---
en:
  admin:
    unauthorized: "You are not authorized to access this area."
    sso_providers:
      index:
        title: "SSO Providers"
        description: "Manage single sign-on authentication providers for your instance"
        add_provider: "Add Provider"
        no_providers_title: "No SSO Providers"
        no_providers_message: "Get started by adding your first SSO provider."
        note: "Changes to SSO providers require a server restart to take effect. Alternatively, enable the AUTH_PROVIDERS_SOURCE=db feature flag to load providers from the database dynamically."
        table:
          name: "Name"
          strategy: "Strategy"
          status: "Status"
          issuer: "Issuer"
          actions: "Actions"
          enabled: "Enabled"
          disabled: "Disabled"
        legacy_providers_title: "Environment-Configured Providers"
        legacy_providers_notice: "These providers are configured via environment variables or YAML and cannot be managed through this interface. To manage them here, migrate them to database-backed providers by enabling AUTH_PROVIDERS_SOURCE=db and recreating them in the UI."
        env_configured: "Env/YAML"
      new:
        title: "Add SSO Provider"
        description: "Configure a new single sign-on authentication provider"
      edit:
        title: "Edit SSO Provider"
        description: "Update configuration for %{label}"
      create:
        success: "SSO provider was successfully created."
      update:
        success: "SSO provider was successfully updated."
      destroy:
        success: "SSO provider was successfully deleted."
        confirm: "Are you sure you want to delete this provider? This action cannot be undone."
      toggle:
        success_enabled: "SSO provider was successfully enabled."
        success_disabled: "SSO provider was successfully disabled."
        confirm_enable: "Are you sure you want to enable this provider?"
        confirm_disable: "Are you sure you want to disable this provider?"
      form:
        basic_information: "Basic Information"
        oauth_configuration: "OAuth/OIDC Configuration"
        strategy_label: "Strategy"
        strategy_help: "The authentication strategy to use"
        name_label: "Name"
        name_placeholder: "e.g., openid_connect, keycloak, authentik"
        name_help: "Unique identifier (lowercase, numbers, underscores only)"
        label_label: "Label"
        label_placeholder: "e.g., Sign in with Keycloak"
        label_help: "Button text shown to users"
        icon_label: "Icon"
        icon_placeholder: "e.g., key, google, github"
        icon_help: "Lucide icon name (optional)"
        enabled_label: "Enable this provider"
        enabled_help: "Users can sign in with this provider when enabled"
        issuer_label: "Issuer"
        issuer_placeholder: "https://accounts.google.com"
        issuer_help: "OIDC issuer URL (will validate .well-known/openid-configuration endpoint)"
        client_id_label: "Client ID"
        client_id_placeholder: "your-client-id"
        client_id_help: "OAuth client ID from your identity provider"
        client_secret_label: "Client Secret"
        client_secret_placeholder_new: "your-client-secret"
        client_secret_placeholder_existing: "••••••••••••••••"
        client_secret_help: "OAuth client secret (encrypted in database)"
        client_secret_help_existing: " - leave blank to keep existing"
        redirect_uri_label: "Redirect URI"
        redirect_uri_placeholder: "https://yourdomain.com/auth/openid_connect/callback"
        redirect_uri_help: "Callback URL to configure in your identity provider"
        copy_button: "Copy"
        cancel: "Cancel"
        submit: "Save Provider"
        errors_title: "%{count} error prohibited this provider from being saved:"
        provisioning_title: "User Provisioning"
        default_role_label: "Default Role for New Users"
        default_role_help: "Role assigned to users created via just-in-time (JIT) SSO account provisioning. Defaults to Member."
        role_member: "Member"
        role_admin: "Admin"
        role_super_admin: "Super Admin"
        role_mapping_title: "Group to Role Mapping (Optional)"
        role_mapping_help: "Map IdP groups/claims to application roles. Users are assigned the highest matching role. Leave blank to use the default role above."
        super_admin_groups: "Super Admin Groups"
        admin_groups: "Admin Groups"
        member_groups: "Member Groups"
        groups_help: "Comma-separated list of IdP group names. Use * to match all groups."
        advanced_title: "Advanced OIDC Settings"
        scopes_label: "Custom Scopes"
        scopes_help: "Space-separated list of OIDC scopes. Leave blank for defaults (openid email profile). Add 'groups' to retrieve group claims."
        prompt_label: "Authentication Prompt"
        prompt_default: "Default (IdP decides)"
        prompt_login: "Force Login (re-authenticate)"
        prompt_consent: "Force Consent (re-authorize)"
        prompt_select_account: "Account Selection (choose account)"
        prompt_none: "No Prompt (silent auth)"
        prompt_help: "Controls how the IdP prompts the user during authentication."
        test_connection: "Test Connection"
        saml_configuration: "SAML Configuration"
        idp_metadata_url: "IdP Metadata URL"
        idp_metadata_url_help: "URL to your IdP's SAML metadata. If provided, other SAML settings will be auto-configured."
        manual_saml_config: "Manual Configuration (if not using metadata URL)"
        manual_saml_help: "Only use these settings if your IdP doesn't provide a metadata URL."
        idp_sso_url: "IdP SSO URL"
        idp_slo_url: "IdP SLO URL (optional)"
        idp_certificate: "IdP Certificate"
        idp_certificate_help: "X.509 certificate in PEM format. Required if not using metadata URL."
        idp_cert_fingerprint: "Certificate Fingerprint (alternative)"
        name_id_format: "NameID Format"
        name_id_email: "Email Address (default)"
        name_id_persistent: "Persistent"
        name_id_transient: "Transient"
        name_id_unspecified: "Unspecified"
