label'}}</:title>
     <:description>{{t 'form.account_claim_maps.help'}}</:description>
     <:body>
+      {{#if @model.errors.attributes_account_claim_maps}}
+        <Rose::Form::Errors as |errors|>
+          {{#each @model.errors.attributes_account_claim_maps as |error|}}
+            <errors.message>{{error.message}}</errors.message>
+          {{/each}}
+        </Rose::Form::Errors>
+      {{/if}}
       <Rose::Table @style='condensed' as |table|>
         <table.header as |header|>
           <header.row as |row|>
@@ -410,28 +408,18 @@
                 <form.input
                   @type='text'
                   @value={{claimMap.from}}
-                  @error={{@model.errors.attributes.account_claim_maps}}
+                  @error={{@model.errors.attributes_account_claim_maps}}
                   @contextual={{true}}
                   as |field|
                 >
                   <field.label>{{t 'form.from_claim.label'}}</field.label>
                   <field.field />
-                  {{#if @model.errors.attributes.account_claim_maps}}
-                    <field.errors as |errors|>
-                      {{#each
-                        @model.errors.attributes.account_claim_maps
-                        as |error|
-                      }}
-                        <errors.message>{{error.message}}</errors.message>
-                      {{/each}}
-                    </field.errors>
-                  {{/if}}
                 </form.input>
               </row.cell>
               <row.cell>
                 <form.select
                   @value={{claimMap.to}}
-                  @error={{@model.errors.attributes.account_claim_maps}}
+                  @error={{@model.errors.attributes_account_claim_maps}}
                   @contextual={{true}}
                   @onChange={{fn (mut claimMap.to)}}
                   as |field|
@@ -444,16 +432,6 @@
                       >{{toClaim}}</select.option>
                     {{/each}}
                   </field.field>
-                  {{#if @model.errors.attributes.account_claim_maps}}
-                    <field.errors as |errors|>
-                      {{#each
-                        @model.errors.attributes.account_claim_maps
-                        as |error|
-                      }}
-                        <errors.message>{{error.message}}</errors.message>
-                      {{/each}}
-                    </field.errors>
-                  {{/if}}
                 </form.select>
               </row.cell>
               <row.cell @shrink={{true}}>
@@ -521,6 +499,13 @@
     <:title>{{t 'form.idp_ca_certs.label'}}</:title>
     <:description>{{t 'form.idp_ca_certs.help'}}</:description>
     <:body>
+      {{#if @model.errors.attributes_idp_ca_certs}}
+        <Rose::Form::Errors as |errors|>
+          {{#each @model.errors.attributes_idp_ca_certs as |error|}}
+            <errors.message>{{error.message}}</errors.message>
+          {{/each}}
+        </Rose::Form::Errors>
+      {{/if}}
       <Rose::Table @style='condensed' as |table|>
         <table.header as |header|>
           <header.row @hidden={{true}} as |row|>
@@ -534,19 +519,12 @@
               <row.cell>
                 <form.textarea
                   @value={{cert.value}}
-                  @error={{@model.errors.attributes.idp_ca_certs}}
+                  @error={{@model.errors.attributes_idp_ca_certs}}
                   @contextual={{true}}
                   as |field|
                 >
                   <field.label>{{t 'form.certificate.label'}}</field.label>
                   <field.field />
-                  {{#if @model.errors.attributes.idp_ca_certs}}
-                    <field.errors as |errors|>
-                      {{#each @model.errors.attributes.idp_ca_certs as |error|}}
-                        <errors.message>{{error.message}}</errors.message>
-                      {{/each}}
-                    </field.errors>
-                  {{/if}}
                 </form.textarea>
               </row.cell>
               <row.cell @shrink={{true}}>
@@ -600,15 +578,15 @@
     @value={{@model.attributes.max_age}}
     @label={{t 'form.max_age.label'}}
     @helperText={{t 'form.max_age.help'}}
-    @error={{@model.errors.attributes.max_age}}
+    @error={{@model.errors.attributes_max_age}}
     readonly={{false}}
     step='1'
     min='0'
     as |field|
   >
-    {{#if @model.errors.attributes.max_age}}
+    {{#if @model.errors.attributes_max_age}}
       <field.errors as |errors|>
-        {{#each @model.errors.attributes.max_age as |error|}}
+        {{#each @model.errors.attributes_max_age as |error|}}
           <errors.message>{{error.message}}</errors.message>
         {{/each}}
       </field.errors>
@@ -621,13 +599,13 @@
     @value={{@model.attributes.api_url_prefix}}
     @label={{t 'form.api_url_prefix.label'}}
     @helperText={{t 'form.api_url_prefix.help'}}
-    @error={{@model.errors.attributes.api_url_prefix}}
+    @error={{@model.errors.attributes_api_url_prefix}}
     readonly={{false}}
     as |field|
   >
-    {{#if @model.errors.attributes.api_url_prefix}}
+    {{#if @model.errors.attributes_api_url_prefix}}
       <field.errors as |errors|>
-        {{#each @model.errors.attributes.api_url_prefix as |error|}}
+        {{#each @model.errors.attributes_api_url_prefix as |error|}}
           <errors.message>{{error.message}}</errors.message>
         {{/each}}
       </field.errors>