Skip to content

i18n(admin): extract the auth-providers panel (#248) #297

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tbcsec merged 1 commit into from
Aug 24, 2026
Merged

i18n(admin): extract the auth-providers panel (#248) #297

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
104 changes: 104 additions & 0 deletions frontend/messages/en.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2326,6 +2326,110 @@
"legToolCalling": "Tool calling",
"legOk": "OK",
"legFailed": "Failed"
},
"authProviders": {
"editTitle": "Edit {name}",
"addTitle": "Add a provider",
"descLdap": "Point Flagpost at your directory. Directory users sign in with the ordinary username & password form — no separate button appears. New providers start disabled.",
"descSaml": "Register Flagpost as a Service Provider at your IdP (its metadata is at the SP metadata URL below once saved), then paste the IdP's details here. New providers start disabled.",
"descOauth": "Register Flagpost as an OAuth client at your provider first, then paste its details here. New providers start disabled.",
"protocol": "Protocol",
"protocolOidc": "OpenID Connect",
"protocolOauth2": "OAuth 2.0 (no OpenID Connect)",
"protocolSaml": "SAML 2.0",
"protocolLdap": "LDAP / Active Directory",
"protocolHint": "Fixed after creation. OIDC suits most modern providers; plain OAuth 2.0 is for providers without OpenID Connect, like GitHub and Discord, where identity comes from a userinfo API call; SAML suits campus/enterprise IdPs (Shibboleth, ADFS); LDAP binds directly against a directory (AD, OpenLDAP, FreeIPA).",
"displayName": "Display name",
"displayNameHintLdap": "Shown in the admin list — LDAP has no login button.",
"displayNameHint": "Shown on the login button: “Sign in with {name}”.",
"slug": "Slug",
"slugHintEditing": "Fixed after creation — it's part of the URLs registered at your provider.",
"slugHint": "Lowercase letters, numbers and hyphens. Appears in the callback/ACS URL.",
"serverUrl": "Server URL",
"startTls": "Upgrade with StartTLS (required for ldap:// — a plaintext connection is never used)",
"bindDn": "Service account (bind DN)",
"bindDnHint": "Used to look up the person's entry before their own credentials are checked. Its password goes in the bind password field below.",
"baseDn": "Search base DN",
"loginAttribute": "Login attribute",
"stableIdAttribute": "Stable ID attribute",
"ldapAttrHint": "Login attribute: what people type as their username (<mono>sAMAccountName</mono> on AD, <mono>uid</mono> elsewhere). Stable ID: the attribute that identifies the account forever — <mono>objectGUID</mono> on AD, <mono>entryUUID</mono> on OpenLDAP/FreeIPA. Never a DN.",
"emailAttribute": "Email attribute",
"nameAttribute": "Name attribute",
"idpEntityId": "IdP entity ID",
"idpSsoUrl": "IdP SSO URL",
"idpSsoUrlHint": "The HTTP-Redirect single-sign-on endpoint we send the login request to.",
"idpCert": "IdP signing certificate (X.509)",
"idpCertHint": "Every assertion is verified against this before it's trusted — the load-bearing setting.",
"spEntityId": "SP entity ID",
"spEntityIdHint": "Our identifier at the IdP. Must match what you register there.",
"samlAttrHint": "The exact SAML attribute names your IdP sends. The stable NameID (must be persistent) becomes the account's identity.",
"authorizeUrl": "Authorization URL",
"tokenUrl": "Token URL",
"userinfoUrl": "Userinfo URL",
"userinfoUrlHint": "There is no ID token in plain OAuth 2.0 — the account's identity is read from this endpoint's JSON response.",
"clientId": "Client ID",
"scopes": "Scopes",
"claimMap": "Claim map",
"subjectField": "Subject field",
"emailField": "Email field",
"nameField": "Name field",
"emailVerifiedField": "Email-verified field",
"claimMapHint": "Which fields of the userinfo response carry identity. The subject must be the provider's stable user ID, never the email address — it's what keeps an account attached when the user renames or changes address upstream.",
"verifiedEmailsUrl": "Verified-emails URL",
"optional": "(optional)",
"verifiedEmailsUrlHint": "For providers that keep verified addresses on a separate endpoint (GitHub). Only the primary, verified address is trusted. Leave blank if the userinfo response already carries a verified flag.",
"usePkce": "Use PKCE",
"usePkceHint": "Extra protection where the provider supports it (Discord does; GitHub's OAuth Apps ignore it). Leave off if sign-in fails with an unexpected-parameter error.",
"issuerUrl": "Issuer URL",
"issuerUrlHint": "Must be HTTPS and publicly resolvable. Discovery reads <mono>{url}</mono>.",
"tenantTemplate": "Tenant issuer template",
"tenantTemplateHint": "Multi-tenant Microsoft Entra only — leave blank for a normal provider. When set, the token's issuer is validated against this template with the signing-in tenant's GUID substituted for <mono>'{tenantid}'</mono>. Trusts every Entra tenant, so restrict access with the registration email-domain allowlist.",
"secretLdap": "Bind password",
"secretSaml": "SP private key (optional)",
"secretOidc": "Client secret",
"secretPlaceholderKeep": "•••••• (leave blank to keep)",
"secretPlaceholderSaml": "-----BEGIN PRIVATE KEY-----…",
"secretHintLdap": "Stored encrypted. The service account's password — required before the provider can be enabled.",
"secretHintSaml": "Stored encrypted. Only needed to sign our requests — leave blank otherwise.",
"secretHintOidc": "Stored encrypted. Leave blank for a public client using PKCE only.",
"signInPolicy": "Sign-in policy",
"postureOpen": "Open — public provider, registration rules apply",
"postureClosed": "Closed — being in this directory is the admission",
"postureHintOpen": "For public IdPs (Google, GitHub): new accounts pass the same registration-open and email-domain checks as the sign-up form.",
"postureHintClosed": "For your own directory (corporate or campus IdP): anyone who can sign in there may enter, even while public registration is closed.",
"trustEmail": "Trust this provider's email addresses",
"trustEmailHint": "Lets a first sign-in attach to an existing account with the same address. Only enable this if the directory verifies mailbox ownership — an unverified address here can claim someone else's account.",
"saving": "Saving…",
"saveChanges": "Save changes",
"addProvider": "Add provider",
"cancel": "Cancel",
"providerUpdated": "Provider updated",
"providerAdded": "Provider added — enable it when you've tested it",
"continue": "Continue",
"setUp": "Set up",
"heading": "Auth providers",
"headingDescription": "Let people sign in with an external identity provider. Local passwords keep working, so an administrator can still get in if a provider goes down.",
"quickSetup": "Quick set up",
"quickSetupHint": "Each of these needs an app registered on the provider's side. After saving, register the callback URL Flagpost shows you.",
"loading": "Loading…",
"badgeEnabled": "Enabled",
"badgeDisabled": "Disabled",
"badgeClosed": "Closed",
"redirectUri": "Redirect URI: {uri}",
"spMetadata": "SP metadata: /api/auth/saml/{slug}/metadata",
"ldapSignInNote": "Signs in through the standard username & password form",
"disable": "Disable",
"enable": "Enable",
"edit": "Edit",
"delete": "Delete",
"providerEnabled": "Provider enabled",
"providerDisabled": "Provider disabled",
"providerDeleted": "Provider deleted",
"deleteTitle": "Delete {name}?",
"deleteDescription": "Anyone who signs in only through this provider will lose their way in — a single-sign-on account has no password to fall back on. Disabling it instead is reversible.",
"deleteConfirm": "Delete",
"emptyTitle": "No identity providers",
"emptyDescription": "Add an OIDC, OAuth 2.0, SAML or LDAP provider to let people sign in with an existing account instead of a Flagpost password."
}
}
}
104 changes: 104 additions & 0 deletions frontend/messages/es.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2326,6 +2326,110 @@
"legToolCalling": "Tool calling",
"legOk": "OK",
"legFailed": "Failed"
},
"authProviders": {
"editTitle": "Edit {name}",
"addTitle": "Add a provider",
"descLdap": "Point Flagpost at your directory. Directory users sign in with the ordinary username & password form — no separate button appears. New providers start disabled.",
"descSaml": "Register Flagpost as a Service Provider at your IdP (its metadata is at the SP metadata URL below once saved), then paste the IdP's details here. New providers start disabled.",
"descOauth": "Register Flagpost as an OAuth client at your provider first, then paste its details here. New providers start disabled.",
"protocol": "Protocol",
"protocolOidc": "OpenID Connect",
"protocolOauth2": "OAuth 2.0 (no OpenID Connect)",
"protocolSaml": "SAML 2.0",
"protocolLdap": "LDAP / Active Directory",
"protocolHint": "Fixed after creation. OIDC suits most modern providers; plain OAuth 2.0 is for providers without OpenID Connect, like GitHub and Discord, where identity comes from a userinfo API call; SAML suits campus/enterprise IdPs (Shibboleth, ADFS); LDAP binds directly against a directory (AD, OpenLDAP, FreeIPA).",
"displayName": "Display name",
"displayNameHintLdap": "Shown in the admin list — LDAP has no login button.",
"displayNameHint": "Shown on the login button: “Sign in with {name}”.",
"slug": "Slug",
"slugHintEditing": "Fixed after creation — it's part of the URLs registered at your provider.",
"slugHint": "Lowercase letters, numbers and hyphens. Appears in the callback/ACS URL.",
"serverUrl": "Server URL",
"startTls": "Upgrade with StartTLS (required for ldap:// — a plaintext connection is never used)",
"bindDn": "Service account (bind DN)",
"bindDnHint": "Used to look up the person's entry before their own credentials are checked. Its password goes in the bind password field below.",
"baseDn": "Search base DN",
"loginAttribute": "Login attribute",
"stableIdAttribute": "Stable ID attribute",
"ldapAttrHint": "Login attribute: what people type as their username (<mono>sAMAccountName</mono> on AD, <mono>uid</mono> elsewhere). Stable ID: the attribute that identifies the account forever — <mono>objectGUID</mono> on AD, <mono>entryUUID</mono> on OpenLDAP/FreeIPA. Never a DN.",
"emailAttribute": "Email attribute",
"nameAttribute": "Name attribute",
"idpEntityId": "IdP entity ID",
"idpSsoUrl": "IdP SSO URL",
"idpSsoUrlHint": "The HTTP-Redirect single-sign-on endpoint we send the login request to.",
"idpCert": "IdP signing certificate (X.509)",
"idpCertHint": "Every assertion is verified against this before it's trusted — the load-bearing setting.",
"spEntityId": "SP entity ID",
"spEntityIdHint": "Our identifier at the IdP. Must match what you register there.",
"samlAttrHint": "The exact SAML attribute names your IdP sends. The stable NameID (must be persistent) becomes the account's identity.",
"authorizeUrl": "Authorization URL",
"tokenUrl": "Token URL",
"userinfoUrl": "Userinfo URL",
"userinfoUrlHint": "There is no ID token in plain OAuth 2.0 — the account's identity is read from this endpoint's JSON response.",
"clientId": "Client ID",
"scopes": "Scopes",
"claimMap": "Claim map",
"subjectField": "Subject field",
"emailField": "Email field",
"nameField": "Name field",
"emailVerifiedField": "Email-verified field",
"claimMapHint": "Which fields of the userinfo response carry identity. The subject must be the provider's stable user ID, never the email address — it's what keeps an account attached when the user renames or changes address upstream.",
"verifiedEmailsUrl": "Verified-emails URL",
"optional": "(optional)",
"verifiedEmailsUrlHint": "For providers that keep verified addresses on a separate endpoint (GitHub). Only the primary, verified address is trusted. Leave blank if the userinfo response already carries a verified flag.",
"usePkce": "Use PKCE",
"usePkceHint": "Extra protection where the provider supports it (Discord does; GitHub's OAuth Apps ignore it). Leave off if sign-in fails with an unexpected-parameter error.",
"issuerUrl": "Issuer URL",
"issuerUrlHint": "Must be HTTPS and publicly resolvable. Discovery reads <mono>{url}</mono>.",
"tenantTemplate": "Tenant issuer template",
"tenantTemplateHint": "Multi-tenant Microsoft Entra only — leave blank for a normal provider. When set, the token's issuer is validated against this template with the signing-in tenant's GUID substituted for <mono>'{tenantid}'</mono>. Trusts every Entra tenant, so restrict access with the registration email-domain allowlist.",
"secretLdap": "Bind password",
"secretSaml": "SP private key (optional)",
"secretOidc": "Client secret",
"secretPlaceholderKeep": "•••••• (leave blank to keep)",
"secretPlaceholderSaml": "-----BEGIN PRIVATE KEY-----…",
"secretHintLdap": "Stored encrypted. The service account's password — required before the provider can be enabled.",
"secretHintSaml": "Stored encrypted. Only needed to sign our requests — leave blank otherwise.",
"secretHintOidc": "Stored encrypted. Leave blank for a public client using PKCE only.",
"signInPolicy": "Sign-in policy",
"postureOpen": "Open — public provider, registration rules apply",
"postureClosed": "Closed — being in this directory is the admission",
"postureHintOpen": "For public IdPs (Google, GitHub): new accounts pass the same registration-open and email-domain checks as the sign-up form.",
"postureHintClosed": "For your own directory (corporate or campus IdP): anyone who can sign in there may enter, even while public registration is closed.",
"trustEmail": "Trust this provider's email addresses",
"trustEmailHint": "Lets a first sign-in attach to an existing account with the same address. Only enable this if the directory verifies mailbox ownership — an unverified address here can claim someone else's account.",
"saving": "Saving…",
"saveChanges": "Save changes",
"addProvider": "Add provider",
"cancel": "Cancel",
"providerUpdated": "Provider updated",
"providerAdded": "Provider added — enable it when you've tested it",
"continue": "Continue",
"setUp": "Set up",
"heading": "Auth providers",
"headingDescription": "Let people sign in with an external identity provider. Local passwords keep working, so an administrator can still get in if a provider goes down.",
"quickSetup": "Quick set up",
"quickSetupHint": "Each of these needs an app registered on the provider's side. After saving, register the callback URL Flagpost shows you.",
"loading": "Loading…",
"badgeEnabled": "Enabled",
"badgeDisabled": "Disabled",
"badgeClosed": "Closed",
"redirectUri": "Redirect URI: {uri}",
"spMetadata": "SP metadata: /api/auth/saml/{slug}/metadata",
"ldapSignInNote": "Signs in through the standard username & password form",
"disable": "Disable",
"enable": "Enable",
"edit": "Edit",
"delete": "Delete",
"providerEnabled": "Provider enabled",
"providerDisabled": "Provider disabled",
"providerDeleted": "Provider deleted",
"deleteTitle": "Delete {name}?",
"deleteDescription": "Anyone who signs in only through this provider will lose their way in — a single-sign-on account has no password to fall back on. Disabling it instead is reversible.",
"deleteConfirm": "Delete",
"emptyTitle": "No identity providers",
"emptyDescription": "Add an OIDC, OAuth 2.0, SAML or LDAP provider to let people sign in with an existing account instead of a Flagpost password."
}
}
}
Loading