diff --git a/addons/api/addon/models/session.js b/addons/api/addon/models/session.js
index 406c10c6c..b71a7bb13 100644
--- a/addons/api/addon/models/session.js
+++ b/addons/api/addon/models/session.js
@@ -3,7 +3,6 @@ import { computed } from '@ember/object';
 import { equal } from '@ember/object/computed';
 import { tracked } from '@glimmer/tracking';
 import { A } from '@ember/array';
-import { typeOf } from '@ember/utils';
 
 /**
  *
@@ -44,20 +43,29 @@ class SessionCredential {
   // =attributes
   rawCredential;
   library;
-  #rawSecretValue;
+  #payloadSecret;
 
   /**
+   * The incoming payload may contain a JSON object under the `decoded` key only
+   * if it can be JSON-decoded.  Some credential stores may not provide JSON,
+   * however, in which case we may have only the raw base64-encoded secret
+   * string.  In the former case, we convert the key/value pairs of the JSON to
+   * an array of `SecretItem` instances.  In the latter case, we return an
+   * array containing a single `SecretItem` instance with key `secret` and a
+   * string value equal to the base64-decoded raw secret.
    * The credential secret as an array of key/value objects.
    * @type {SessionCredential.SecretItem[]}
    */
   get secrets() {
-    if (typeOf(this.#rawSecretValue) === 'object') {
-      return Object.keys(this.#rawSecretValue).map(
-        (key) =>
-          new SessionCredential.SecretItem(key, this.#rawSecretValue[key])
+    if (this.#payloadSecret?.decoded) {
+      const secretJSON = this.#payloadSecret.decoded;
+      return Object.keys(secretJSON).map(
+        (key) => new SessionCredential.SecretItem(key, secretJSON[key])
       );
     } else {
-      return [new SessionCredential.SecretItem('secret', this.#rawSecretValue)];
+      // decode from base64
+      const decodedString = atob(this.#payloadSecret.raw);
+      return [new SessionCredential.SecretItem('secret', decodedString)];
     }
   }
 
@@ -66,7 +74,7 @@ class SessionCredential {
   constructor(cred) {
     const { id, name, description, type } = cred.credential_library;
     this.library = new SessionCredential.Library(id, name, description, type);
-    this.#rawSecretValue = cred.secret;
+    this.#payloadSecret = cred.secret;
     this.rawCredential = cred;
   }
 }
diff --git a/addons/api/mirage/scenarios/ipc.js b/addons/api/mirage/scenarios/ipc.js
index a255cff3d..04ff375d4 100644
--- a/addons/api/mirage/scenarios/ipc.js
+++ b/addons/api/mirage/scenarios/ipc.js
@@ -53,6 +53,12 @@ export default function initializeMockIPC(server) {
         type,
         created_time: new Date().toISOString(),
       });
+      const decoded = {
+        key1: 'value 1',
+        key2: true,
+        key3: 'test',
+      };
+      const raw = btoa(JSON.stringify(decoded));
       return {
         address: window.location.hostname,
         port: datatype.number(),
@@ -67,7 +73,9 @@ export default function initializeMockIPC(server) {
               credential_store_id: 'csvlt_Q1HFGt7Jpm',
               type: 'vault',
             },
-            secret: 'just-a-random-string',
+            secret: {
+              raw: btoa('just-a-random-string'),
+            },
           },
           {
             credential_library: {
@@ -78,21 +86,10 @@ export default function initializeMockIPC(server) {
               type: 'vault',
             },
             secret: {
-              key1: 'value 1',
-              key2: true,
-              key3: 'test',
+              raw,
+              decoded,
             },
           },
-          {
-            credential_library: {
-              id: 'clvlt_9KWscxpcY7',
-              name: 'Library Name',
-              description: 'Library Description',
-              credential_store_id: 'csvlt_Q1HFGt7Jpm',
-              type: 'vault',
-            },
-            secret: 'just-a-random-string',
-          },
           {
             credential_library: {
               id: 'clvlt_9KWscxpcY7',
@@ -102,9 +99,20 @@ export default function initializeMockIPC(server) {
               type: 'vault',
             },
             secret: {
-              key1: 'value 1',
-              key2: true,
-              key3: 'test',
+              raw: btoa('just-a-random-string'),
+            },
+          },
+          {
+            credential_library: {
+              id: 'clvlt_9KWscxpcY7',
+              name: 'Library Name',
+              description: 'Library Description',
+              credential_store_id: 'csvlt_Q1HFGt7Jpm',
+              type: 'vault',
+            },
+            secret: {
+              raw,
+              decoded,
             },
           },
         ],
diff --git a/package.json b/package.json
index 28c7cd543..b91c37ea7 100755
--- a/package.json
+++ b/package.json
@@ -72,7 +72,8 @@
     "css-what": "^5.0.1",
     "trim-newlines": "^3.0.1",
     "clean-css": "^4.1.11",
-    "normalize-url": "^4.5.1"
+    "normalize-url": "^4.5.1",
+    "glob-parent": "^5.1.2"
   },
   "config": {
     "commitizen": {
diff --git a/ui/admin/app/components/form/auth-method/oidc/index.hbs b/ui/admin/app/components/form/auth-method/oidc/index.hbs
index abc18784f..7d43d2e67 100644
--- a/ui/admin/app/components/form/auth-method/oidc/index.hbs
+++ b/ui/admin/app/components/form/auth-method/oidc/index.hbs
@@ -180,7 +180,11 @@
                   @style='warning'
                   @iconOnly='trash'
                   title={{t 'actions.remove'}}
-                  @disabled={{if form.isEditable false true}}
+                  @disabled={{if
+                    @model.isNew
+                    false
+                    (if form.isEditable false true)
+                  }}
                   {{on
                     'click'
                     (fn @removeItemByIndex 'attributes.signing_algorithms' i)
@@ -215,7 +219,11 @@
               <Rose::Button
                 @style='secondary'
                 title={{t 'actions.add'}}
-                @disabled={{if form.isEditable false true}}
+                @disabled={{if
+                  @model.isNew
+                  false
+                  (if form.isEditable false true)
+                }}
                 {{on
                   'click'
                   (fn
@@ -273,7 +281,11 @@
                   @style='warning'
                   @iconOnly='trash'
                   title={{t 'actions.remove'}}
-                  @disabled={{if form.isEditable false true}}
+                  @disabled={{if
+                    @model.isNew
+                    false
+                    (if form.isEditable false true)
+                  }}
                   {{on
                     'click'
                     (fn @removeItemByIndex 'attributes.allowed_audiences' i)
@@ -297,7 +309,11 @@
               <Rose::Button
                 @style='secondary'
                 title={{t 'actions.add'}}
-                @disabled={{if form.isEditable false true}}
+                @disabled={{if
+                  @model.isNew
+                  false
+                  (if form.isEditable false true)
+                }}
                 {{on
                   'click'
                   (fn
@@ -355,7 +371,11 @@
                   @style='warning'
                   @iconOnly='trash'
                   title={{t 'actions.remove'}}
-                  @disabled={{if form.isEditable false true}}
+                  @disabled={{if
+                    @model.isNew
+                    false
+                    (if form.isEditable false true)
+                  }}
                   {{on
                     'click'
                     (fn @removeItemByIndex 'attributes.claims_scopes' i)
@@ -379,7 +399,11 @@
               <Rose::Button
                 @style='secondary'
                 title={{t 'actions.add'}}
-                @disabled={{if form.isEditable false true}}
+                @disabled={{if
+                  @model.isNew
+                  false
+                  (if form.isEditable false true)
+                }}
                 {{on
                   'click'
                   (fn
@@ -456,7 +480,11 @@
                   @style='warning'
                   @iconOnly='trash'
                   title={{t 'actions.remove'}}
-                  @disabled={{if form.isEditable false true}}
+                  @disabled={{if
+                    @model.isNew
+                    false
+                    (if form.isEditable false true)
+                  }}
                   {{on
                     'click'
                     (fn @removeItemByIndex 'attributes.account_claim_maps' i)
@@ -496,7 +524,11 @@
               <Rose::Button
                 @style='secondary'
                 title={{t 'actions.add'}}
-                @disabled={{if form.isEditable false true}}
+                @disabled={{if
+                  @model.isNew
+                  false
+                  (if form.isEditable false true)
+                }}
                 {{on
                   'click'
                   (fn @addAccountClaimMapItem this.newFromClaim this.newToClaim)
@@ -549,7 +581,11 @@
                   @style='warning'
                   @iconOnly='trash'
                   title={{t 'actions.remove'}}
-                  @disabled={{if form.isEditable false true}}
+                  @disabled={{if
+                    @model.isNew
+                    false
+                    (if form.isEditable false true)
+                  }}
                   {{on
                     'click'
                     (fn @removeItemByIndex 'attributes.idp_ca_certs' i)
@@ -572,7 +608,11 @@
               <Rose::Button
                 @style='secondary'
                 title={{t 'actions.add'}}
-                @disabled={{if form.isEditable false true}}
+                @disabled={{if
+                  @model.isNew
+                  false
+                  (if form.isEditable false true)
+                }}
                 {{on
                   'click'
                   (fn
diff --git a/ui/desktop/CHANGELOG.md b/ui/desktop/CHANGELOG.md
index 0f1f7544e..e9c021464 100644
--- a/ui/desktop/CHANGELOG.md
+++ b/ui/desktop/CHANGELOG.md
@@ -2,11 +2,11 @@
 
 Canonical reference for changes, improvements, and bugfixes for Boundary Desktop.
 
-## Next
+## v1.2.0 [CLI 0.4.0] (2021.06.29)
 
 ### New
 
-- Add vault credential support. ([PR](https://github.com/hashicorp/boundary-ui/pull/619))
+- Add Vault credential support. ([PR](https://github.com/hashicorp/boundary-ui/pull/619))
 
 ## v1.1.0 [CLI 0.3.0] (2021.06.09)
 
diff --git a/ui/desktop/app/styles/app.scss b/ui/desktop/app/styles/app.scss
index 405a2572e..6bf7c387e 100644
--- a/ui/desktop/app/styles/app.scss
+++ b/ui/desktop/app/styles/app.scss
@@ -328,9 +328,12 @@
 
 // Dialog Detail
 // These styles are a Work In Progress. Expect changes (lots of them)
+.rose-dialog,
 .dialog-detail {
   z-index: 6000;
+}
 
+.dialog-detail {
   .rose-notification {
     border-left: 0;
     border-right: 0;
diff --git a/ui/desktop/electron-app/config/cli.js b/ui/desktop/electron-app/config/cli.js
index 9af356e9e..e9b5a6a12 100644
--- a/ui/desktop/electron-app/config/cli.js
+++ b/ui/desktop/electron-app/config/cli.js
@@ -5,7 +5,7 @@ const https = require('https');
 const decompress = require('decompress');
 const { isMac, isWindows } = require('../src/helpers/platform.js');
 
-const artifactVersion = '0.3.0';
+const artifactVersion = '0.4.0';
 const artifactDestination = path.resolve(__dirname, '..', 'cli');
 
 const downloadArtifact = (version) => {
diff --git a/yarn.lock b/yarn.lock
index 896224b8b..6ecd10690 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -11290,22 +11290,7 @@ glob-base@^0.3.0:
     glob-parent "^2.0.0"
     is-glob "^2.0.0"
 
-glob-parent@^2.0.0:
-  version "2.0.0"
-  resolved "https://registry.yarnpkg.com/glob-parent/-/glob-parent-2.0.0.tgz#81383d72db054fcccf5336daa902f182f6edbb28"
-  integrity sha1-gTg9ctsFT8zPUzbaqQLxgvbtuyg=
-  dependencies:
-    is-glob "^2.0.0"
-
-glob-parent@^3.1.0:
-  version "3.1.0"
-  resolved "https://registry.yarnpkg.com/glob-parent/-/glob-parent-3.1.0.tgz#9e6af6299d8d3bd2bd40430832bd113df906c5ae"
-  integrity sha1-nmr2KZ2NO9K9QEMIMr0RPfkGxa4=
-  dependencies:
-    is-glob "^3.1.0"
-    path-dirname "^1.0.0"
-
-glob-parent@^5.1.0, glob-parent@^5.1.2, glob-parent@~5.1.0:
+glob-parent@^2.0.0, glob-parent@^3.1.0, glob-parent@^5.1.0, glob-parent@^5.1.2, glob-parent@~5.1.0:
   version "5.1.2"
   resolved "https://registry.yarnpkg.com/glob-parent/-/glob-parent-5.1.2.tgz#869832c58034fe68a4093c17dc15e8340d8401c4"
   integrity sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==
@@ -12772,7 +12757,7 @@ is-glob@^2.0.0:
   dependencies:
     is-extglob "^1.0.0"
 
-is-glob@^3.0.0, is-glob@^3.1.0:
+is-glob@^3.0.0:
   version "3.1.0"
   resolved "https://registry.yarnpkg.com/is-glob/-/is-glob-3.1.0.tgz#7ba5ae24217804ac70707b96922567486cc3e84a"
   integrity sha1-e6WuJCF4BKxwcHuWkiVnSGzD6Eo=
@@ -16607,11 +16592,6 @@ path-browserify@0.0.1:
   resolved "https://registry.yarnpkg.com/path-browserify/-/path-browserify-0.0.1.tgz#e6c4ddd7ed3aa27c68a20cc4e50e1a4ee83bbc4a"
   integrity sha512-BapA40NHICOS+USX9SN4tyhq+A2RrN/Ws5F0Z5aMHDp98Fl86lX8Oti8B7uN93L4Ifv4fHOEA+pQw87gmMO/lQ==
 
-path-dirname@^1.0.0:
-  version "1.0.2"
-  resolved "https://registry.yarnpkg.com/path-dirname/-/path-dirname-1.0.2.tgz#cc33d24d525e099a5388c0336c6e32b9160609e0"
-  integrity sha1-zDPSTVJeCZpTiMAzbG4yuRYGCeA=
-
 path-exists@^2.0.0:
   version "2.1.0"
   resolved "https://registry.yarnpkg.com/path-exists/-/path-exists-2.1.0.tgz#0feb6c64f0fc518d9a754dd5efb62c7022761f4b"