From d4493c0ee9b243b42d752996dbd5479fb6c64cdd Mon Sep 17 00:00:00 2001
From: Jens Langhammer <jens.langhammer@beryju.org>
Date: Sun, 9 May 2021 12:59:00 +0200
Subject: [PATCH 01/10] web/admin: add new base form to handle refresh events

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
---
 web/src/elements/forms/Form.ts      |  7 +++++++
 web/src/elements/forms/ModelForm.ts | 32 +++++++++++++++++++++++++++++
 2 files changed, 39 insertions(+)
 create mode 100644 web/src/elements/forms/ModelForm.ts

diff --git a/web/src/elements/forms/Form.ts b/web/src/elements/forms/Form.ts
index 57297f1f5..786c4cf03 100644
--- a/web/src/elements/forms/Form.ts
+++ b/web/src/elements/forms/Form.ts
@@ -15,6 +15,7 @@ import { MessageLevel } from "../messages/Message";
 import { IronFormElement } from "@polymer/iron-form/iron-form";
 import { camelToSnake, convertToSlug } from "../../utils";
 import { ValidationError } from "authentik-api/src";
+import { EVENT_REFRESH } from "../../constants";
 
 export class APIError extends Error {
 
@@ -140,6 +141,12 @@ export class Form<T> extends LitElement {
                 level: MessageLevel.success,
                 message: this.getSuccessMessage()
             });
+            this.dispatchEvent(
+                new CustomEvent(EVENT_REFRESH, {
+                    bubbles: true,
+                    composed: true,
+                })
+            );
             return r;
         }).catch((ex: Response) => {
             if (ex.status > 399 && ex.status < 500) {
diff --git a/web/src/elements/forms/ModelForm.ts b/web/src/elements/forms/ModelForm.ts
new file mode 100644
index 000000000..612fcab48
--- /dev/null
+++ b/web/src/elements/forms/ModelForm.ts
@@ -0,0 +1,32 @@
+import { property } from "lit-element";
+import { EVENT_REFRESH } from "../../constants";
+import { Form } from "./Form";
+
+export abstract class ModelForm<T, PKT> extends Form<T> {
+
+    abstract loadInstance(pk: PKT): Promise<T>;
+
+    @property()
+    set instancePk(value: PKT) {
+        this._instancePk = value;
+        this.loadInstance(value).then(instance => {
+            this.instance = instance;
+        });
+    }
+
+    private _instancePk?: PKT;
+
+    @property({ attribute: false })
+    instance?: T;
+
+    constructor() {
+        super();
+        this.addEventListener(EVENT_REFRESH, () => {
+            if (!this._instancePk) return;
+            this.loadInstance(this._instancePk).then(instance => {
+                this.instance = instance;
+            });
+        });
+    }
+
+}

From b4d750174f6d384f873055bdfe7b30af72ff7157 Mon Sep 17 00:00:00 2001
From: Jens Langhammer <jens.langhammer@beryju.org>
Date: Tue, 11 May 2021 11:48:34 +0200
Subject: [PATCH 02/10] web/admin: add modelform as base, start migrating

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
---
 web/src/elements/forms/ModelForm.ts           |  4 +-
 web/src/pages/applications/ApplicationForm.ts | 36 ++++----
 .../pages/applications/ApplicationListPage.ts |  2 +-
 web/src/pages/outposts/OutpostForm.ts         | 35 ++++----
 web/src/pages/outposts/OutpostListPage.ts     |  2 +-
 .../PropertyMappingLDAPForm.ts                | 27 +++---
 .../PropertyMappingSAMLForm.ts                | 30 +++----
 .../PropertyMappingScopeForm.ts               | 29 +++----
 web/src/pages/providers/ProviderListPage.ts   |  2 +-
 .../pages/providers/ldap/LDAPProviderForm.ts  | 31 +++----
 .../providers/ldap/LDAPProviderViewPage.ts    |  2 +-
 .../providers/oauth2/OAuth2ProviderForm.ts    | 65 +++++++-------
 .../oauth2/OAuth2ProviderViewPage.ts          |  2 +-
 .../providers/proxy/ProxyProviderForm.ts      | 43 +++++-----
 .../providers/proxy/ProxyProviderViewPage.ts  |  2 +-
 .../pages/providers/saml/SAMLProviderForm.ts  | 76 ++++++++--------
 .../providers/saml/SAMLProviderViewPage.ts    |  2 +-
 web/src/pages/sources/SourcesListPage.ts      |  2 +-
 web/src/pages/sources/ldap/LDAPSourceForm.ts  | 67 +++++++--------
 .../pages/sources/ldap/LDAPSourceViewPage.ts  |  2 +-
 .../pages/sources/oauth/OAuthSourceForm.ts    | 71 ++++++++-------
 .../sources/oauth/OAuthSourceViewPage.ts      |  2 +-
 web/src/pages/sources/plex/PlexSourceForm.ts  | 56 ++++++------
 .../pages/sources/plex/PlexSourceViewPage.ts  |  2 +-
 web/src/pages/sources/saml/SAMLSourceForm.ts  | 86 +++++++++----------
 .../pages/sources/saml/SAMLSourceViewPage.ts  |  2 +-
 26 files changed, 320 insertions(+), 360 deletions(-)

diff --git a/web/src/elements/forms/ModelForm.ts b/web/src/elements/forms/ModelForm.ts
index 612fcab48..e5fd7fdef 100644
--- a/web/src/elements/forms/ModelForm.ts
+++ b/web/src/elements/forms/ModelForm.ts
@@ -2,11 +2,11 @@ import { property } from "lit-element";
 import { EVENT_REFRESH } from "../../constants";
 import { Form } from "./Form";
 
-export abstract class ModelForm<T, PKT> extends Form<T> {
+export abstract class ModelForm<T, PKT extends string | number> extends Form<T> {
 
     abstract loadInstance(pk: PKT): Promise<T>;
 
-    @property()
+    @property({attribute: false})
     set instancePk(value: PKT) {
         this._instancePk = value;
         this.loadInstance(value).then(instance => {
diff --git a/web/src/pages/applications/ApplicationForm.ts b/web/src/pages/applications/ApplicationForm.ts
index a169e0d94..74e117041 100644
--- a/web/src/pages/applications/ApplicationForm.ts
+++ b/web/src/pages/applications/ApplicationForm.ts
@@ -13,18 +13,22 @@ import "../../elements/forms/ModalForm";
 import "../../elements/forms/HorizontalFormElement";
 import "../../elements/forms/FormGroup";
 import PFDropdown from "@patternfly/patternfly/components/Dropdown/dropdown.css";
+import { ModelForm } from "../../elements/forms/ModelForm";
 
 @customElement("ak-application-form")
-export class ApplicationForm extends Form<Application> {
+export class ApplicationForm extends ModelForm<Application, string> {
 
-    @property({ attribute: false })
-    application?: Application;
+    loadInstance(pk: string): Promise<Application> {
+        return new CoreApi(DEFAULT_CONFIG).coreApplicationsRead({
+            slug: pk
+        });
+    }
 
     @property({ attribute: false })
     provider?: number;
 
     getSuccessMessage(): string {
-        if (this.application) {
+        if (this.instance) {
             return t`Successfully updated application.`;
         } else {
             return t`Successfully created application.`;
@@ -37,9 +41,9 @@ export class ApplicationForm extends Form<Application> {
 
     send = (data: Application): Promise<Application | void> => {
         let writeOp: Promise<Application>;
-        if (this.application) {
+        if (this.instance) {
             writeOp = new CoreApi(DEFAULT_CONFIG).coreApplicationsUpdate({
-                slug: this.application.slug,
+                slug: this.instance.slug,
                 data: data
             });
         } else {
@@ -72,7 +76,7 @@ export class ApplicationForm extends Form<Application> {
             ${Array.from(m).map(([group, providers]) => {
                 return html`<optgroup label=${group}>
                     ${providers.map(p => {
-                        const selected = (this.application?.provider === p.pk) || (this.provider === p.pk);
+                        const selected = (this.instance?.provider === p.pk) || (this.provider === p.pk);
                         return html`<option ?selected=${selected} value=${ifDefined(p.pk)}>${p.name}</option>`;
                     })}
                 </optgroup>`;
@@ -86,21 +90,21 @@ export class ApplicationForm extends Form<Application> {
                 label=${t`Name`}
                 ?required=${true}
                 name="name">
-                <input type="text" value="${ifDefined(this.application?.name)}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.name)}" class="pf-c-form-control" required>
                 <p class="pf-c-form__helper-text">${t`Application's display Name.`}</p>
             </ak-form-element-horizontal>
             <ak-form-element-horizontal
                 label=${t`Slug`}
                 ?required=${true}
                 name="slug">
-                <input type="text" value="${ifDefined(this.application?.slug)}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.slug)}" class="pf-c-form-control" required>
                 <p class="pf-c-form__helper-text">${t`Internal application name, used in URLs.`}</p>
             </ak-form-element-horizontal>
             <ak-form-element-horizontal
                 label=${t`Provider`}
                 name="provider">
                 <select class="pf-c-form-control">
-                    <option value="" ?selected=${this.application?.provider === undefined}>---------</option>
+                    <option value="" ?selected=${this.instance?.provider === undefined}>---------</option>
                     ${until(new ProvidersApi(DEFAULT_CONFIG).providersAllList({}).then(providers => {
                         return this.groupProviders(providers.results);
                     }), html`<option>${t`Loading...`}</option>`)}
@@ -142,10 +146,10 @@ export class ApplicationForm extends Form<Application> {
                 ?required=${true}
                 name="policyEngineMode">
                 <select class="pf-c-form-control">
-                    <option value=${ApplicationPolicyEngineModeEnum.Any} ?selected=${this.application?.policyEngineMode === ApplicationPolicyEngineModeEnum.Any}>
+                    <option value=${ApplicationPolicyEngineModeEnum.Any} ?selected=${this.instance?.policyEngineMode === ApplicationPolicyEngineModeEnum.Any}>
                         ${t`ANY, any policy must match to grant access.`}
                     </option>
-                    <option value=${ApplicationPolicyEngineModeEnum.All} ?selected=${this.application?.policyEngineMode === ApplicationPolicyEngineModeEnum.All}>
+                    <option value=${ApplicationPolicyEngineModeEnum.All} ?selected=${this.instance?.policyEngineMode === ApplicationPolicyEngineModeEnum.All}>
                         ${t`ALL, all policies must match to grant access.`}
                     </option>
                 </select>
@@ -158,23 +162,23 @@ export class ApplicationForm extends Form<Application> {
                     <ak-form-element-horizontal
                         label=${t`Launch URL`}
                         name="metaLaunchUrl">
-                        <input type="text" value="${ifDefined(this.application?.metaLaunchUrl)}" class="pf-c-form-control">
+                        <input type="text" value="${ifDefined(this.instance?.metaLaunchUrl)}" class="pf-c-form-control">
                         <p class="pf-c-form__helper-text">${t`If left empty, authentik will try to extract the launch URL based on the selected provider.`}</p>
                     </ak-form-element-horizontal>
                     <ak-form-element-horizontal
                         label=${t`Icon`}
                         name="metaIcon">
-                        <input type="file" value="${ifDefined(this.application?.metaIcon)}" class="pf-c-form-control">
+                        <input type="file" value="${ifDefined(this.instance?.metaIcon)}" class="pf-c-form-control">
                     </ak-form-element-horizontal>
                     <ak-form-element-horizontal
                         label=${t`Description`}
                         name="metaDescription">
-                        <textarea class="pf-c-form-control">${ifDefined(this.application?.metaDescription)}</textarea>
+                        <textarea class="pf-c-form-control">${ifDefined(this.instance?.metaDescription)}</textarea>
                     </ak-form-element-horizontal>
                     <ak-form-element-horizontal
                         label=${t`Publisher`}
                         name="metaPublisher">
-                        <input type="text" value="${ifDefined(this.application?.metaPublisher)}" class="pf-c-form-control">
+                        <input type="text" value="${ifDefined(this.instance?.metaPublisher)}" class="pf-c-form-control">
                     </ak-form-element-horizontal>
                 </div>
             </ak-form-group>
diff --git a/web/src/pages/applications/ApplicationListPage.ts b/web/src/pages/applications/ApplicationListPage.ts
index 66177438d..3bdebecc8 100644
--- a/web/src/pages/applications/ApplicationListPage.ts
+++ b/web/src/pages/applications/ApplicationListPage.ts
@@ -89,7 +89,7 @@ export class ApplicationListPage extends TablePage<Application> {
                 <span slot="header">
                     ${t`Update Application`}
                 </span>
-                <ak-application-form slot="form" .application=${item}>
+                <ak-application-form slot="form" .instancePk=${item.slug}>
                 </ak-application-form>
                 <button slot="trigger" class="pf-c-button pf-m-secondary">
                     ${t`Edit`}
diff --git a/web/src/pages/outposts/OutpostForm.ts b/web/src/pages/outposts/OutpostForm.ts
index 1e65dd045..9bd78b0d1 100644
--- a/web/src/pages/outposts/OutpostForm.ts
+++ b/web/src/pages/outposts/OutpostForm.ts
@@ -3,21 +3,24 @@ import { t } from "@lingui/macro";
 import { customElement, property } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../api/Config";
-import { Form } from "../../elements/forms/Form";
 import { until } from "lit-html/directives/until";
 import { ifDefined } from "lit-html/directives/if-defined";
 import "../../elements/forms/HorizontalFormElement";
 import "../../elements/CodeMirror";
 import YAML from "yaml";
+import { ModelForm } from "../../elements/forms/ModelForm";
 
 @customElement("ak-outpost-form")
-export class OutpostForm extends Form<Outpost> {
+export class OutpostForm extends ModelForm<Outpost, string> {
 
-    @property({attribute: false})
-    outpost?: Outpost;
+    loadInstance(pk: string): Promise<Outpost> {
+        return new OutpostsApi(DEFAULT_CONFIG).outpostsInstancesRead({
+            uuid: pk
+        });
+    }
 
     getSuccessMessage(): string {
-        if (this.outpost) {
+        if (this.instance) {
             return t`Successfully updated outpost.`;
         } else {
             return t`Successfully created outpost.`;
@@ -25,9 +28,9 @@ export class OutpostForm extends Form<Outpost> {
     }
 
     send = (data: Outpost): Promise<Outpost> => {
-        if (this.outpost) {
+        if (this.instance) {
             return new OutpostsApi(DEFAULT_CONFIG).outpostsOutpostsUpdate({
-                uuid: this.outpost.pk || "",
+                uuid: this.instance.pk || "",
                 data: data
             });
         } else {
@@ -43,27 +46,27 @@ export class OutpostForm extends Form<Outpost> {
                 label=${t`Name`}
                 ?required=${true}
                 name="name">
-                <input type="text" value="${ifDefined(this.outpost?.name)}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.name)}" class="pf-c-form-control" required>
             </ak-form-element-horizontal>
             <ak-form-element-horizontal
                 label=${t`Type`}
                 ?required=${true}
                 name="type">
                 <select class="pf-c-form-control">
-                    <option value=${OutpostTypeEnum.Proxy} ?selected=${this.outpost?.type === OutpostTypeEnum.Proxy}>${t`Proxy`}</option>
-                    <option value=${OutpostTypeEnum.Ldap} ?selected=${this.outpost?.type === OutpostTypeEnum.Ldap}>${t`LDAP (Technical preview)`}</option>
+                    <option value=${OutpostTypeEnum.Proxy} ?selected=${this.instance?.type === OutpostTypeEnum.Proxy}>${t`Proxy`}</option>
+                    <option value=${OutpostTypeEnum.Ldap} ?selected=${this.instance?.type === OutpostTypeEnum.Ldap}>${t`LDAP (Technical preview)`}</option>
                 </select>
             </ak-form-element-horizontal>
             <ak-form-element-horizontal
                 label=${t`Service connection`}
                 name="serviceConnection">
                 <select class="pf-c-form-control">
-                    <option value="" ?selected=${this.outpost?.serviceConnection === undefined}>---------</option>
+                    <option value="" ?selected=${this.instance?.serviceConnection === undefined}>---------</option>
                     ${until(new OutpostsApi(DEFAULT_CONFIG).outpostsServiceConnectionsAllList({
                         ordering: "pk"
                     }).then(scs => {
                         return scs.results.map(sc => {
-                            return html`<option value=${ifDefined(sc.pk)} ?selected=${this.outpost?.serviceConnection === sc.pk}>
+                            return html`<option value=${ifDefined(sc.pk)} ?selected=${this.instance?.serviceConnection === sc.pk}>
                                 ${sc.name} (${sc.verboseName})
                             </option>`;
                         });
@@ -83,7 +86,7 @@ export class OutpostForm extends Form<Outpost> {
                         ordering: "pk"
                     }).then(providers => {
                         return providers.results.map(provider => {
-                            const selected = Array.from(this.outpost?.providers || []).some(sp => {
+                            const selected = Array.from(this.instance?.providers || []).some(sp => {
                                 return sp == provider.pk;
                             });
                             return html`<option value=${ifDefined(provider.pk)} ?selected=${selected}>${provider.verboseName} ${provider.name}</option>`;
@@ -93,7 +96,7 @@ export class OutpostForm extends Form<Outpost> {
                         ordering: "pk"
                     }).then(providers => {
                         return providers.results.map(provider => {
-                            const selected = Array.from(this.outpost?.providers || []).some(sp => {
+                            const selected = Array.from(this.instance?.providers || []).some(sp => {
                                 return sp == provider.pk;
                             });
                             return html`<option value=${ifDefined(provider.pk)} ?selected=${selected}>${provider.verboseName} ${provider.name}</option>`;
@@ -107,8 +110,8 @@ export class OutpostForm extends Form<Outpost> {
                 name="config">
                 <ak-codemirror mode="yaml" value="${until(new OutpostsApi(DEFAULT_CONFIG).outpostsOutpostsDefaultSettings({}).then(config => {
                         let fc = config.config;
-                        if (this.outpost) {
-                            fc = this.outpost.config;
+                        if (this.instance) {
+                            fc = this.instance.config;
                         }
                         return YAML.stringify(fc);
                     }))}"></ak-codemirror>
diff --git a/web/src/pages/outposts/OutpostListPage.ts b/web/src/pages/outposts/OutpostListPage.ts
index 8016605af..02118d1f5 100644
--- a/web/src/pages/outposts/OutpostListPage.ts
+++ b/web/src/pages/outposts/OutpostListPage.ts
@@ -66,7 +66,7 @@ export class OutpostListPage extends TablePage<Outpost> {
                 <span slot="header">
                     ${t`Update Outpost`}
                 </span>
-                <ak-outpost-form slot="form" .outpost=${item}>
+                <ak-outpost-form slot="form" .instancePk=${item.pk}>
                 </ak-outpost-form>
                 <button slot="trigger" class="pf-c-button pf-m-secondary">
                     ${t`Edit`}
diff --git a/web/src/pages/property-mappings/PropertyMappingLDAPForm.ts b/web/src/pages/property-mappings/PropertyMappingLDAPForm.ts
index 62bfd1884..755f1ea7a 100644
--- a/web/src/pages/property-mappings/PropertyMappingLDAPForm.ts
+++ b/web/src/pages/property-mappings/PropertyMappingLDAPForm.ts
@@ -3,27 +3,22 @@ import { t } from "@lingui/macro";
 import { customElement, property } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../api/Config";
-import { Form } from "../../elements/forms/Form";
 import { ifDefined } from "lit-html/directives/if-defined";
 import "../../elements/forms/HorizontalFormElement";
 import "../../elements/CodeMirror";
+import { ModelForm } from "../../elements/forms/ModelForm";
 
 @customElement("ak-property-mapping-ldap-form")
-export class PropertyMappingLDAPForm extends Form<LDAPPropertyMapping> {
+export class PropertyMappingLDAPForm extends ModelForm<LDAPPropertyMapping, string> {
 
-    set mappingUUID(value: string) {
-        new PropertymappingsApi(DEFAULT_CONFIG).propertymappingsLdapRead({
-            pmUuid: value,
-        }).then(mapping => {
-            this.mapping = mapping;
+    loadInstance(pk: string): Promise<LDAPPropertyMapping> {
+        return new PropertymappingsApi(DEFAULT_CONFIG).propertymappingsLdapRead({
+            pmUuid: pk,
         });
     }
 
-    @property({attribute: false})
-    mapping?: LDAPPropertyMapping;
-
     getSuccessMessage(): string {
-        if (this.mapping) {
+        if (this.instance) {
             return t`Successfully updated mapping.`;
         } else {
             return t`Successfully created mapping.`;
@@ -31,9 +26,9 @@ export class PropertyMappingLDAPForm extends Form<LDAPPropertyMapping> {
     }
 
     send = (data: LDAPPropertyMapping): Promise<LDAPPropertyMapping> => {
-        if (this.mapping) {
+        if (this.instance) {
             return new PropertymappingsApi(DEFAULT_CONFIG).propertymappingsLdapUpdate({
-                pmUuid: this.mapping.pk || "",
+                pmUuid: this.instance.pk || "",
                 data: data
             });
         } else {
@@ -49,20 +44,20 @@ export class PropertyMappingLDAPForm extends Form<LDAPPropertyMapping> {
                 label=${t`Name`}
                 ?required=${true}
                 name="name">
-                <input type="text" value="${ifDefined(this.mapping?.name)}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.name)}" class="pf-c-form-control" required>
             </ak-form-element-horizontal>
             <ak-form-element-horizontal
                 label=${t`Object field`}
                 ?required=${true}
                 name="objectField">
-                <input type="text" value="${ifDefined(this.mapping?.objectField)}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.objectField)}" class="pf-c-form-control" required>
                 <p class="pf-c-form__helper-text">${t`Field of the user object this value is written to.`}</p>
             </ak-form-element-horizontal>
             <ak-form-element-horizontal
                 label=${t`Expression`}
                 ?required=${true}
                 name="expression">
-                <ak-codemirror mode="python" value="${ifDefined(this.mapping?.expression)}">
+                <ak-codemirror mode="python" value="${ifDefined(this.instance?.expression)}">
                 </ak-codemirror>
                 <p class="pf-c-form__helper-text">
                     ${t`Expression using Python.`}
diff --git a/web/src/pages/property-mappings/PropertyMappingSAMLForm.ts b/web/src/pages/property-mappings/PropertyMappingSAMLForm.ts
index 61539f035..d7aca81d3 100644
--- a/web/src/pages/property-mappings/PropertyMappingSAMLForm.ts
+++ b/web/src/pages/property-mappings/PropertyMappingSAMLForm.ts
@@ -3,27 +3,21 @@ import { t } from "@lingui/macro";
 import { customElement, property } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../api/Config";
-import { Form } from "../../elements/forms/Form";
 import { ifDefined } from "lit-html/directives/if-defined";
 import "../../elements/forms/HorizontalFormElement";
 import "../../elements/CodeMirror";
+import { ModelForm } from "../../elements/forms/ModelForm";
 
 @customElement("ak-property-mapping-saml-form")
-export class PropertyMappingLDAPForm extends Form<SAMLPropertyMapping> {
-
-    set mappingUUID(value: string) {
-        new PropertymappingsApi(DEFAULT_CONFIG).propertymappingsSamlRead({
-            pmUuid: value,
-        }).then(mapping => {
-            this.mapping = mapping;
+export class PropertyMappingLDAPForm extends ModelForm<SAMLPropertyMapping, string> {
+    loadInstance(pk: string): Promise<SAMLPropertyMapping> {
+        return new PropertymappingsApi(DEFAULT_CONFIG).propertymappingsSamlRead({
+            pmUuid: pk,
         });
     }
 
-    @property({attribute: false})
-    mapping?: SAMLPropertyMapping;
-
     getSuccessMessage(): string {
-        if (this.mapping) {
+        if (this.instance) {
             return t`Successfully updated mapping.`;
         } else {
             return t`Successfully created mapping.`;
@@ -31,9 +25,9 @@ export class PropertyMappingLDAPForm extends Form<SAMLPropertyMapping> {
     }
 
     send = (data: SAMLPropertyMapping): Promise<SAMLPropertyMapping> => {
-        if (this.mapping) {
+        if (this.instance) {
             return new PropertymappingsApi(DEFAULT_CONFIG).propertymappingsSamlUpdate({
-                pmUuid: this.mapping.pk || "",
+                pmUuid: this.instance.pk || "",
                 data: data
             });
         } else {
@@ -49,13 +43,13 @@ export class PropertyMappingLDAPForm extends Form<SAMLPropertyMapping> {
                 label=${t`Name`}
                 ?required=${true}
                 name="name">
-                <input type="text" value="${ifDefined(this.mapping?.name)}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.name)}" class="pf-c-form-control" required>
             </ak-form-element-horizontal>
             <ak-form-element-horizontal
                 label=${t`SAML Attribute Name`}
                 ?required=${true}
                 name="samlName">
-                <input type="text" value="${ifDefined(this.mapping?.samlName)}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.samlName)}" class="pf-c-form-control" required>
                 <p class="pf-c-form__helper-text">
                     ${t`Attribute name used for SAML Assertions. Can be a URN OID, a schema reference, or a any other string. If this property mapping is used for NameID Property, this field is discarded.`}
                 </p>
@@ -63,7 +57,7 @@ export class PropertyMappingLDAPForm extends Form<SAMLPropertyMapping> {
             <ak-form-element-horizontal
                 label=${t`Friendly Name`}
                 name="friendlyName">
-                <input type="text" value="${ifDefined(this.mapping?.friendlyName || "")}" class="pf-c-form-control">
+                <input type="text" value="${ifDefined(this.instance?.friendlyName || "")}" class="pf-c-form-control">
                 <p class="pf-c-form__helper-text">
                     ${t`Optionally set the 'FriendlyName' value of the Assertion attribute.`}
                 </p>
@@ -72,7 +66,7 @@ export class PropertyMappingLDAPForm extends Form<SAMLPropertyMapping> {
                 label=${t`Expression`}
                 ?required=${true}
                 name="expression">
-                <ak-codemirror mode="python" value="${ifDefined(this.mapping?.expression)}">
+                <ak-codemirror mode="python" value="${ifDefined(this.instance?.expression)}">
                 </ak-codemirror>
                 <p class="pf-c-form__helper-text">
                     ${t`Expression using Python.`}
diff --git a/web/src/pages/property-mappings/PropertyMappingScopeForm.ts b/web/src/pages/property-mappings/PropertyMappingScopeForm.ts
index 21014dda1..68cd24986 100644
--- a/web/src/pages/property-mappings/PropertyMappingScopeForm.ts
+++ b/web/src/pages/property-mappings/PropertyMappingScopeForm.ts
@@ -3,27 +3,22 @@ import { t } from "@lingui/macro";
 import { customElement, property } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../api/Config";
-import { Form } from "../../elements/forms/Form";
+import { ModelForm } from "../../elements/forms/ModelForm";
 import { ifDefined } from "lit-html/directives/if-defined";
 import "../../elements/forms/HorizontalFormElement";
 import "../../elements/CodeMirror";
 
 @customElement("ak-property-mapping-scope-form")
-export class PropertyMappingScopeForm extends Form<ScopeMapping> {
+export class PropertyMappingScopeForm extends ModelForm<ScopeMapping, string> {
 
-    set mappingUUID(value: string) {
-        new PropertymappingsApi(DEFAULT_CONFIG).propertymappingsScopeRead({
-            pmUuid: value,
-        }).then(mapping => {
-            this.mapping = mapping;
+    loadInstance(pk: string): Promise<ScopeMapping> {
+        return new PropertymappingsApi(DEFAULT_CONFIG).propertymappingsScopeRead({
+            pmUuid: pk,
         });
     }
 
-    @property({attribute: false})
-    mapping?: ScopeMapping;
-
     getSuccessMessage(): string {
-        if (this.mapping) {
+        if (this.instance) {
             return t`Successfully updated mapping.`;
         } else {
             return t`Successfully created mapping.`;
@@ -31,9 +26,9 @@ export class PropertyMappingScopeForm extends Form<ScopeMapping> {
     }
 
     send = (data: ScopeMapping): Promise<ScopeMapping> => {
-        if (this.mapping) {
+        if (this.instance) {
             return new PropertymappingsApi(DEFAULT_CONFIG).propertymappingsScopeUpdate({
-                pmUuid: this.mapping.pk || "",
+                pmUuid: this.instance.pk || "",
                 data: data
             });
         } else {
@@ -49,27 +44,27 @@ export class PropertyMappingScopeForm extends Form<ScopeMapping> {
                 label=${t`Name`}
                 ?required=${true}
                 name="name">
-                <input type="text" value="${ifDefined(this.mapping?.name)}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.name)}" class="pf-c-form-control" required>
             </ak-form-element-horizontal>
             <ak-form-element-horizontal
                 label=${t`Scope name`}
                 ?required=${true}
                 name="scopeName">
-                <input type="text" value="${ifDefined(this.mapping?.scopeName)}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.scopeName)}" class="pf-c-form-control" required>
                 <p class="pf-c-form__helper-text">${t`Scope which the client can specify to access these properties.`}</p>
             </ak-form-element-horizontal>
             <ak-form-element-horizontal
                 label=${t`Description`}
                 ?required=${true}
                 name="description">
-                <input type="text" value="${ifDefined(this.mapping?.description)}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.description)}" class="pf-c-form-control" required>
                 <p class="pf-c-form__helper-text">${t`Description shown to the user when consenting. If left empty, the user won't be informed.`}</p>
             </ak-form-element-horizontal>
             <ak-form-element-horizontal
                 label=${t`Expression`}
                 ?required=${true}
                 name="expression">
-                <ak-codemirror mode="python" value="${ifDefined(this.mapping?.expression)}">
+                <ak-codemirror mode="python" value="${ifDefined(this.instance?.expression)}">
                 </ak-codemirror>
                 <p class="pf-c-form__helper-text">
                     ${t`Expression using Python.`}
diff --git a/web/src/pages/providers/ProviderListPage.ts b/web/src/pages/providers/ProviderListPage.ts
index cf1d56281..233ede457 100644
--- a/web/src/pages/providers/ProviderListPage.ts
+++ b/web/src/pages/providers/ProviderListPage.ts
@@ -79,7 +79,7 @@ export class ProviderListPage extends TablePage<Provider> {
                 <ak-proxy-form
                     slot="form"
                     .args=${{
-                        "providerUUID": item.pk
+                        "instancePk": item.pk
                     }}
                     type=${ifDefined(item.component)}>
                 </ak-proxy-form>
diff --git a/web/src/pages/providers/ldap/LDAPProviderForm.ts b/web/src/pages/providers/ldap/LDAPProviderForm.ts
index 4a21f4766..5f07bc379 100644
--- a/web/src/pages/providers/ldap/LDAPProviderForm.ts
+++ b/web/src/pages/providers/ldap/LDAPProviderForm.ts
@@ -3,7 +3,7 @@ import { t } from "@lingui/macro";
 import { customElement, property } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../../api/Config";
-import { Form } from "../../../elements/forms/Form";
+import { ModelForm } from "../../../elements/forms/ModelForm";
 import { until } from "lit-html/directives/until";
 import { ifDefined } from "lit-html/directives/if-defined";
 import "../../../elements/forms/HorizontalFormElement";
@@ -11,21 +11,16 @@ import "../../../elements/forms/FormGroup";
 import { first } from "../../../utils";
 
 @customElement("ak-provider-ldap-form")
-export class LDAPProviderFormPage extends Form<LDAPProvider> {
+export class LDAPProviderFormPage extends ModelForm<LDAPProvider, number> {
 
-    set providerUUID(value: number) {
-        new ProvidersApi(DEFAULT_CONFIG).providersLdapRead({
-            id: value,
-        }).then(provider => {
-            this.provider = provider;
+    loadInstance(pk: number): Promise<LDAPProvider> {
+        return new ProvidersApi(DEFAULT_CONFIG).providersLdapRead({
+            id: pk,
         });
     }
 
-    @property({attribute: false})
-    provider?: LDAPProvider;
-
     getSuccessMessage(): string {
-        if (this.provider) {
+        if (this.instance) {
             return t`Successfully updated provider.`;
         } else {
             return t`Successfully created provider.`;
@@ -33,9 +28,9 @@ export class LDAPProviderFormPage extends Form<LDAPProvider> {
     }
 
     send = (data: LDAPProvider): Promise<LDAPProvider> => {
-        if (this.provider) {
+        if (this.instance) {
             return new ProvidersApi(DEFAULT_CONFIG).providersLdapUpdate({
-                id: this.provider.pk || 0,
+                id: this.instance.pk || 0,
                 data: data
             });
         } else {
@@ -51,7 +46,7 @@ export class LDAPProviderFormPage extends Form<LDAPProvider> {
                 label=${t`Name`}
                 ?required=${true}
                 name="name">
-                <input type="text" value="${ifDefined(this.provider?.name)}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.name)}" class="pf-c-form-control" required>
             </ak-form-element-horizontal>
             <ak-form-element-horizontal
                 label=${t`Bind flow`}
@@ -63,7 +58,7 @@ export class LDAPProviderFormPage extends Form<LDAPProvider> {
                         designation: FlowDesignationEnum.Authentication,
                     }).then(flows => {
                         return flows.results.map(flow => {
-                            return html`<option value=${ifDefined(flow.pk)} ?selected=${this.provider?.authorizationFlow === flow.pk}>${flow.name} (${flow.slug})</option>`;
+                            return html`<option value=${ifDefined(flow.pk)} ?selected=${this.instance?.authorizationFlow === flow.pk}>${flow.name} (${flow.slug})</option>`;
                         });
                     }), html`<option>${t`Loading...`}</option>`)}
                 </select>
@@ -73,10 +68,10 @@ export class LDAPProviderFormPage extends Form<LDAPProvider> {
                 label=${t`Group`}
                 name="searchGroup">
                 <select class="pf-c-form-control">
-                    <option value="" ?selected=${this.provider?.searchGroup === undefined}>---------</option>
+                    <option value="" ?selected=${this.instance?.searchGroup === undefined}>---------</option>
                     ${until(new CoreApi(DEFAULT_CONFIG).coreGroupsList({}).then(groups => {
                         return groups.results.map(group => {
-                            return html`<option value=${ifDefined(group.pk)} ?selected=${this.provider?.searchGroup === group.pk}>${group.name}</option>`;
+                            return html`<option value=${ifDefined(group.pk)} ?selected=${this.instance?.searchGroup === group.pk}>${group.name}</option>`;
                         });
                     }), html`<option>${t`Loading...`}</option>`)}
                 </select>
@@ -92,7 +87,7 @@ export class LDAPProviderFormPage extends Form<LDAPProvider> {
                         label=${t`Base DN`}
                         ?required=${true}
                         name="baseDn">
-                        <input type="text" value="${first(this.provider?.baseDn, "DC=ldap,DC=goauthentik,DC=io")}" class="pf-c-form-control" required>
+                        <input type="text" value="${first(this.instance?.baseDn, "DC=ldap,DC=goauthentik,DC=io")}" class="pf-c-form-control" required>
                         <p class="pf-c-form__helper-text">${t`LDAP DN under which bind requests and search requests can be made.`}</p>
                     </ak-form-element-horizontal>
                 </div>
diff --git a/web/src/pages/providers/ldap/LDAPProviderViewPage.ts b/web/src/pages/providers/ldap/LDAPProviderViewPage.ts
index e8bc97667..0f7a05768 100644
--- a/web/src/pages/providers/ldap/LDAPProviderViewPage.ts
+++ b/web/src/pages/providers/ldap/LDAPProviderViewPage.ts
@@ -102,7 +102,7 @@ export class LDAPProviderViewPage extends LitElement {
                                         </span>
                                         <ak-provider-ldap-form
                                             slot="form"
-                                            .providerUUID=${this.provider.pk || 0}>
+                                            .instancePk=${this.provider.pk || 0}>
                                         </ak-provider-ldap-form>
                                         <button slot="trigger" class="pf-c-button pf-m-primary">
                                             ${t`Edit`}
diff --git a/web/src/pages/providers/oauth2/OAuth2ProviderForm.ts b/web/src/pages/providers/oauth2/OAuth2ProviderForm.ts
index bea1cfe27..eb720b3e4 100644
--- a/web/src/pages/providers/oauth2/OAuth2ProviderForm.ts
+++ b/web/src/pages/providers/oauth2/OAuth2ProviderForm.ts
@@ -3,7 +3,7 @@ import { t } from "@lingui/macro";
 import { customElement, property } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../../api/Config";
-import { Form } from "../../../elements/forms/Form";
+import { ModelForm } from "../../../elements/forms/ModelForm";
 import { until } from "lit-html/directives/until";
 import { ifDefined } from "lit-html/directives/if-defined";
 import "../../../elements/forms/HorizontalFormElement";
@@ -11,25 +11,22 @@ import "../../../elements/forms/FormGroup";
 import { first, randomString } from "../../../utils";
 
 @customElement("ak-provider-oauth2-form")
-export class OAuth2ProviderFormPage extends Form<OAuth2Provider> {
+export class OAuth2ProviderFormPage extends ModelForm<OAuth2Provider, number> {
 
-    set providerUUID(value: number) {
-        new ProvidersApi(DEFAULT_CONFIG).providersOauth2Read({
-            id: value,
+    loadInstance(pk: number): Promise<OAuth2Provider> {
+        return new ProvidersApi(DEFAULT_CONFIG).providersOauth2Read({
+            id: pk,
         }).then(provider => {
-            this.provider = provider;
             this.showClientSecret = provider.clientType === OAuth2ProviderClientTypeEnum.Confidential;
+            return provider;
         });
     }
 
-    @property({attribute: false})
-    provider?: OAuth2Provider;
-
     @property({type: Boolean})
     showClientSecret = true;
 
     getSuccessMessage(): string {
-        if (this.provider) {
+        if (this.instance) {
             return t`Successfully updated provider.`;
         } else {
             return t`Successfully created provider.`;
@@ -37,9 +34,9 @@ export class OAuth2ProviderFormPage extends Form<OAuth2Provider> {
     }
 
     send = (data: OAuth2Provider): Promise<OAuth2Provider> => {
-        if (this.provider) {
+        if (this.instance) {
             return new ProvidersApi(DEFAULT_CONFIG).providersOauth2Update({
-                id: this.provider.pk || 0,
+                id: this.instance.pk || 0,
                 data: data
             });
         } else {
@@ -55,7 +52,7 @@ export class OAuth2ProviderFormPage extends Form<OAuth2Provider> {
                 label=${t`Name`}
                 ?required=${true}
                 name="name">
-                <input type="text" value="${ifDefined(this.provider?.name)}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.name)}" class="pf-c-form-control" required>
             </ak-form-element-horizontal>
             <ak-form-element-horizontal
                 label=${t`Authorization flow`}
@@ -67,7 +64,7 @@ export class OAuth2ProviderFormPage extends Form<OAuth2Provider> {
                         designation: FlowDesignationEnum.Authorization,
                     }).then(flows => {
                         return flows.results.map(flow => {
-                            return html`<option value=${ifDefined(flow.pk)} ?selected=${this.provider?.authorizationFlow === flow.pk}>${flow.name} (${flow.slug})</option>`;
+                            return html`<option value=${ifDefined(flow.pk)} ?selected=${this.instance?.authorizationFlow === flow.pk}>${flow.name} (${flow.slug})</option>`;
                         });
                     }), html`<option>${t`Loading...`}</option>`)}
                 </select>
@@ -91,10 +88,10 @@ export class OAuth2ProviderFormPage extends Form<OAuth2Provider> {
                                 this.showClientSecret = true;
                             }
                         }}>
-                            <option value=${OAuth2ProviderClientTypeEnum.Confidential} ?selected=${this.provider?.clientType === OAuth2ProviderClientTypeEnum.Confidential}>
+                            <option value=${OAuth2ProviderClientTypeEnum.Confidential} ?selected=${this.instance?.clientType === OAuth2ProviderClientTypeEnum.Confidential}>
                                 ${t`Confidential`}
                             </option>
-                            <option value=${OAuth2ProviderClientTypeEnum.Public} ?selected=${this.provider?.clientType === OAuth2ProviderClientTypeEnum.Public}>
+                            <option value=${OAuth2ProviderClientTypeEnum.Public} ?selected=${this.instance?.clientType === OAuth2ProviderClientTypeEnum.Public}>
                                 ${t`Public`}
                             </option>
                         </select>
@@ -104,19 +101,19 @@ export class OAuth2ProviderFormPage extends Form<OAuth2Provider> {
                         label=${t`Client ID`}
                         ?required=${true}
                         name="clientId">
-                        <input type="text" value="${first(this.provider?.clientId, randomString(40))}" class="pf-c-form-control" required>
+                        <input type="text" value="${first(this.instance?.clientId, randomString(40))}" class="pf-c-form-control" required>
                     </ak-form-element-horizontal>
                     <ak-form-element-horizontal
                         ?hidden=${!this.showClientSecret}
                         label=${t`Client Secret`}
                         name="clientSecret">
-                        <input type="text" value="${first(this.provider?.clientSecret, randomString(128))}" class="pf-c-form-control">
+                        <input type="text" value="${first(this.instance?.clientSecret, randomString(128))}" class="pf-c-form-control">
                     </ak-form-element-horizontal>
                     <ak-form-element-horizontal
                         label=${t`Redirect URIs/Origins`}
                         ?required=${true}
                         name="redirectUris">
-                        <textarea class="pf-c-form-control" required>${this.provider?.redirectUris}</textarea>
+                        <textarea class="pf-c-form-control" required>${this.instance?.redirectUris}</textarea>
                         <p class="pf-c-form__helper-text">
                             ${t`Valid redirect URLs after a successful authorization flow. Also specify any origins here for Implicit flows.`}
                         </p>
@@ -133,7 +130,7 @@ export class OAuth2ProviderFormPage extends Form<OAuth2Provider> {
                         label=${t`Access code validity`}
                         ?required=${true}
                         name="accessCodeValidity">
-                        <input type="text" value="${first(this.provider?.accessCodeValidity, "minutes=1")}" class="pf-c-form-control" required>
+                        <input type="text" value="${first(this.instance?.accessCodeValidity, "minutes=1")}" class="pf-c-form-control" required>
                         <p class="pf-c-form__helper-text">${t`Configure how long access codes are valid for.`}</p>
                         <p class="pf-c-form__helper-text">${t`(Format: hours=-1;minutes=-2;seconds=-3).`}</p>
                     </ak-form-element-horizontal>
@@ -141,7 +138,7 @@ export class OAuth2ProviderFormPage extends Form<OAuth2Provider> {
                         label=${t`Token validity`}
                         ?required=${true}
                         name="tokenValidity">
-                        <input type="text" value="${first(this.provider?.tokenValidity, "minutes=10")}" class="pf-c-form-control" required>
+                        <input type="text" value="${first(this.instance?.tokenValidity, "minutes=10")}" class="pf-c-form-control" required>
                         <p class="pf-c-form__helper-text">${t`Configure how long refresh tokens and their id_tokens are valid for.`}</p>
                         <p class="pf-c-form__helper-text">${t`(Format: hours=-1;minutes=-2;seconds=-3).`}</p>
                     </ak-form-element-horizontal>
@@ -150,10 +147,10 @@ export class OAuth2ProviderFormPage extends Form<OAuth2Provider> {
                         ?required=${true}
                         name="jwtAlg">
                         <select class="pf-c-form-control">
-                            <option value=${OAuth2ProviderJwtAlgEnum.Rs256} ?selected=${this.provider?.jwtAlg === OAuth2ProviderJwtAlgEnum.Rs256}>
+                            <option value=${OAuth2ProviderJwtAlgEnum.Rs256} ?selected=${this.instance?.jwtAlg === OAuth2ProviderJwtAlgEnum.Rs256}>
                                 ${t`RS256 (Asymmetric Encryption)`}
                             </option>
-                            <option value=${OAuth2ProviderJwtAlgEnum.Hs256} ?selected=${this.provider?.jwtAlg === OAuth2ProviderJwtAlgEnum.Hs256}>
+                            <option value=${OAuth2ProviderJwtAlgEnum.Hs256} ?selected=${this.instance?.jwtAlg === OAuth2ProviderJwtAlgEnum.Hs256}>
                                 ${t`HS256 (Symmetric Encryption)`}
                             </option>
                         </select>
@@ -168,10 +165,10 @@ export class OAuth2ProviderFormPage extends Form<OAuth2Provider> {
                             }).then(scopes => {
                                 return scopes.results.map(scope => {
                                     let selected = false;
-                                    if (!this.provider?.propertyMappings) {
+                                    if (!this.instance?.propertyMappings) {
                                         selected = scope.managed?.startsWith("goauthentik.io/providers/oauth2/scope-") || false;
                                     } else {
-                                        selected = Array.from(this.provider?.propertyMappings).some(su => {
+                                        selected = Array.from(this.instance?.propertyMappings).some(su => {
                                             return su == scope.pk;
                                         });
                                     }
@@ -186,13 +183,13 @@ export class OAuth2ProviderFormPage extends Form<OAuth2Provider> {
                         label=${t`RSA Key`}
                         name="rsaKey">
                         <select class="pf-c-form-control">
-                            <option value="" ?selected=${this.provider?.rsaKey === undefined}>---------</option>
+                            <option value="" ?selected=${this.instance?.rsaKey === undefined}>---------</option>
                             ${until(new CryptoApi(DEFAULT_CONFIG).cryptoCertificatekeypairsList({
                                 ordering: "pk",
                                 hasKey: "true",
                             }).then(keys => {
                                 return keys.results.map(key => {
-                                    let selected = this.provider?.rsaKey === key.pk;
+                                    let selected = this.instance?.rsaKey === key.pk;
                                     if (keys.results.length === 1) {
                                         selected = true;
                                     }
@@ -207,16 +204,16 @@ export class OAuth2ProviderFormPage extends Form<OAuth2Provider> {
                         ?required=${true}
                         name="subMode">
                         <select class="pf-c-form-control">
-                            <option value="${OAuth2ProviderSubModeEnum.HashedUserId}" ?selected=${this.provider?.subMode === OAuth2ProviderSubModeEnum.HashedUserId}>
+                            <option value="${OAuth2ProviderSubModeEnum.HashedUserId}" ?selected=${this.instance?.subMode === OAuth2ProviderSubModeEnum.HashedUserId}>
                                 ${t`Based on the Hashed User ID`}
                             </option>
-                            <option value="${OAuth2ProviderSubModeEnum.UserUsername}" ?selected=${this.provider?.subMode === OAuth2ProviderSubModeEnum.UserUsername}>
+                            <option value="${OAuth2ProviderSubModeEnum.UserUsername}" ?selected=${this.instance?.subMode === OAuth2ProviderSubModeEnum.UserUsername}>
                                 ${t`Based on the username`}
                             </option>
-                            <option value="${OAuth2ProviderSubModeEnum.UserEmail}" ?selected=${this.provider?.subMode === OAuth2ProviderSubModeEnum.UserEmail}>
+                            <option value="${OAuth2ProviderSubModeEnum.UserEmail}" ?selected=${this.instance?.subMode === OAuth2ProviderSubModeEnum.UserEmail}>
                                 ${t`Based on the User's Email. This is recommended over the UPN method.`}
                             </option>
-                            <option value="${OAuth2ProviderSubModeEnum.UserUpn}" ?selected=${this.provider?.subMode === OAuth2ProviderSubModeEnum.UserUpn}>
+                            <option value="${OAuth2ProviderSubModeEnum.UserUpn}" ?selected=${this.instance?.subMode === OAuth2ProviderSubModeEnum.UserUpn}>
                                 ${t`Based on the User's UPN, only works if user has a 'upn' attribute set. Use this method only if you have different UPN and Mail domains.`}
                             </option>
                         </select>
@@ -226,7 +223,7 @@ export class OAuth2ProviderFormPage extends Form<OAuth2Provider> {
                     </ak-form-element-horizontal>
                     <ak-form-element-horizontal name="includeClaimsInIdToken">
                         <div class="pf-c-check">
-                            <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.provider?.includeClaimsInIdToken, true)}>
+                            <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.instance?.includeClaimsInIdToken, true)}>
                             <label class="pf-c-check__label">
                                 ${t`Include claims in id_token`}
                             </label>
@@ -238,10 +235,10 @@ export class OAuth2ProviderFormPage extends Form<OAuth2Provider> {
                         ?required=${true}
                         name="issuerMode">
                         <select class="pf-c-form-control">
-                            <option value="${OAuth2ProviderIssuerModeEnum.PerProvider}" ?selected=${this.provider?.issuerMode === OAuth2ProviderIssuerModeEnum.PerProvider}>
+                            <option value="${OAuth2ProviderIssuerModeEnum.PerProvider}" ?selected=${this.instance?.issuerMode === OAuth2ProviderIssuerModeEnum.PerProvider}>
                                 ${t`Each provider has a different issuer, based on the application slug.`}
                             </option>
-                            <option value="${OAuth2ProviderIssuerModeEnum.Global}" ?selected=${this.provider?.issuerMode === OAuth2ProviderIssuerModeEnum.Global}>
+                            <option value="${OAuth2ProviderIssuerModeEnum.Global}" ?selected=${this.instance?.issuerMode === OAuth2ProviderIssuerModeEnum.Global}>
                                 ${t`Same identifier is used for all providers`}
                             </option>
                         </select>
diff --git a/web/src/pages/providers/oauth2/OAuth2ProviderViewPage.ts b/web/src/pages/providers/oauth2/OAuth2ProviderViewPage.ts
index 9779129df..8fdb63ba5 100644
--- a/web/src/pages/providers/oauth2/OAuth2ProviderViewPage.ts
+++ b/web/src/pages/providers/oauth2/OAuth2ProviderViewPage.ts
@@ -127,7 +127,7 @@ export class OAuth2ProviderViewPage extends LitElement {
                                         </span>
                                         <ak-provider-oauth2-form
                                             slot="form"
-                                            .providerUUID=${this.provider.pk || 0}>
+                                            .instancePk=${this.provider.pk || 0}>
                                         </ak-provider-oauth2-form>
                                         <button slot="trigger" class="pf-c-button pf-m-primary">
                                             ${t`Edit`}
diff --git a/web/src/pages/providers/proxy/ProxyProviderForm.ts b/web/src/pages/providers/proxy/ProxyProviderForm.ts
index 25622a5a5..80af18752 100644
--- a/web/src/pages/providers/proxy/ProxyProviderForm.ts
+++ b/web/src/pages/providers/proxy/ProxyProviderForm.ts
@@ -3,7 +3,7 @@ import { t } from "@lingui/macro";
 import { customElement, property } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../../api/Config";
-import { Form } from "../../../elements/forms/Form";
+import { ModelForm } from "../../../elements/forms/ModelForm";
 import { until } from "lit-html/directives/until";
 import { ifDefined } from "lit-html/directives/if-defined";
 import "../../../elements/forms/HorizontalFormElement";
@@ -11,21 +11,18 @@ import "../../../elements/forms/FormGroup";
 import { first } from "../../../utils";
 
 @customElement("ak-provider-proxy-form")
-export class ProxyProviderFormPage extends Form<ProxyProvider> {
+export class ProxyProviderFormPage extends ModelForm<ProxyProvider, number> {
 
-    set providerUUID(value: number) {
-        new ProvidersApi(DEFAULT_CONFIG).providersProxyRead({
-            id: value,
+    loadInstance(pk: number): Promise<ProxyProvider> {
+        return new ProvidersApi(DEFAULT_CONFIG).providersProxyRead({
+            id: pk,
         }).then(provider => {
-            this.provider = provider;
             this.showHttpBasic = first(provider.basicAuthEnabled, true);
             this.showInternalServer = first(!provider.forwardAuthMode, true);
+            return provider;
         });
     }
 
-    @property({attribute: false})
-    provider?: ProxyProvider;
-
     @property({type: Boolean})
     showHttpBasic = true;
 
@@ -33,7 +30,7 @@ export class ProxyProviderFormPage extends Form<ProxyProvider> {
     showInternalServer = true;
 
     getSuccessMessage(): string {
-        if (this.provider) {
+        if (this.instance) {
             return t`Successfully updated provider.`;
         } else {
             return t`Successfully created provider.`;
@@ -41,9 +38,9 @@ export class ProxyProviderFormPage extends Form<ProxyProvider> {
     }
 
     send = (data: ProxyProvider): Promise<ProxyProvider> => {
-        if (this.provider) {
+        if (this.instance) {
             return new ProvidersApi(DEFAULT_CONFIG).providersProxyUpdate({
-                id: this.provider.pk || 0,
+                id: this.instance.pk || 0,
                 data: data
             });
         } else {
@@ -60,13 +57,13 @@ export class ProxyProviderFormPage extends Form<ProxyProvider> {
         return html`<ak-form-element-horizontal
                 label=${t`HTTP-Basic Username Key`}
                 name="basicAuthUserAttribute">
-                <input type="text" value="${ifDefined(this.provider?.basicAuthUserAttribute)}" class="pf-c-form-control">
+                <input type="text" value="${ifDefined(this.instance?.basicAuthUserAttribute)}" class="pf-c-form-control">
                 <p class="pf-c-form__helper-text">${t`User/Group Attribute used for the user part of the HTTP-Basic Header. If not set, the user's Email address is used.`}</p>
             </ak-form-element-horizontal>
             <ak-form-element-horizontal
                 label=${t`HTTP-Basic Password Key`}
                 name="basicAuthPasswordAttribute">
-                <input type="text" value="${ifDefined(this.provider?.basicAuthPasswordAttribute)}" class="pf-c-form-control">
+                <input type="text" value="${ifDefined(this.instance?.basicAuthPasswordAttribute)}" class="pf-c-form-control">
                 <p class="pf-c-form__helper-text">${t`User/Group Attribute used for the password part of the HTTP-Basic Header.`}</p>
             </ak-form-element-horizontal>`;
     }
@@ -79,12 +76,12 @@ export class ProxyProviderFormPage extends Form<ProxyProvider> {
                     label=${t`Internal host`}
                     ?required=${true}
                     name="internalHost">
-                    <input type="text" value="${ifDefined(this.provider?.internalHost)}" class="pf-c-form-control" required>
+                    <input type="text" value="${ifDefined(this.instance?.internalHost)}" class="pf-c-form-control" required>
                     <p class="pf-c-form__helper-text">${t`Upstream host that the requests are forwarded to.`}</p>
                 </ak-form-element-horizontal>
                 <ak-form-element-horizontal name="internalHostSslValidation">
                     <div class="pf-c-check">
-                        <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.provider?.internalHostSslValidation, true)}>
+                        <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.instance?.internalHostSslValidation, true)}>
                         <label class="pf-c-check__label">
                             ${t`Internal host SSL Validation`}
                         </label>
@@ -99,7 +96,7 @@ export class ProxyProviderFormPage extends Form<ProxyProvider> {
                 label=${t`Name`}
                 ?required=${true}
                 name="name">
-                <input type="text" value="${ifDefined(this.provider?.name)}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.name)}" class="pf-c-form-control" required>
             </ak-form-element-horizontal>
             <ak-form-element-horizontal
                 label=${t`Authorization flow`}
@@ -111,7 +108,7 @@ export class ProxyProviderFormPage extends Form<ProxyProvider> {
                         designation: FlowDesignationEnum.Authorization,
                     }).then(flows => {
                         return flows.results.map(flow => {
-                            return html`<option value=${ifDefined(flow.pk)} ?selected=${this.provider?.authorizationFlow === flow.pk}>${flow.name} (${flow.slug})</option>`;
+                            return html`<option value=${ifDefined(flow.pk)} ?selected=${this.instance?.authorizationFlow === flow.pk}>${flow.name} (${flow.slug})</option>`;
                         });
                     }), html`<option>${t`Loading...`}</option>`)}
                 </select>
@@ -127,12 +124,12 @@ export class ProxyProviderFormPage extends Form<ProxyProvider> {
                         label=${t`External host`}
                         ?required=${true}
                         name="externalHost">
-                        <input type="text" value="${ifDefined(this.provider?.externalHost)}" class="pf-c-form-control" required>
+                        <input type="text" value="${ifDefined(this.instance?.externalHost)}" class="pf-c-form-control" required>
                         <p class="pf-c-form__helper-text">${t`The external URL you'll access the outpost at.`}</p>
                     </ak-form-element-horizontal>
                     <ak-form-element-horizontal name="forwardAuthMode">
                         <div class="pf-c-check">
-                            <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.provider?.forwardAuthMode, false)} @change=${(ev: Event) => {
+                            <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.instance?.forwardAuthMode, false)} @change=${(ev: Event) => {
                                 const el = ev.target as HTMLInputElement;
                                 this.showInternalServer = !el.checked;
                             }}>
@@ -162,7 +159,7 @@ export class ProxyProviderFormPage extends Form<ProxyProvider> {
                                 hasKey: "true",
                             }).then(keys => {
                                 return keys.results.map(key => {
-                                    return html`<option value=${ifDefined(key.pk)} ?selected=${this.provider?.certificate === key.pk}>${key.name}</option>`;
+                                    return html`<option value=${ifDefined(key.pk)} ?selected=${this.instance?.certificate === key.pk}>${key.name}</option>`;
                                 });
                             }), html`<option>${t`Loading...`}</option>`)}
                         </select>
@@ -171,13 +168,13 @@ export class ProxyProviderFormPage extends Form<ProxyProvider> {
                     <ak-form-element-horizontal
                         label=${t`Skip path regex`}
                         name="skipPathRegex">
-                        <textarea class="pf-c-form-control">${this.provider?.skipPathRegex}</textarea>
+                        <textarea class="pf-c-form-control">${this.instance?.skipPathRegex}</textarea>
                         <p class="pf-c-form__helper-text">${t`Regular expressions for which authentication is not required. Each new line is interpreted as a new Regular Expression.`}</p>
                     </ak-form-element-horizontal>
 
                     <ak-form-element-horizontal name="basicAuthEnabled">
                         <div class="pf-c-check">
-                            <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.provider?.basicAuthEnabled, false)} @change=${(ev: Event) => {
+                            <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.instance?.basicAuthEnabled, false)} @change=${(ev: Event) => {
                                 const el = ev.target as HTMLInputElement;
                                 this.showHttpBasic = el.checked;
                             }}>
diff --git a/web/src/pages/providers/proxy/ProxyProviderViewPage.ts b/web/src/pages/providers/proxy/ProxyProviderViewPage.ts
index 05cafd475..16305ab74 100644
--- a/web/src/pages/providers/proxy/ProxyProviderViewPage.ts
+++ b/web/src/pages/providers/proxy/ProxyProviderViewPage.ts
@@ -127,7 +127,7 @@ export class ProxyProviderViewPage extends LitElement {
                                         </span>
                                         <ak-provider-proxy-form
                                             slot="form"
-                                            .providerUUID=${this.provider.pk || 0}>
+                                            .instancePk=${this.provider.pk || 0}>
                                         </ak-provider-proxy-form>
                                         <button slot="trigger" class="pf-c-button pf-m-primary">
                                             ${t`Edit`}
diff --git a/web/src/pages/providers/saml/SAMLProviderForm.ts b/web/src/pages/providers/saml/SAMLProviderForm.ts
index 8fc643dff..e059a4071 100644
--- a/web/src/pages/providers/saml/SAMLProviderForm.ts
+++ b/web/src/pages/providers/saml/SAMLProviderForm.ts
@@ -3,28 +3,24 @@ import { t } from "@lingui/macro";
 import { customElement, property } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../../api/Config";
-import { Form } from "../../../elements/forms/Form";
+import { ModelForm } from "../../../elements/forms/ModelForm";
 import { until } from "lit-html/directives/until";
 import { ifDefined } from "lit-html/directives/if-defined";
 import "../../../elements/forms/HorizontalFormElement";
 import "../../../elements/forms/FormGroup";
 
 @customElement("ak-provider-saml-form")
-export class SAMLProviderFormPage extends Form<SAMLProvider> {
+export class SAMLProviderFormPage extends ModelForm<SAMLProvider, number> {
 
-    set providerUUID(value: number) {
-        new ProvidersApi(DEFAULT_CONFIG).providersSamlRead({
-            id: value,
-        }).then(provider => {
-            this.provider = provider;
+    loadInstance(pk: number): Promise<SAMLProvider> {
+        console.log("reading saml provider")
+        return new ProvidersApi(DEFAULT_CONFIG).providersSamlRead({
+            id: pk,
         });
     }
 
-    @property({attribute: false})
-    provider?: SAMLProvider;
-
     getSuccessMessage(): string {
-        if (this.provider) {
+        if (this.instance) {
             return t`Successfully updated provider.`;
         } else {
             return t`Successfully created provider.`;
@@ -32,9 +28,9 @@ export class SAMLProviderFormPage extends Form<SAMLProvider> {
     }
 
     send = (data: SAMLProvider): Promise<SAMLProvider> => {
-        if (this.provider) {
+        if (this.instance) {
             return new ProvidersApi(DEFAULT_CONFIG).providersSamlUpdate({
-                id: this.provider.pk || 0,
+                id: this.instance.pk || 0,
                 data: data
             });
         } else {
@@ -50,7 +46,7 @@ export class SAMLProviderFormPage extends Form<SAMLProvider> {
                 label=${t`Name`}
                 ?required=${true}
                 name="name">
-                <input type="text" value="${ifDefined(this.provider?.name)}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.name)}" class="pf-c-form-control" required>
             </ak-form-element-horizontal>
             <ak-form-element-horizontal
                 label=${t`Authorization flow`}
@@ -62,7 +58,7 @@ export class SAMLProviderFormPage extends Form<SAMLProvider> {
                         designation: FlowDesignationEnum.Authorization,
                     }).then(flows => {
                         return flows.results.map(flow => {
-                            return html`<option value=${ifDefined(flow.pk)} ?selected=${this.provider?.authorizationFlow === flow.pk}>${flow.name} (${flow.slug})</option>`;
+                            return html`<option value=${ifDefined(flow.pk)} ?selected=${this.instance?.authorizationFlow === flow.pk}>${flow.name} (${flow.slug})</option>`;
                         });
                     }), html`<option>${t`Loading...`}</option>`)}
                 </select>
@@ -78,23 +74,23 @@ export class SAMLProviderFormPage extends Form<SAMLProvider> {
                         label=${t`ACS URL`}
                         ?required=${true}
                         name="acsUrl">
-                        <input type="text" value="${ifDefined(this.provider?.acsUrl)}" class="pf-c-form-control" required>
+                        <input type="text" value="${ifDefined(this.instance?.acsUrl)}" class="pf-c-form-control" required>
                     </ak-form-element-horizontal>
                     <ak-form-element-horizontal
                         label=${t`Issuer`}
                         ?required=${true}
                         name="issuer">
-                        <input type="text" value="${this.provider?.issuer || "authentik"}" class="pf-c-form-control" required>
+                        <input type="text" value="${this.instance?.issuer || "authentik"}" class="pf-c-form-control" required>
                     </ak-form-element-horizontal>
                     <ak-form-element-horizontal
                         label=${t`Service Provider Binding`}
                         ?required=${true}
                         name="spBinding">
                         <select class="pf-c-form-control">
-                            <option value=${SAMLProviderSpBindingEnum.Redirect} ?selected=${this.provider?.spBinding === SAMLProviderSpBindingEnum.Redirect}>
+                            <option value=${SAMLProviderSpBindingEnum.Redirect} ?selected=${this.instance?.spBinding === SAMLProviderSpBindingEnum.Redirect}>
                                 ${t`Redirect`}
                             </option>
-                            <option value=${SAMLProviderSpBindingEnum.Post} ?selected=${this.provider?.spBinding === SAMLProviderSpBindingEnum.Post}>
+                            <option value=${SAMLProviderSpBindingEnum.Post} ?selected=${this.instance?.spBinding === SAMLProviderSpBindingEnum.Post}>
                                 ${t`Post`}
                             </option>
                         </select>
@@ -103,7 +99,7 @@ export class SAMLProviderFormPage extends Form<SAMLProvider> {
                     <ak-form-element-horizontal
                         label=${t`Audience`}
                         name="audience">
-                        <input type="text" value="${ifDefined(this.provider?.audience)}" class="pf-c-form-control">
+                        <input type="text" value="${ifDefined(this.instance?.audience)}" class="pf-c-form-control">
                     </ak-form-element-horizontal>
                 </div>
             </ak-form-group>
@@ -117,13 +113,13 @@ export class SAMLProviderFormPage extends Form<SAMLProvider> {
                         label=${t`Signing Certificate`}
                         name="signingKp">
                         <select class="pf-c-form-control">
-                            <option value="" ?selected=${this.provider?.signingKp === undefined}>---------</option>
+                            <option value="" ?selected=${this.instance?.signingKp === undefined}>---------</option>
                             ${until(new CryptoApi(DEFAULT_CONFIG).cryptoCertificatekeypairsList({
                                 ordering: "pk",
                                 hasKey: "true",
                             }).then(keys => {
                                 return keys.results.map(key => {
-                                    return html`<option value=${ifDefined(key.pk)} ?selected=${this.provider?.signingKp === key.pk}>${key.name}</option>`;
+                                    return html`<option value=${ifDefined(key.pk)} ?selected=${this.instance?.signingKp === key.pk}>${key.name}</option>`;
                                 });
                             }), html`<option>${t`Loading...`}</option>`)}
                         </select>
@@ -133,12 +129,12 @@ export class SAMLProviderFormPage extends Form<SAMLProvider> {
                         label=${t`Verification Certificate`}
                         name="verificationKp">
                         <select class="pf-c-form-control">
-                            <option value="" ?selected=${this.provider?.verificationKp === undefined}>---------</option>
+                            <option value="" ?selected=${this.instance?.verificationKp === undefined}>---------</option>
                             ${until(new CryptoApi(DEFAULT_CONFIG).cryptoCertificatekeypairsList({
                                 ordering: "pk",
                             }).then(keys => {
                                 return keys.results.map(key => {
-                                    return html`<option value=${ifDefined(key.pk)} ?selected=${this.provider?.verificationKp === key.pk}>${key.name}</option>`;
+                                    return html`<option value=${ifDefined(key.pk)} ?selected=${this.instance?.verificationKp === key.pk}>${key.name}</option>`;
                                 });
                             }), html`<option>${t`Loading...`}</option>`)}
                         </select>
@@ -155,10 +151,10 @@ export class SAMLProviderFormPage extends Form<SAMLProvider> {
                             }).then(mappings => {
                                 return mappings.results.map(mapping => {
                                     let selected = false;
-                                    if (!this.provider?.propertyMappings) {
+                                    if (!this.instance?.propertyMappings) {
                                         selected = mapping.managed?.startsWith("goauthentik.io/providers/saml") || false;
                                     } else {
-                                        selected = Array.from(this.provider?.propertyMappings).some(su => {
+                                        selected = Array.from(this.instance?.propertyMappings).some(su => {
                                             return su == mapping.pk;
                                         });
                                     }
@@ -172,12 +168,12 @@ export class SAMLProviderFormPage extends Form<SAMLProvider> {
                         label=${t`NameID Property Mapping`}
                         name="nameIdMapping">
                         <select class="pf-c-form-control">
-                            <option value="" ?selected=${this.provider?.nameIdMapping === undefined}>---------</option>
+                            <option value="" ?selected=${this.instance?.nameIdMapping === undefined}>---------</option>
                             ${until(new PropertymappingsApi(DEFAULT_CONFIG).propertymappingsSamlList({
                                 ordering: "saml_name"
                             }).then(mappings => {
                                 return mappings.results.map(mapping => {
-                                    return html`<option value=${ifDefined(mapping.pk)} ?selected=${this.provider?.nameIdMapping === mapping.pk}>${mapping.name}</option>`;
+                                    return html`<option value=${ifDefined(mapping.pk)} ?selected=${this.instance?.nameIdMapping === mapping.pk}>${mapping.name}</option>`;
                                 });
                             }), html`<option>${t`Loading...`}</option>`)}
                         </select>
@@ -188,7 +184,7 @@ export class SAMLProviderFormPage extends Form<SAMLProvider> {
                         label=${t`Assertion valid not before`}
                         ?required=${true}
                         name="assertionValidNotBefore">
-                        <input type="text" value="${this.provider?.assertionValidNotBefore || "minutes=-5"}" class="pf-c-form-control" required>
+                        <input type="text" value="${this.instance?.assertionValidNotBefore || "minutes=-5"}" class="pf-c-form-control" required>
                         <p class="pf-c-form__helper-text">${t`Configure the maximum allowed time drift for an asseration.`}</p>
                         <p class="pf-c-form__helper-text">${t`(Format: hours=-1;minutes=-2;seconds=-3).`}</p>
                     </ak-form-element-horizontal>
@@ -196,14 +192,14 @@ export class SAMLProviderFormPage extends Form<SAMLProvider> {
                         label=${t`Assertion valid not on or after`}
                         ?required=${true}
                         name="assertionValidNotOnOrAfter">
-                        <input type="text" value="${this.provider?.assertionValidNotOnOrAfter || "minutes=5"}" class="pf-c-form-control" required>
+                        <input type="text" value="${this.instance?.assertionValidNotOnOrAfter || "minutes=5"}" class="pf-c-form-control" required>
                         <p class="pf-c-form__helper-text">${t`Assertion not valid on or after current time + this value (Format: hours=1;minutes=2;seconds=3).`}</p>
                     </ak-form-element-horizontal>
                     <ak-form-element-horizontal
                         label=${t`Session valid not on or after`}
                         ?required=${true}
                         name="sessionValidNotOnOrAfter">
-                        <input type="text" value="${this.provider?.sessionValidNotOnOrAfter || "minutes=86400"}" class="pf-c-form-control" required>
+                        <input type="text" value="${this.instance?.sessionValidNotOnOrAfter || "minutes=86400"}" class="pf-c-form-control" required>
                         <p class="pf-c-form__helper-text">${t`Session not valid on or after current time + this value (Format: hours=1;minutes=2;seconds=3).`}</p>
                     </ak-form-element-horizontal>
 
@@ -212,16 +208,16 @@ export class SAMLProviderFormPage extends Form<SAMLProvider> {
                         ?required=${true}
                         name="digestAlgorithm">
                         <select class="pf-c-form-control">
-                            <option value=${SAMLProviderDigestAlgorithmEnum._200009Xmldsigsha1} ?selected=${this.provider?.digestAlgorithm === SAMLProviderDigestAlgorithmEnum._200009Xmldsigsha1}>
+                            <option value=${SAMLProviderDigestAlgorithmEnum._200009Xmldsigsha1} ?selected=${this.instance?.digestAlgorithm === SAMLProviderDigestAlgorithmEnum._200009Xmldsigsha1}>
                                 ${t`SHA1`}
                             </option>
-                            <option value=${SAMLProviderDigestAlgorithmEnum._200104Xmlencsha256} ?selected=${this.provider?.digestAlgorithm === SAMLProviderDigestAlgorithmEnum._200104Xmlencsha256 || this.provider?.digestAlgorithm === undefined}>
+                            <option value=${SAMLProviderDigestAlgorithmEnum._200104Xmlencsha256} ?selected=${this.instance?.digestAlgorithm === SAMLProviderDigestAlgorithmEnum._200104Xmlencsha256 || this.instance?.digestAlgorithm === undefined}>
                                 ${t`SHA256`}
                             </option>
-                            <option value=${SAMLProviderDigestAlgorithmEnum._200104XmldsigMoresha384} ?selected=${this.provider?.digestAlgorithm === SAMLProviderDigestAlgorithmEnum._200104XmldsigMoresha384}>
+                            <option value=${SAMLProviderDigestAlgorithmEnum._200104XmldsigMoresha384} ?selected=${this.instance?.digestAlgorithm === SAMLProviderDigestAlgorithmEnum._200104XmldsigMoresha384}>
                                 ${t`SHA384`}
                             </option>
-                            <option value=${SAMLProviderDigestAlgorithmEnum._200104Xmlencsha512} ?selected=${this.provider?.digestAlgorithm === SAMLProviderDigestAlgorithmEnum._200104Xmlencsha512}>
+                            <option value=${SAMLProviderDigestAlgorithmEnum._200104Xmlencsha512} ?selected=${this.instance?.digestAlgorithm === SAMLProviderDigestAlgorithmEnum._200104Xmlencsha512}>
                                 ${t`SHA512`}
                             </option>
                         </select>
@@ -231,19 +227,19 @@ export class SAMLProviderFormPage extends Form<SAMLProvider> {
                         ?required=${true}
                         name="signatureAlgorithm">
                         <select class="pf-c-form-control">
-                            <option value=${SAMLProviderSignatureAlgorithmEnum._200009XmldsigrsaSha1} ?selected=${this.provider?.signatureAlgorithm === SAMLProviderSignatureAlgorithmEnum._200009XmldsigrsaSha1}>
+                            <option value=${SAMLProviderSignatureAlgorithmEnum._200009XmldsigrsaSha1} ?selected=${this.instance?.signatureAlgorithm === SAMLProviderSignatureAlgorithmEnum._200009XmldsigrsaSha1}>
                                 ${t`RSA-SHA1`}
                             </option>
-                            <option value=${SAMLProviderSignatureAlgorithmEnum._200104XmldsigMorersaSha256} ?selected=${this.provider?.signatureAlgorithm === SAMLProviderSignatureAlgorithmEnum._200104XmldsigMorersaSha256 || this.provider?.signatureAlgorithm === undefined}>
+                            <option value=${SAMLProviderSignatureAlgorithmEnum._200104XmldsigMorersaSha256} ?selected=${this.instance?.signatureAlgorithm === SAMLProviderSignatureAlgorithmEnum._200104XmldsigMorersaSha256 || this.instance?.signatureAlgorithm === undefined}>
                                 ${t`RSA-SHA256`}
                             </option>
-                            <option value=${SAMLProviderSignatureAlgorithmEnum._200104XmldsigMorersaSha384} ?selected=${this.provider?.signatureAlgorithm === SAMLProviderSignatureAlgorithmEnum._200104XmldsigMorersaSha384}>
+                            <option value=${SAMLProviderSignatureAlgorithmEnum._200104XmldsigMorersaSha384} ?selected=${this.instance?.signatureAlgorithm === SAMLProviderSignatureAlgorithmEnum._200104XmldsigMorersaSha384}>
                                 ${t`RSA-SHA384`}
                             </option>
-                            <option value=${SAMLProviderSignatureAlgorithmEnum._200104XmldsigMorersaSha512} ?selected=${this.provider?.signatureAlgorithm === SAMLProviderSignatureAlgorithmEnum._200104XmldsigMorersaSha512}>
+                            <option value=${SAMLProviderSignatureAlgorithmEnum._200104XmldsigMorersaSha512} ?selected=${this.instance?.signatureAlgorithm === SAMLProviderSignatureAlgorithmEnum._200104XmldsigMorersaSha512}>
                                 ${t`RSA-SHA512`}
                             </option>
-                            <option value=${SAMLProviderSignatureAlgorithmEnum._200009XmldsigdsaSha1} ?selected=${this.provider?.signatureAlgorithm === SAMLProviderSignatureAlgorithmEnum._200009XmldsigdsaSha1}>
+                            <option value=${SAMLProviderSignatureAlgorithmEnum._200009XmldsigdsaSha1} ?selected=${this.instance?.signatureAlgorithm === SAMLProviderSignatureAlgorithmEnum._200009XmldsigdsaSha1}>
                                 ${t`DSA-SHA1`}
                             </option>
                         </select>
diff --git a/web/src/pages/providers/saml/SAMLProviderViewPage.ts b/web/src/pages/providers/saml/SAMLProviderViewPage.ts
index 62f5ed8bc..1ddc270d4 100644
--- a/web/src/pages/providers/saml/SAMLProviderViewPage.ts
+++ b/web/src/pages/providers/saml/SAMLProviderViewPage.ts
@@ -120,7 +120,7 @@ export class SAMLProviderViewPage extends LitElement {
                                         </span>
                                         <ak-provider-saml-form
                                             slot="form"
-                                            .providerUUID=${this.provider.pk || 0}>
+                                            .instancePk=${this.provider.pk || 0}>
                                         </ak-provider-saml-form>
                                         <button slot="trigger" class="pf-c-button pf-m-primary">
                                             ${t`Edit`}
diff --git a/web/src/pages/sources/SourcesListPage.ts b/web/src/pages/sources/SourcesListPage.ts
index e00d7443d..a2c4d6121 100644
--- a/web/src/pages/sources/SourcesListPage.ts
+++ b/web/src/pages/sources/SourcesListPage.ts
@@ -75,7 +75,7 @@ export class SourceListPage extends TablePage<Source> {
                 <ak-proxy-form
                     slot="form"
                     .args=${{
-                        "sourceSlug": item.slug
+                        "instancePk": item.slug
                     }}
                     type=${ifDefined(item.component)}>
                 </ak-proxy-form>
diff --git a/web/src/pages/sources/ldap/LDAPSourceForm.ts b/web/src/pages/sources/ldap/LDAPSourceForm.ts
index 844a74d98..8d1da3d3a 100644
--- a/web/src/pages/sources/ldap/LDAPSourceForm.ts
+++ b/web/src/pages/sources/ldap/LDAPSourceForm.ts
@@ -1,31 +1,26 @@
 import { LDAPSource, SourcesApi, PropertymappingsApi } from "authentik-api";
 import { t } from "@lingui/macro";
-import { customElement, property } from "lit-element";
+import { customElement } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../../api/Config";
-import { Form } from "../../../elements/forms/Form";
 import "../../../elements/forms/FormGroup";
 import "../../../elements/forms/HorizontalFormElement";
 import { ifDefined } from "lit-html/directives/if-defined";
 import { until } from "lit-html/directives/until";
 import { first } from "../../../utils";
+import { ModelForm } from "../../../elements/forms/ModelForm";
 
 @customElement("ak-source-ldap-form")
-export class LDAPSourceForm extends Form<LDAPSource> {
+export class LDAPSourceForm extends ModelForm<LDAPSource, string> {
 
-    set sourceSlug(value: string) {
-        new SourcesApi(DEFAULT_CONFIG).sourcesLdapRead({
-            slug: value,
-        }).then(source => {
-            this.source = source;
+    loadInstance(pk: string): Promise<LDAPSource> {
+        return new SourcesApi(DEFAULT_CONFIG).sourcesLdapRead({
+            slug: pk,
         });
     }
 
-    @property({attribute: false})
-    source?: LDAPSource;
-
     getSuccessMessage(): string {
-        if (this.source) {
+        if (this.instance) {
             return t`Successfully updated source.`;
         } else {
             return t`Successfully created source.`;
@@ -33,9 +28,9 @@ export class LDAPSourceForm extends Form<LDAPSource> {
     }
 
     send = (data: LDAPSource): Promise<LDAPSource> => {
-        if (this.source) {
+        if (this.instance) {
             return new SourcesApi(DEFAULT_CONFIG).sourcesLdapPartialUpdate({
-                slug: this.source.slug,
+                slug: this.instance.slug,
                 data: data
             });
         } else {
@@ -51,17 +46,17 @@ export class LDAPSourceForm extends Form<LDAPSource> {
                 label=${t`Name`}
                 ?required=${true}
                 name="name">
-                <input type="text" value="${ifDefined(this.source?.name)}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.name)}" class="pf-c-form-control" required>
             </ak-form-element-horizontal>
             <ak-form-element-horizontal
                 label=${t`Slug`}
                 ?required=${true}
                 name="slug">
-                <input type="text" value="${ifDefined(this.source?.slug)}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.slug)}" class="pf-c-form-control" required>
             </ak-form-element-horizontal>
             <ak-form-element-horizontal name="enabled">
                 <div class="pf-c-check">
-                    <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.source?.enabled, true)}>
+                    <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.instance?.enabled, true)}>
                     <label class="pf-c-check__label">
                         ${t`Enabled`}
                     </label>
@@ -69,7 +64,7 @@ export class LDAPSourceForm extends Form<LDAPSource> {
             </ak-form-element-horizontal>
             <ak-form-element-horizontal name="syncUsers">
                 <div class="pf-c-check">
-                    <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.source?.syncUsers, true)}>
+                    <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.instance?.syncUsers, true)}>
                     <label class="pf-c-check__label">
                         ${t`Sync users`}
                     </label>
@@ -77,7 +72,7 @@ export class LDAPSourceForm extends Form<LDAPSource> {
             </ak-form-element-horizontal>
             <ak-form-element-horizontal name="syncUsersPassword">
                 <div class="pf-c-check">
-                    <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.source?.syncUsersPassword, true)}>
+                    <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.instance?.syncUsersPassword, true)}>
                     <label class="pf-c-check__label">
                         ${t`User password writeback`}
                     </label>
@@ -86,7 +81,7 @@ export class LDAPSourceForm extends Form<LDAPSource> {
             </ak-form-element-horizontal>
             <ak-form-element-horizontal name="syncGroups">
                 <div class="pf-c-check">
-                    <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.source?.syncGroups, true)}>
+                    <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.instance?.syncGroups, true)}>
                     <label class="pf-c-check__label">
                         ${t`Sync groups`}
                     </label>
@@ -101,11 +96,11 @@ export class LDAPSourceForm extends Form<LDAPSource> {
                         label=${t`Server URI`}
                         ?required=${true}
                         name="serverUri">
-                        <input type="text" value="${ifDefined(this.source?.serverUri)}" class="pf-c-form-control" required>
+                        <input type="text" value="${ifDefined(this.instance?.serverUri)}" class="pf-c-form-control" required>
                     </ak-form-element-horizontal>
                     <ak-form-element-horizontal name="startTls">
                         <div class="pf-c-check">
-                            <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.source?.startTls, true)}>
+                            <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.instance?.startTls, true)}>
                             <label class="pf-c-check__label">
                                 ${t`Enable StartTLS`}
                             </label>
@@ -115,20 +110,20 @@ export class LDAPSourceForm extends Form<LDAPSource> {
                         label=${t`Bind CN`}
                         ?required=${true}
                         name="bindCn">
-                        <input type="text" value="${ifDefined(this.source?.bindCn)}" class="pf-c-form-control" required>
+                        <input type="text" value="${ifDefined(this.instance?.bindCn)}" class="pf-c-form-control" required>
                     </ak-form-element-horizontal>
                     <ak-form-element-horizontal
                         label=${t`Bind Password`}
                         ?required=${true}
-                        ?writeOnly=${this.source !== undefined}
+                        ?writeOnly=${this.instance !== undefined}
                         name="bindPassword">
-                        <input type="text" value="${ifDefined(this.source?.bindPassword)}" class="pf-c-form-control" required>
+                        <input type="text" value="${ifDefined(this.instance?.bindPassword)}" class="pf-c-form-control" required>
                     </ak-form-element-horizontal>
                     <ak-form-element-horizontal
                         label=${t`Base DN`}
                         ?required=${true}
                         name="baseDn">
-                        <input type="text" value="${ifDefined(this.source?.baseDn)}" class="pf-c-form-control" required>
+                        <input type="text" value="${ifDefined(this.instance?.baseDn)}" class="pf-c-form-control" required>
                     </ak-form-element-horizontal>
                 </div>
             </ak-form-group>
@@ -147,10 +142,10 @@ export class LDAPSourceForm extends Form<LDAPSource> {
                             }).then(mappings => {
                                 return mappings.results.map(mapping => {
                                     let selected = false;
-                                    if (!this.source?.propertyMappings) {
+                                    if (!this.instance?.propertyMappings) {
                                         selected = mapping.managed?.startsWith("goauthentik.io/sources/ldap/default") || mapping.managed?.startsWith("goauthentik.io/sources/ldap/ms") || false;
                                     } else {
-                                        selected = Array.from(this.source?.propertyMappings).some(su => {
+                                        selected = Array.from(this.instance?.propertyMappings).some(su => {
                                             return su == mapping.pk;
                                         });
                                     }
@@ -171,10 +166,10 @@ export class LDAPSourceForm extends Form<LDAPSource> {
                             }).then(mappings => {
                                 return mappings.results.map(mapping => {
                                     let selected = false;
-                                    if (!this.source?.propertyMappingsGroup) {
+                                    if (!this.instance?.propertyMappingsGroup) {
                                         selected = mapping.managed === "goauthentik.io/sources/ldap/default-name";
                                     } else {
-                                        selected = Array.from(this.source?.propertyMappingsGroup).some(su => {
+                                        selected = Array.from(this.instance?.propertyMappingsGroup).some(su => {
                                             return su == mapping.pk;
                                         });
                                     }
@@ -188,41 +183,41 @@ export class LDAPSourceForm extends Form<LDAPSource> {
                     <ak-form-element-horizontal
                         label=${t`Addition User DN`}
                         name="additionalUserDn">
-                        <input type="text" value="${ifDefined(this.source?.additionalUserDn)}" class="pf-c-form-control">
+                        <input type="text" value="${ifDefined(this.instance?.additionalUserDn)}" class="pf-c-form-control">
                         <p class="pf-c-form__helper-text">${t`Additional user DN, prepended to the Base DN.`}</p>
                     </ak-form-element-horizontal>
                     <ak-form-element-horizontal
                         label=${t`Addition Group DN`}
                         name="additionalGroupDn">
-                        <input type="text" value="${ifDefined(this.source?.additionalGroupDn)}" class="pf-c-form-control">
+                        <input type="text" value="${ifDefined(this.instance?.additionalGroupDn)}" class="pf-c-form-control">
                         <p class="pf-c-form__helper-text">${t`Additional group DN, prepended to the Base DN.`}</p>
                     </ak-form-element-horizontal>
                     <ak-form-element-horizontal
                         label=${t`User object filter`}
                         ?required=${true}
                         name="userObjectFilter">
-                        <input type="text" value="${this.source?.userObjectFilter || "(objectClass=person)"}" class="pf-c-form-control" required>
+                        <input type="text" value="${this.instance?.userObjectFilter || "(objectClass=person)"}" class="pf-c-form-control" required>
                         <p class="pf-c-form__helper-text">${t`Consider Objects matching this filter to be Users.`}</p>
                     </ak-form-element-horizontal>
                     <ak-form-element-horizontal
                         label=${t`Group object filter`}
                         ?required=${true}
                         name="groupObjectFilter">
-                        <input type="text" value="${this.source?.groupObjectFilter || "(objectClass=group)"}" class="pf-c-form-control" required>
+                        <input type="text" value="${this.instance?.groupObjectFilter || "(objectClass=group)"}" class="pf-c-form-control" required>
                         <p class="pf-c-form__helper-text">${t`Consider Objects matching this filter to be Groups.`}</p>
                     </ak-form-element-horizontal>
                     <ak-form-element-horizontal
                         label=${t`Group membership field`}
                         ?required=${true}
                         name="groupMembershipField">
-                        <input type="text" value="${this.source?.groupMembershipField || "member"}" class="pf-c-form-control" required>
+                        <input type="text" value="${this.instance?.groupMembershipField || "member"}" class="pf-c-form-control" required>
                         <p class="pf-c-form__helper-text">${t`Field which contains members of a group.`}</p>
                     </ak-form-element-horizontal>
                     <ak-form-element-horizontal
                         label=${t`Object uniqueness field`}
                         ?required=${true}
                         name="objectUniquenessField">
-                        <input type="text" value="${this.source?.objectUniquenessField || "objectSid"}" class="pf-c-form-control" required>
+                        <input type="text" value="${this.instance?.objectUniquenessField || "objectSid"}" class="pf-c-form-control" required>
                         <p class="pf-c-form__helper-text">${t`Field which contains a unique Identifier.`}</p>
                     </ak-form-element-horizontal>
                 </div>
diff --git a/web/src/pages/sources/ldap/LDAPSourceViewPage.ts b/web/src/pages/sources/ldap/LDAPSourceViewPage.ts
index 97f27cefa..11db0d025 100644
--- a/web/src/pages/sources/ldap/LDAPSourceViewPage.ts
+++ b/web/src/pages/sources/ldap/LDAPSourceViewPage.ts
@@ -103,7 +103,7 @@ export class LDAPSourceViewPage extends LitElement {
                                         </span>
                                         <ak-source-ldap-form
                                             slot="form"
-                                            .sourceSlug=${this.source.slug}>
+                                            .instancePk=${this.source.slug}>
                                         </ak-source-ldap-form>
                                         <button slot="trigger" class="pf-c-button pf-m-primary">
                                             ${t`Edit`}
diff --git a/web/src/pages/sources/oauth/OAuthSourceForm.ts b/web/src/pages/sources/oauth/OAuthSourceForm.ts
index 959607af1..d72ad0632 100644
--- a/web/src/pages/sources/oauth/OAuthSourceForm.ts
+++ b/web/src/pages/sources/oauth/OAuthSourceForm.ts
@@ -3,32 +3,29 @@ import { t } from "@lingui/macro";
 import { customElement, property } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../../api/Config";
-import { Form } from "../../../elements/forms/Form";
 import "../../../elements/forms/FormGroup";
 import "../../../elements/forms/HorizontalFormElement";
 import { ifDefined } from "lit-html/directives/if-defined";
 import { until } from "lit-html/directives/until";
 import { first } from "../../../utils";
 import { AppURLManager } from "../../../api/legacy";
+import { ModelForm } from "../../../elements/forms/ModelForm";
 
 @customElement("ak-source-oauth-form")
-export class OAuthSourceForm extends Form<OAuthSource> {
+export class OAuthSourceForm extends ModelForm<OAuthSource, string> {
 
-    set sourceSlug(value: string) {
-        new SourcesApi(DEFAULT_CONFIG).sourcesOauthRead({
-            slug: value,
+    loadInstance(pk: string): Promise<OAuthSource> {
+        return new SourcesApi(DEFAULT_CONFIG).sourcesOauthRead({
+            slug: pk,
         }).then(source => {
-            this.source = source;
             this.showUrlOptions = first(source.type?.urlsCustomizable, false);
+            return source;
         });
     }
 
     @property()
     modelName?: string;
 
-    @property({attribute: false})
-    source?: OAuthSource;
-
     @property({type: Boolean})
     showUrlOptions = false;
 
@@ -36,7 +33,7 @@ export class OAuthSourceForm extends Form<OAuthSource> {
     showRequestTokenURL = false;
 
     getSuccessMessage(): string {
-        if (this.source) {
+        if (this.instance) {
             return t`Successfully updated source.`;
         } else {
             return t`Successfully created source.`;
@@ -44,9 +41,9 @@ export class OAuthSourceForm extends Form<OAuthSource> {
     }
 
     send = (data: OAuthSource): Promise<OAuthSource> => {
-        if (this.source) {
+        if (this.instance) {
             return new SourcesApi(DEFAULT_CONFIG).sourcesOauthUpdate({
-                slug: this.source.slug,
+                slug: this.instance.slug,
                 data: data
             });
         } else {
@@ -70,27 +67,27 @@ export class OAuthSourceForm extends Form<OAuthSource> {
                         label=${t`Authorization URL`}
                         ?required=${true}
                         name="authorizationUrl">
-                        <input type="text" value="${first(this.source?.authorizationUrl, "")}" class="pf-c-form-control" required>
+                        <input type="text" value="${first(this.instance?.authorizationUrl, "")}" class="pf-c-form-control" required>
                         <p class="pf-c-form__helper-text">${t`URL the user is redirect to to consent the authorization.`}</p>
                     </ak-form-element-horizontal>
                     <ak-form-element-horizontal
                         label=${t`Access token URL`}
                         ?required=${true}
                         name="accessTokenUrl">
-                        <input type="text" value="${first(this.source?.accessTokenUrl, "")}" class="pf-c-form-control" required>
+                        <input type="text" value="${first(this.instance?.accessTokenUrl, "")}" class="pf-c-form-control" required>
                         <p class="pf-c-form__helper-text">${t`URL used by authentik to retrieve tokens.`}</p>
                     </ak-form-element-horizontal>
                     <ak-form-element-horizontal
                         label=${t`Profile URL`}
                         ?required=${true}
                         name="profileUrl">
-                        <input type="text" value="${first(this.source?.profileUrl, "")}" class="pf-c-form-control" required>
+                        <input type="text" value="${first(this.instance?.profileUrl, "")}" class="pf-c-form-control" required>
                         <p class="pf-c-form__helper-text">${t`URL used by authentik to get user information.`}</p>
                     </ak-form-element-horizontal>
                     ${this.showRequestTokenURL ? html`<ak-form-element-horizontal
                         label=${t`Request token URL`}
                         name="requestTokenUrl">
-                        <input type="text" value="${first(this.source?.requestTokenUrl, "")}" class="pf-c-form-control">
+                        <input type="text" value="${first(this.instance?.requestTokenUrl, "")}" class="pf-c-form-control">
                         <p class="pf-c-form__helper-text">${t`URL used to request the initial token. This URL is only required for OAuth 1.`}</p>
                     </ak-form-element-horizontal>
                     ` : html``}
@@ -112,13 +109,13 @@ export class OAuthSourceForm extends Form<OAuthSource> {
                 label=${t`Name`}
                 ?required=${true}
                 name="name">
-                <input type="text" value="${ifDefined(this.source?.name)}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.name)}" class="pf-c-form-control" required>
             </ak-form-element-horizontal>
             <ak-form-element-horizontal
                 label=${t`Slug`}
                 ?required=${true}
                 name="slug">
-                <input type="text" value="${ifDefined(this.source?.slug)}" class="pf-c-form-control" required @input=${(ev: Event) => {
+                <input type="text" value="${ifDefined(this.instance?.slug)}" class="pf-c-form-control" required @input=${(ev: Event) => {
                     const current = (ev.target as HTMLInputElement).value;
                     const label = this.shadowRoot?.querySelector<HTMLSpanElement>("#callback-url");
                     if (!label) return;
@@ -126,12 +123,12 @@ export class OAuthSourceForm extends Form<OAuthSource> {
                 }}>
                 <p class="pf-c-form__helper-text">
                     ${t`Use this redirect URL:`}
-                    <span id="callback-url">${this.getRedirectURI(this.source?.slug)}</span>
+                    <span id="callback-url">${this.getRedirectURI(this.instance?.slug)}</span>
                 </p>
             </ak-form-element-horizontal>
             <ak-form-element-horizontal name="enabled">
                 <div class="pf-c-check">
-                    <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.source?.enabled, true)}>
+                    <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.instance?.enabled, true)}>
                     <label class="pf-c-check__label">
                         ${t`Enabled`}
                     </label>
@@ -142,19 +139,19 @@ export class OAuthSourceForm extends Form<OAuthSource> {
                 ?required=${true}
                 name="userMatchingMode">
                 <select class="pf-c-form-control">
-                    <option value=${OAuthSourceUserMatchingModeEnum.Identifier} ?selected=${this.source?.userMatchingMode === OAuthSourceUserMatchingModeEnum.Identifier}>
+                    <option value=${OAuthSourceUserMatchingModeEnum.Identifier} ?selected=${this.instance?.userMatchingMode === OAuthSourceUserMatchingModeEnum.Identifier}>
                         ${t`Link users on unique identifier`}
                     </option>
-                    <option value=${OAuthSourceUserMatchingModeEnum.UsernameLink} ?selected=${this.source?.userMatchingMode === OAuthSourceUserMatchingModeEnum.UsernameLink}>
+                    <option value=${OAuthSourceUserMatchingModeEnum.UsernameLink} ?selected=${this.instance?.userMatchingMode === OAuthSourceUserMatchingModeEnum.UsernameLink}>
                         ${t`Link to a user with identical email address. Can have security implications when a source doesn't validate email addresses`}
                     </option>
-                    <option value=${OAuthSourceUserMatchingModeEnum.UsernameDeny} ?selected=${this.source?.userMatchingMode === OAuthSourceUserMatchingModeEnum.UsernameDeny}>
+                    <option value=${OAuthSourceUserMatchingModeEnum.UsernameDeny} ?selected=${this.instance?.userMatchingMode === OAuthSourceUserMatchingModeEnum.UsernameDeny}>
                         ${t`Use the user's email address, but deny enrollment when the email address already exists.`}
                     </option>
-                    <option value=${OAuthSourceUserMatchingModeEnum.EmailLink} ?selected=${this.source?.userMatchingMode === OAuthSourceUserMatchingModeEnum.EmailLink}>
+                    <option value=${OAuthSourceUserMatchingModeEnum.EmailLink} ?selected=${this.instance?.userMatchingMode === OAuthSourceUserMatchingModeEnum.EmailLink}>
                         ${t`Link to a user with identical username address. Can have security implications when a username is used with another source.`}
                     </option>
-                    <option value=${OAuthSourceUserMatchingModeEnum.EmailDeny} ?selected=${this.source?.userMatchingMode === OAuthSourceUserMatchingModeEnum.EmailDeny}>
+                    <option value=${OAuthSourceUserMatchingModeEnum.EmailDeny} ?selected=${this.instance?.userMatchingMode === OAuthSourceUserMatchingModeEnum.EmailDeny}>
                         ${t`Use the user's username, but deny enrollment when the username already exists.`}
                     </option>
                 </select>
@@ -169,14 +166,14 @@ export class OAuthSourceForm extends Form<OAuthSource> {
                         label=${t`Consumer key`}
                         ?required=${true}
                         name="consumerKey">
-                        <input type="text" value="${ifDefined(this.source?.consumerKey)}" class="pf-c-form-control" required>
+                        <input type="text" value="${ifDefined(this.instance?.consumerKey)}" class="pf-c-form-control" required>
                     </ak-form-element-horizontal>
                     <ak-form-element-horizontal
                         label=${t`Consumer secret`}
                         ?required=${true}
-                        ?writeOnly=${this.source !== undefined}
+                        ?writeOnly=${this.instance !== undefined}
                         name="consumerSecret">
-                        <input type="text" value="${ifDefined(this.source?.consumerSecret)}" class="pf-c-form-control" required>
+                        <input type="text" value="${ifDefined(this.instance?.consumerSecret)}" class="pf-c-form-control" required>
                     </ak-form-element-horizontal>
                     <ak-form-element-horizontal
                         label=${t`Provider type`}
@@ -194,15 +191,15 @@ export class OAuthSourceForm extends Form<OAuthSource> {
                             } else {
                                 this.showRequestTokenURL = false;
                             }
-                            if (!this.source) {
-                                this.source = {} as OAuthSource;
+                            if (!this.instance) {
+                                this.instance = {} as OAuthSource;
                             }
-                            this.source.providerType = selected.value;
+                            this.instance.providerType = selected.value;
                         }}>
                             ${until(new SourcesApi(DEFAULT_CONFIG).sourcesOauthSourceTypes().then(types => {
                                 return types.map(type => {
-                                    let selected = this.source?.providerType === type.slug;
-                                    if (!this.source?.pk) {
+                                    let selected = this.instance?.providerType === type.slug;
+                                    if (!this.instance?.pk) {
                                         if (this.modelName?.replace("oauthsource", "") === type.slug) {
                                             selected = true;
                                         }
@@ -236,8 +233,8 @@ export class OAuthSourceForm extends Form<OAuthSource> {
                                 designation: FlowDesignationEnum.Authentication,
                             }).then(flows => {
                                 return flows.results.map(flow => {
-                                    let selected = this.source?.authenticationFlow === flow.pk;
-                                    if (!this.source?.pk && !this.source?.authenticationFlow && flow.slug === "default-source-authentication") {
+                                    let selected = this.instance?.authenticationFlow === flow.pk;
+                                    if (!this.instance?.pk && !this.instance?.authenticationFlow && flow.slug === "default-source-authentication") {
                                         selected = true;
                                     }
                                     return html`<option value=${ifDefined(flow.pk)} ?selected=${selected}>${flow.name} (${flow.slug})</option>`;
@@ -256,8 +253,8 @@ export class OAuthSourceForm extends Form<OAuthSource> {
                                 designation: FlowDesignationEnum.Enrollment,
                             }).then(flows => {
                                 return flows.results.map(flow => {
-                                    let selected = this.source?.enrollmentFlow === flow.pk;
-                                    if (!this.source?.pk && !this.source?.enrollmentFlow && flow.slug === "default-source-enrollment") {
+                                    let selected = this.instance?.enrollmentFlow === flow.pk;
+                                    if (!this.instance?.pk && !this.instance?.enrollmentFlow && flow.slug === "default-source-enrollment") {
                                         selected = true;
                                     }
                                     return html`<option value=${ifDefined(flow.pk)} ?selected=${selected}>${flow.name} (${flow.slug})</option>`;
diff --git a/web/src/pages/sources/oauth/OAuthSourceViewPage.ts b/web/src/pages/sources/oauth/OAuthSourceViewPage.ts
index 97c07362c..b4f9bb498 100644
--- a/web/src/pages/sources/oauth/OAuthSourceViewPage.ts
+++ b/web/src/pages/sources/oauth/OAuthSourceViewPage.ts
@@ -122,7 +122,7 @@ export class OAuthSourceViewPage extends LitElement {
                                         </span>
                                         <ak-source-oauth-form
                                             slot="form"
-                                            .sourceSlug=${this.source.slug}>
+                                            .instancePk=${this.source.slug}>
                                         </ak-source-oauth-form>
                                         <button slot="trigger" class="pf-c-button pf-m-primary">
                                             ${t`Edit`}
diff --git a/web/src/pages/sources/plex/PlexSourceForm.ts b/web/src/pages/sources/plex/PlexSourceForm.ts
index b4aa4db31..a95fb5631 100644
--- a/web/src/pages/sources/plex/PlexSourceForm.ts
+++ b/web/src/pages/sources/plex/PlexSourceForm.ts
@@ -10,26 +10,22 @@ import { ifDefined } from "lit-html/directives/if-defined";
 import { until } from "lit-html/directives/until";
 import { first, randomString } from "../../../utils";
 import { PlexAPIClient, PlexResource, popupCenterScreen} from "../../../flows/sources/plex/API";
+import { ModelForm } from "../../../elements/forms/ModelForm";
 
 
 @customElement("ak-source-plex-form")
-export class PlexSourceForm extends Form<PlexSource> {
+export class PlexSourceForm extends ModelForm<PlexSource, string> {
 
-    set sourceSlug(value: string) {
-        new SourcesApi(DEFAULT_CONFIG).sourcesPlexRead({
-            slug: value,
+    loadInstance(pk: string): Promise<PlexSource> {
+        return new SourcesApi(DEFAULT_CONFIG).sourcesPlexRead({
+            slug: pk,
         }).then(source => {
-            this.source = source;
             this.plexToken = source.plexToken;
             this.loadServers();
+            return source;
         });
     }
 
-    @property({attribute: false})
-    source: PlexSource = {
-        clientId: randomString(40)
-    } as PlexSource;
-
     @property()
     plexToken?: string;
 
@@ -37,7 +33,7 @@ export class PlexSourceForm extends Form<PlexSource> {
     plexResources?: PlexResource[];
 
     getSuccessMessage(): string {
-        if (this.source) {
+        if (this.instance) {
             return t`Successfully updated source.`;
         } else {
             return t`Successfully created source.`;
@@ -46,9 +42,9 @@ export class PlexSourceForm extends Form<PlexSource> {
 
     send = (data: PlexSource): Promise<PlexSource> => {
         data.plexToken = this.plexToken;
-        if (this.source.slug) {
+        if (this.instance?.slug) {
             return new SourcesApi(DEFAULT_CONFIG).sourcesPlexUpdate({
-                slug: this.source.slug,
+                slug: this.instance.slug,
                 data: data
             });
         } else {
@@ -59,9 +55,9 @@ export class PlexSourceForm extends Form<PlexSource> {
     };
 
     async doAuth(): Promise<void> {
-        const authInfo = await PlexAPIClient.getPin(this.source?.clientId || "");
+        const authInfo = await PlexAPIClient.getPin(this.instance?.clientId || "");
         const authWindow = popupCenterScreen(authInfo.authUrl, "plex auth", 550, 700);
-        PlexAPIClient.pinPoll(this.source?.clientId || "", authInfo.pin.id).then(token => {
+        PlexAPIClient.pinPoll(this.instance?.clientId || "", authInfo.pin.id).then(token => {
             authWindow?.close();
             this.plexToken = token;
             this.loadServers();
@@ -81,17 +77,17 @@ export class PlexSourceForm extends Form<PlexSource> {
                 label=${t`Name`}
                 ?required=${true}
                 name="name">
-                <input type="text" value="${ifDefined(this.source?.name)}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.name)}" class="pf-c-form-control" required>
             </ak-form-element-horizontal>
             <ak-form-element-horizontal
                 label=${t`Slug`}
                 ?required=${true}
                 name="slug">
-                <input type="text" value="${ifDefined(this.source?.slug)}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.slug)}" class="pf-c-form-control" required>
             </ak-form-element-horizontal>
             <ak-form-element-horizontal name="enabled">
                 <div class="pf-c-check">
-                    <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.source?.enabled, true)}>
+                    <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.instance?.enabled, true)}>
                     <label class="pf-c-check__label">
                         ${t`Enabled`}
                     </label>
@@ -102,19 +98,19 @@ export class PlexSourceForm extends Form<PlexSource> {
                 ?required=${true}
                 name="userMatchingMode">
                 <select class="pf-c-form-control">
-                    <option value=${PlexSourceUserMatchingModeEnum.Identifier} ?selected=${this.source?.userMatchingMode === PlexSourceUserMatchingModeEnum.Identifier}>
+                    <option value=${PlexSourceUserMatchingModeEnum.Identifier} ?selected=${this.instance?.userMatchingMode === PlexSourceUserMatchingModeEnum.Identifier}>
                         ${t`Link users on unique identifier`}
                     </option>
-                    <option value=${PlexSourceUserMatchingModeEnum.UsernameLink} ?selected=${this.source?.userMatchingMode === PlexSourceUserMatchingModeEnum.UsernameLink}>
+                    <option value=${PlexSourceUserMatchingModeEnum.UsernameLink} ?selected=${this.instance?.userMatchingMode === PlexSourceUserMatchingModeEnum.UsernameLink}>
                         ${t`Link to a user with identical email address. Can have security implications when a source doesn't validate email addresses`}
                     </option>
-                    <option value=${PlexSourceUserMatchingModeEnum.UsernameDeny} ?selected=${this.source?.userMatchingMode === PlexSourceUserMatchingModeEnum.UsernameDeny}>
+                    <option value=${PlexSourceUserMatchingModeEnum.UsernameDeny} ?selected=${this.instance?.userMatchingMode === PlexSourceUserMatchingModeEnum.UsernameDeny}>
                         ${t`Use the user's email address, but deny enrollment when the email address already exists.`}
                     </option>
-                    <option value=${PlexSourceUserMatchingModeEnum.EmailLink} ?selected=${this.source?.userMatchingMode === PlexSourceUserMatchingModeEnum.EmailLink}>
+                    <option value=${PlexSourceUserMatchingModeEnum.EmailLink} ?selected=${this.instance?.userMatchingMode === PlexSourceUserMatchingModeEnum.EmailLink}>
                         ${t`Link to a user with identical username address. Can have security implications when a username is used with another source.`}
                     </option>
-                    <option value=${PlexSourceUserMatchingModeEnum.EmailDeny} ?selected=${this.source?.userMatchingMode === PlexSourceUserMatchingModeEnum.EmailDeny}>
+                    <option value=${PlexSourceUserMatchingModeEnum.EmailDeny} ?selected=${this.instance?.userMatchingMode === PlexSourceUserMatchingModeEnum.EmailDeny}>
                         ${t`Use the user's username, but deny enrollment when the username already exists.`}
                     </option>
                 </select>
@@ -129,11 +125,11 @@ export class PlexSourceForm extends Form<PlexSource> {
                         label=${t`Client ID`}
                         ?required=${true}
                         name="clientId">
-                        <input type="text" value="${first(this.source?.clientId)}" class="pf-c-form-control" required>
+                        <input type="text" value="${first(this.instance?.clientId)}" class="pf-c-form-control" required>
                     </ak-form-element-horizontal>
                     <ak-form-element-horizontal name="allowFriends">
                         <div class="pf-c-check">
-                            <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.source?.allowFriends, true)}>
+                            <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.instance?.allowFriends, true)}>
                             <label class="pf-c-check__label">
                                 ${t`Allow friends to authenticate via Plex, even if you don't share any servers`}
                             </label>
@@ -145,7 +141,7 @@ export class PlexSourceForm extends Form<PlexSource> {
                         name="allowedServers">
                         <select class="pf-c-form-control" multiple>
                             ${this.plexResources?.map(r => {
-                                const selected = Array.from(this.source?.allowedServers || []).some(server => {
+                                const selected = Array.from(this.instance?.allowedServers || []).some(server => {
                                     return server == r.clientIdentifier;
                                 });
                                 return html`<option value=${r.clientIdentifier} ?selected=${selected}>${r.name}</option>`;
@@ -178,8 +174,8 @@ export class PlexSourceForm extends Form<PlexSource> {
                                 designation: FlowDesignationEnum.Authentication,
                             }).then(flows => {
                                 return flows.results.map(flow => {
-                                    let selected = this.source?.authenticationFlow === flow.pk;
-                                    if (!this.source?.pk && !this.source?.authenticationFlow && flow.slug === "default-source-authentication") {
+                                    let selected = this.instance?.authenticationFlow === flow.pk;
+                                    if (!this.instance?.pk && !this.instance?.authenticationFlow && flow.slug === "default-source-authentication") {
                                         selected = true;
                                     }
                                     return html`<option value=${ifDefined(flow.pk)} ?selected=${selected}>${flow.name} (${flow.slug})</option>`;
@@ -198,8 +194,8 @@ export class PlexSourceForm extends Form<PlexSource> {
                                 designation: FlowDesignationEnum.Enrollment,
                             }).then(flows => {
                                 return flows.results.map(flow => {
-                                    let selected = this.source?.enrollmentFlow === flow.pk;
-                                    if (!this.source?.pk && !this.source?.enrollmentFlow && flow.slug === "default-source-enrollment") {
+                                    let selected = this.instance?.enrollmentFlow === flow.pk;
+                                    if (!this.instance?.pk && !this.instance?.enrollmentFlow && flow.slug === "default-source-enrollment") {
                                         selected = true;
                                     }
                                     return html`<option value=${ifDefined(flow.pk)} ?selected=${selected}>${flow.name} (${flow.slug})</option>`;
diff --git a/web/src/pages/sources/plex/PlexSourceViewPage.ts b/web/src/pages/sources/plex/PlexSourceViewPage.ts
index 2640cd11d..556c610e3 100644
--- a/web/src/pages/sources/plex/PlexSourceViewPage.ts
+++ b/web/src/pages/sources/plex/PlexSourceViewPage.ts
@@ -82,7 +82,7 @@ export class PlexSourceViewPage extends LitElement {
                                         </span>
                                         <ak-source-plex-form
                                             slot="form"
-                                            .sourceSlug=${this.source.slug}>
+                                            .instancePk=${this.source.slug}>
                                         </ak-source-plex-form>
                                         <button slot="trigger" class="pf-c-button pf-m-primary">
                                             ${t`Edit`}
diff --git a/web/src/pages/sources/saml/SAMLSourceForm.ts b/web/src/pages/sources/saml/SAMLSourceForm.ts
index 2fc1dfc28..d45f9b246 100644
--- a/web/src/pages/sources/saml/SAMLSourceForm.ts
+++ b/web/src/pages/sources/saml/SAMLSourceForm.ts
@@ -9,23 +9,19 @@ import "../../../elements/forms/HorizontalFormElement";
 import { ifDefined } from "lit-html/directives/if-defined";
 import { until } from "lit-html/directives/until";
 import { first } from "../../../utils";
+import { ModelForm } from "../../../elements/forms/ModelForm";
 
 @customElement("ak-source-saml-form")
-export class SAMLSourceForm extends Form<SAMLSource> {
+export class SAMLSourceForm extends ModelForm<SAMLSource, string> {
 
-    set sourceSlug(value: string) {
-        new SourcesApi(DEFAULT_CONFIG).sourcesSamlRead({
-            slug: value,
-        }).then(source => {
-            this.source = source;
+    loadInstance(pk: string): Promise<SAMLSource> {
+        return new SourcesApi(DEFAULT_CONFIG).sourcesSamlRead({
+            slug: pk,
         });
     }
 
-    @property({attribute: false})
-    source?: SAMLSource;
-
     getSuccessMessage(): string {
-        if (this.source) {
+        if (this.instance) {
             return t`Successfully updated source.`;
         } else {
             return t`Successfully created source.`;
@@ -33,9 +29,9 @@ export class SAMLSourceForm extends Form<SAMLSource> {
     }
 
     send = (data: SAMLSource): Promise<SAMLSource> => {
-        if (this.source) {
+        if (this.instance) {
             return new SourcesApi(DEFAULT_CONFIG).sourcesSamlUpdate({
-                slug: this.source.slug,
+                slug: this.instance.slug,
                 data: data
             });
         } else {
@@ -51,17 +47,17 @@ export class SAMLSourceForm extends Form<SAMLSource> {
                 label=${t`Name`}
                 ?required=${true}
                 name="name">
-                <input type="text" value="${ifDefined(this.source?.name)}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.name)}" class="pf-c-form-control" required>
             </ak-form-element-horizontal>
             <ak-form-element-horizontal
                 label=${t`Slug`}
                 ?required=${true}
                 name="slug">
-                <input type="text" value="${ifDefined(this.source?.slug)}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.slug)}" class="pf-c-form-control" required>
             </ak-form-element-horizontal>
             <ak-form-element-horizontal name="enabled">
                 <div class="pf-c-check">
-                    <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.source?.enabled, true)}>
+                    <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.instance?.enabled, true)}>
                     <label class="pf-c-check__label">
                         ${t`Enabled`}
                     </label>
@@ -77,19 +73,19 @@ export class SAMLSourceForm extends Form<SAMLSource> {
                         label=${t`SSO URL`}
                         ?required=${true}
                         name="ssoUrl">
-                        <input type="text" value="${ifDefined(this.source?.ssoUrl)}" class="pf-c-form-control" required>
+                        <input type="text" value="${ifDefined(this.instance?.ssoUrl)}" class="pf-c-form-control" required>
                         <p class="pf-c-form__helper-text">${t`URL that the initial Login request is sent to.`}</p>
                     </ak-form-element-horizontal>
                     <ak-form-element-horizontal
                         label=${t`SLO URL`}
                         name="sloUrl">
-                        <input type="text" value="${ifDefined(this.source?.sloUrl || "")}" class="pf-c-form-control">
+                        <input type="text" value="${ifDefined(this.instance?.sloUrl || "")}" class="pf-c-form-control">
                         <p class="pf-c-form__helper-text">${t`Optional URL if the IDP supports Single-Logout.`}</p>
                     </ak-form-element-horizontal>
                     <ak-form-element-horizontal
                         label=${t`Issuer`}
                         name="issuer">
-                        <input type="text" value="${ifDefined(this.source?.issuer)}" class="pf-c-form-control">
+                        <input type="text" value="${ifDefined(this.instance?.issuer)}" class="pf-c-form-control">
                         <p class="pf-c-form__helper-text">${t`Also known as Entity ID. Defaults the Metadata URL.`}</p>
                     </ak-form-element-horizontal>
                     <ak-form-element-horizontal
@@ -97,13 +93,13 @@ export class SAMLSourceForm extends Form<SAMLSource> {
                         ?required=${true}
                         name="bindingType">
                         <select class="pf-c-form-control">
-                            <option value=${SAMLSourceBindingTypeEnum.Redirect} ?selected=${this.source?.bindingType === SAMLSourceBindingTypeEnum.Redirect}>
+                            <option value=${SAMLSourceBindingTypeEnum.Redirect} ?selected=${this.instance?.bindingType === SAMLSourceBindingTypeEnum.Redirect}>
                                 ${t`Redirect binding`}
                             </option>
-                            <option value=${SAMLSourceBindingTypeEnum.PostAuto} ?selected=${this.source?.bindingType === SAMLSourceBindingTypeEnum.PostAuto}>
+                            <option value=${SAMLSourceBindingTypeEnum.PostAuto} ?selected=${this.instance?.bindingType === SAMLSourceBindingTypeEnum.PostAuto}>
                                 ${t`Post binding (auto-submit)`}
                             </option>
-                            <option value=${SAMLSourceBindingTypeEnum.Post} ?selected=${this.source?.bindingType === SAMLSourceBindingTypeEnum.Post}>
+                            <option value=${SAMLSourceBindingTypeEnum.Post} ?selected=${this.instance?.bindingType === SAMLSourceBindingTypeEnum.Post}>
                                 ${t`Post binding`}
                             </option>
                         </select>
@@ -112,12 +108,12 @@ export class SAMLSourceForm extends Form<SAMLSource> {
                         label=${t`Signing keypair`}
                         name="signingKp">
                         <select class="pf-c-form-control">
-                            <option value="" ?selected=${this.source?.signingKp === undefined}>---------</option>
+                            <option value="" ?selected=${this.instance?.signingKp === undefined}>---------</option>
                             ${until(new CryptoApi(DEFAULT_CONFIG).cryptoCertificatekeypairsList({
                                 ordering: "pk",
                             }).then(keys => {
                                 return keys.results.map(key => {
-                                    return html`<option value=${ifDefined(key.pk)} ?selected=${this.source?.signingKp === key.pk}>${key.name}</option>`;
+                                    return html`<option value=${ifDefined(key.pk)} ?selected=${this.instance?.signingKp === key.pk}>${key.name}</option>`;
                                 });
                             }), html`<option>${t`Loading...`}</option>`)}
                         </select>
@@ -132,7 +128,7 @@ export class SAMLSourceForm extends Form<SAMLSource> {
                 <div slot="body" class="pf-c-form">
                     <ak-form-element-horizontal name="allowIdpInitiated">
                         <div class="pf-c-check">
-                            <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.source?.allowIdpInitiated, false)}>
+                            <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.instance?.allowIdpInitiated, false)}>
                             <label class="pf-c-check__label">
                                 ${t` Allow IDP-initiated logins`}
                             </label>
@@ -144,19 +140,19 @@ export class SAMLSourceForm extends Form<SAMLSource> {
                         ?required=${true}
                         name="nameIdPolicy">
                         <select class="pf-c-form-control">
-                            <option value=${SAMLSourceNameIdPolicyEnum._20nameidFormatpersistent} ?selected=${this.source?.nameIdPolicy === SAMLSourceNameIdPolicyEnum._20nameidFormatpersistent}>
+                            <option value=${SAMLSourceNameIdPolicyEnum._20nameidFormatpersistent} ?selected=${this.instance?.nameIdPolicy === SAMLSourceNameIdPolicyEnum._20nameidFormatpersistent}>
                                 ${t`Persistent`}
                             </option>
-                            <option value=${SAMLSourceNameIdPolicyEnum._11nameidFormatemailAddress} ?selected=${this.source?.nameIdPolicy === SAMLSourceNameIdPolicyEnum._11nameidFormatemailAddress}>
+                            <option value=${SAMLSourceNameIdPolicyEnum._11nameidFormatemailAddress} ?selected=${this.instance?.nameIdPolicy === SAMLSourceNameIdPolicyEnum._11nameidFormatemailAddress}>
                                 ${t`Email address`}
                             </option>
-                            <option value=${SAMLSourceNameIdPolicyEnum._20nameidFormatWindowsDomainQualifiedName} ?selected=${this.source?.nameIdPolicy === SAMLSourceNameIdPolicyEnum._20nameidFormatWindowsDomainQualifiedName}>
+                            <option value=${SAMLSourceNameIdPolicyEnum._20nameidFormatWindowsDomainQualifiedName} ?selected=${this.instance?.nameIdPolicy === SAMLSourceNameIdPolicyEnum._20nameidFormatWindowsDomainQualifiedName}>
                                 ${t`Windows`}
                             </option>
-                            <option value=${SAMLSourceNameIdPolicyEnum._20nameidFormatX509SubjectName} ?selected=${this.source?.nameIdPolicy === SAMLSourceNameIdPolicyEnum._20nameidFormatX509SubjectName}>
+                            <option value=${SAMLSourceNameIdPolicyEnum._20nameidFormatX509SubjectName} ?selected=${this.instance?.nameIdPolicy === SAMLSourceNameIdPolicyEnum._20nameidFormatX509SubjectName}>
                                 ${t`X509 Subject`}
                             </option>
-                            <option value=${SAMLSourceNameIdPolicyEnum._20nameidFormattransient} ?selected=${this.source?.nameIdPolicy === SAMLSourceNameIdPolicyEnum._20nameidFormattransient}>
+                            <option value=${SAMLSourceNameIdPolicyEnum._20nameidFormattransient} ?selected=${this.instance?.nameIdPolicy === SAMLSourceNameIdPolicyEnum._20nameidFormattransient}>
                                 ${t`Transient`}
                             </option>
                         </select>
@@ -165,7 +161,7 @@ export class SAMLSourceForm extends Form<SAMLSource> {
                         label=${t`Delete temporary users after`}
                         ?required=${true}
                         name="temporaryUserDeleteAfter">
-                        <input type="text" value="${this.source?.temporaryUserDeleteAfter || "days=1"}" class="pf-c-form-control" required>
+                        <input type="text" value="${this.instance?.temporaryUserDeleteAfter || "days=1"}" class="pf-c-form-control" required>
                         <p class="pf-c-form__helper-text">${t`Time offset when temporary users should be deleted. This only applies if your IDP uses the NameID Format 'transient', and the user doesn't log out manually. (Format: hours=1;minutes=2;seconds=3).`}</p>
                     </ak-form-element-horizontal>
                     <ak-form-element-horizontal
@@ -173,16 +169,16 @@ export class SAMLSourceForm extends Form<SAMLSource> {
                         ?required=${true}
                         name="digestAlgorithm">
                         <select class="pf-c-form-control">
-                            <option value=${SAMLSourceDigestAlgorithmEnum._200009Xmldsigsha1} ?selected=${this.source?.digestAlgorithm === SAMLSourceDigestAlgorithmEnum._200009Xmldsigsha1}>
+                            <option value=${SAMLSourceDigestAlgorithmEnum._200009Xmldsigsha1} ?selected=${this.instance?.digestAlgorithm === SAMLSourceDigestAlgorithmEnum._200009Xmldsigsha1}>
                                 ${t`SHA1`}
                             </option>
-                            <option value=${SAMLSourceDigestAlgorithmEnum._200104Xmlencsha256} ?selected=${this.source?.digestAlgorithm === SAMLSourceDigestAlgorithmEnum._200104Xmlencsha256 || this.source?.digestAlgorithm === undefined}>
+                            <option value=${SAMLSourceDigestAlgorithmEnum._200104Xmlencsha256} ?selected=${this.instance?.digestAlgorithm === SAMLSourceDigestAlgorithmEnum._200104Xmlencsha256 || this.instance?.digestAlgorithm === undefined}>
                                 ${t`SHA256`}
                             </option>
-                            <option value=${SAMLSourceDigestAlgorithmEnum._200104XmldsigMoresha384} ?selected=${this.source?.digestAlgorithm === SAMLSourceDigestAlgorithmEnum._200104XmldsigMoresha384}>
+                            <option value=${SAMLSourceDigestAlgorithmEnum._200104XmldsigMoresha384} ?selected=${this.instance?.digestAlgorithm === SAMLSourceDigestAlgorithmEnum._200104XmldsigMoresha384}>
                                 ${t`SHA384`}
                             </option>
-                            <option value=${SAMLSourceDigestAlgorithmEnum._200104Xmlencsha512} ?selected=${this.source?.digestAlgorithm === SAMLSourceDigestAlgorithmEnum._200104Xmlencsha512}>
+                            <option value=${SAMLSourceDigestAlgorithmEnum._200104Xmlencsha512} ?selected=${this.instance?.digestAlgorithm === SAMLSourceDigestAlgorithmEnum._200104Xmlencsha512}>
                                 ${t`SHA512`}
                             </option>
                         </select>
@@ -192,19 +188,19 @@ export class SAMLSourceForm extends Form<SAMLSource> {
                         ?required=${true}
                         name="signatureAlgorithm">
                         <select class="pf-c-form-control">
-                            <option value=${SAMLSourceSignatureAlgorithmEnum._200009XmldsigrsaSha1} ?selected=${this.source?.signatureAlgorithm === SAMLSourceSignatureAlgorithmEnum._200009XmldsigrsaSha1}>
+                            <option value=${SAMLSourceSignatureAlgorithmEnum._200009XmldsigrsaSha1} ?selected=${this.instance?.signatureAlgorithm === SAMLSourceSignatureAlgorithmEnum._200009XmldsigrsaSha1}>
                                 ${t`RSA-SHA1`}
                             </option>
-                            <option value=${SAMLSourceSignatureAlgorithmEnum._200104XmldsigMorersaSha256} ?selected=${this.source?.signatureAlgorithm === SAMLSourceSignatureAlgorithmEnum._200104XmldsigMorersaSha256 || this.source?.signatureAlgorithm === undefined}>
+                            <option value=${SAMLSourceSignatureAlgorithmEnum._200104XmldsigMorersaSha256} ?selected=${this.instance?.signatureAlgorithm === SAMLSourceSignatureAlgorithmEnum._200104XmldsigMorersaSha256 || this.instance?.signatureAlgorithm === undefined}>
                                 ${t`RSA-SHA256`}
                             </option>
-                            <option value=${SAMLSourceSignatureAlgorithmEnum._200104XmldsigMorersaSha384} ?selected=${this.source?.signatureAlgorithm === SAMLSourceSignatureAlgorithmEnum._200104XmldsigMorersaSha384}>
+                            <option value=${SAMLSourceSignatureAlgorithmEnum._200104XmldsigMorersaSha384} ?selected=${this.instance?.signatureAlgorithm === SAMLSourceSignatureAlgorithmEnum._200104XmldsigMorersaSha384}>
                                 ${t`RSA-SHA384`}
                             </option>
-                            <option value=${SAMLSourceSignatureAlgorithmEnum._200104XmldsigMorersaSha512} ?selected=${this.source?.signatureAlgorithm === SAMLSourceSignatureAlgorithmEnum._200104XmldsigMorersaSha512}>
+                            <option value=${SAMLSourceSignatureAlgorithmEnum._200104XmldsigMorersaSha512} ?selected=${this.instance?.signatureAlgorithm === SAMLSourceSignatureAlgorithmEnum._200104XmldsigMorersaSha512}>
                                 ${t`RSA-SHA512`}
                             </option>
-                            <option value=${SAMLSourceSignatureAlgorithmEnum._200009XmldsigdsaSha1} ?selected=${this.source?.signatureAlgorithm === SAMLSourceSignatureAlgorithmEnum._200009XmldsigdsaSha1}>
+                            <option value=${SAMLSourceSignatureAlgorithmEnum._200009XmldsigdsaSha1} ?selected=${this.instance?.signatureAlgorithm === SAMLSourceSignatureAlgorithmEnum._200009XmldsigdsaSha1}>
                                 ${t`DSA-SHA1`}
                             </option>
                         </select>
@@ -226,8 +222,8 @@ export class SAMLSourceForm extends Form<SAMLSource> {
                                 designation: FlowDesignationEnum.StageConfiguration,
                             }).then(flows => {
                                 return flows.results.map(flow => {
-                                    let selected = this.source?.preAuthenticationFlow === flow.pk;
-                                    if (!this.source?.pk && !this.source?.preAuthenticationFlow && flow.slug === "default-source-pre-authentication") {
+                                    let selected = this.instance?.preAuthenticationFlow === flow.pk;
+                                    if (!this.instance?.pk && !this.instance?.preAuthenticationFlow && flow.slug === "default-source-pre-authentication") {
                                         selected = true;
                                     }
                                     return html`<option value=${ifDefined(flow.pk)} ?selected=${selected}>${flow.name} (${flow.slug})</option>`;
@@ -246,8 +242,8 @@ export class SAMLSourceForm extends Form<SAMLSource> {
                                 designation: FlowDesignationEnum.Authentication,
                             }).then(flows => {
                                 return flows.results.map(flow => {
-                                    let selected = this.source?.authenticationFlow === flow.pk;
-                                    if (!this.source?.pk && !this.source?.authenticationFlow && flow.slug === "default-source-authentication") {
+                                    let selected = this.instance?.authenticationFlow === flow.pk;
+                                    if (!this.instance?.pk && !this.instance?.authenticationFlow && flow.slug === "default-source-authentication") {
                                         selected = true;
                                     }
                                     return html`<option value=${ifDefined(flow.pk)} ?selected=${selected}>${flow.name} (${flow.slug})</option>`;
@@ -266,8 +262,8 @@ export class SAMLSourceForm extends Form<SAMLSource> {
                                 designation: FlowDesignationEnum.Enrollment,
                             }).then(flows => {
                                 return flows.results.map(flow => {
-                                    let selected = this.source?.enrollmentFlow === flow.pk;
-                                    if (!this.source?.pk && !this.source?.enrollmentFlow && flow.slug === "default-source-enrollment") {
+                                    let selected = this.instance?.enrollmentFlow === flow.pk;
+                                    if (!this.instance?.pk && !this.instance?.enrollmentFlow && flow.slug === "default-source-enrollment") {
                                         selected = true;
                                     }
                                     return html`<option value=${ifDefined(flow.pk)} ?selected=${selected}>${flow.name} (${flow.slug})</option>`;
diff --git a/web/src/pages/sources/saml/SAMLSourceViewPage.ts b/web/src/pages/sources/saml/SAMLSourceViewPage.ts
index 730a183ea..2449f2c65 100644
--- a/web/src/pages/sources/saml/SAMLSourceViewPage.ts
+++ b/web/src/pages/sources/saml/SAMLSourceViewPage.ts
@@ -109,7 +109,7 @@ export class SAMLSourceViewPage extends LitElement {
                                         </span>
                                         <ak-source-saml-form
                                             slot="form"
-                                            .sourceSlug=${this.source.slug}>
+                                            .instancePk=${this.source.slug}>
                                         </ak-source-saml-form>
                                         <button slot="trigger" class="pf-c-button pf-m-primary">
                                             ${t`Edit`}

From 4d11d82c6e5879556ab5de6e5d4ee53866e64d92 Mon Sep 17 00:00:00 2001
From: Jens Langhammer <jens.langhammer@beryju.org>
Date: Tue, 11 May 2021 11:55:25 +0200
Subject: [PATCH 03/10] web/admin: migrate more forms

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
---
 .../pages/crypto/CertificateKeyPairForm.ts    | 26 ++++++-----
 .../crypto/CertificateKeyPairListPage.ts      |  2 +-
 web/src/pages/events/RuleForm.ts              | 30 +++++++------
 web/src/pages/events/RuleListPage.ts          |  2 +-
 web/src/pages/events/TransportForm.ts         | 32 ++++++++------
 web/src/pages/events/TransportListPage.ts     |  2 +-
 web/src/pages/flows/BoundStagesList.ts        |  2 +-
 web/src/pages/flows/FlowForm.ts               | 44 ++++++++++---------
 web/src/pages/flows/FlowListPage.ts           |  2 +-
 web/src/pages/flows/StageBindingForm.ts       | 34 +++++++-------
 10 files changed, 98 insertions(+), 78 deletions(-)

diff --git a/web/src/pages/crypto/CertificateKeyPairForm.ts b/web/src/pages/crypto/CertificateKeyPairForm.ts
index fa2b36980..e466c268d 100644
--- a/web/src/pages/crypto/CertificateKeyPairForm.ts
+++ b/web/src/pages/crypto/CertificateKeyPairForm.ts
@@ -7,15 +7,19 @@ import { Form } from "../../elements/forms/Form";
 import { ifDefined } from "lit-html/directives/if-defined";
 import "../../elements/forms/HorizontalFormElement";
 import "../../elements/CodeMirror";
+import { ModelForm } from "../../elements/forms/ModelForm";
 
 @customElement("ak-crypto-certificate-form")
-export class CertificateKeyPairForm extends Form<CertificateKeyPair> {
+export class CertificateKeyPairForm extends ModelForm<CertificateKeyPair, string> {
 
-    @property({attribute: false})
-    keyPair?: CertificateKeyPair;
+    loadInstance(pk: string): Promise<CertificateKeyPair> {
+        return new CryptoApi(DEFAULT_CONFIG).cryptoCertificatekeypairsRead({
+            kpUuid: pk,
+        });
+    }
 
     getSuccessMessage(): string {
-        if (this.keyPair) {
+        if (this.instance) {
             return t`Successfully updated certificate-key pair.`;
         } else {
             return t`Successfully created certificate-key pair.`;
@@ -23,9 +27,9 @@ export class CertificateKeyPairForm extends Form<CertificateKeyPair> {
     }
 
     send = (data: CertificateKeyPair): Promise<CertificateKeyPair> => {
-        if (this.keyPair) {
+        if (this.instance) {
             return new CryptoApi(DEFAULT_CONFIG).cryptoCertificatekeypairsPartialUpdate({
-                kpUuid: this.keyPair.pk || "",
+                kpUuid: this.instance.pk || "",
                 data: data
             });
         } else {
@@ -41,21 +45,21 @@ export class CertificateKeyPairForm extends Form<CertificateKeyPair> {
                 label=${t`Name`}
                 name="name"
                 ?required=${true}>
-                <input type="text" value="${ifDefined(this.keyPair?.name)}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.name)}" class="pf-c-form-control" required>
             </ak-form-element-horizontal>
             <ak-form-element-horizontal
                 label=${t`Certificate`}
                 name="certificateData"
-                ?writeOnly=${this.keyPair !== undefined}
+                ?writeOnly=${this.instance !== undefined}
                 ?required=${true}>
-                <textarea class="pf-c-form-control" required>${ifDefined(this.keyPair?.certificateData)}</textarea>
+                <textarea class="pf-c-form-control" required>${ifDefined(this.instance?.certificateData)}</textarea>
                 <p class="pf-c-form__helper-text">${t`PEM-encoded Certificate data.`}</p>
             </ak-form-element-horizontal>
             <ak-form-element-horizontal
                 name="keyData"
-                ?writeOnly=${this.keyPair !== undefined}
+                ?writeOnly=${this.instance !== undefined}
                 label=${t`Private Key`}>
-                <textarea class="pf-c-form-control" >${ifDefined(this.keyPair?.keyData)}</textarea>
+                <textarea class="pf-c-form-control" >${ifDefined(this.instance?.keyData)}</textarea>
                 <p class="pf-c-form__helper-text">${t`Optional Private Key. If this is set, you can use this keypair for encryption.`}</p>
             </ak-form-element-horizontal>
         </form>`;
diff --git a/web/src/pages/crypto/CertificateKeyPairListPage.ts b/web/src/pages/crypto/CertificateKeyPairListPage.ts
index 5add00041..06e39bdac 100644
--- a/web/src/pages/crypto/CertificateKeyPairListPage.ts
+++ b/web/src/pages/crypto/CertificateKeyPairListPage.ts
@@ -70,7 +70,7 @@ export class CertificateKeyPairListPage extends TablePage<CertificateKeyPair> {
                 <span slot="header">
                     ${t`Update Certificate-Key Pair`}
                 </span>
-                <ak-crypto-certificate-form slot="form" .keyPair=${item}>
+                <ak-crypto-certificate-form slot="form" .instancePk=${item.pk}>
                 </ak-crypto-certificate-form>
                 <button slot="trigger" class="pf-c-button pf-m-secondary">
                     ${t`Edit`}
diff --git a/web/src/pages/events/RuleForm.ts b/web/src/pages/events/RuleForm.ts
index 16a1c4cb5..660dcbd2c 100644
--- a/web/src/pages/events/RuleForm.ts
+++ b/web/src/pages/events/RuleForm.ts
@@ -7,15 +7,19 @@ import { Form } from "../../elements/forms/Form";
 import { ifDefined } from "lit-html/directives/if-defined";
 import "../../elements/forms/HorizontalFormElement";
 import { until } from "lit-html/directives/until";
+import { ModelForm } from "../../elements/forms/ModelForm";
 
 @customElement("ak-event-rule-form")
-export class RuleForm extends Form<NotificationRule> {
+export class RuleForm extends ModelForm<NotificationRule, string> {
 
-    @property({attribute: false})
-    rule?: NotificationRule;
+    loadInstance(pk: string): Promise<NotificationRule> {
+        return new EventsApi(DEFAULT_CONFIG).eventsRulesRead({
+            pbmUuid: pk,
+        });
+    }
 
     getSuccessMessage(): string {
-        if (this.rule) {
+        if (this.instance) {
             return t`Successfully updated rule.`;
         } else {
             return t`Successfully created rule.`;
@@ -23,9 +27,9 @@ export class RuleForm extends Form<NotificationRule> {
     }
 
     send = (data: NotificationRule): Promise<NotificationRule> => {
-        if (this.rule) {
+        if (this.instance) {
             return new EventsApi(DEFAULT_CONFIG).eventsRulesUpdate({
-                pbmUuid: this.rule.pk || "",
+                pbmUuid: this.instance.pk || "",
                 data: data
             });
         } else {
@@ -37,13 +41,13 @@ export class RuleForm extends Form<NotificationRule> {
 
     renderSeverity(): TemplateResult {
         return html`
-            <option value=${NotificationRuleSeverityEnum.Alert} ?selected=${this.rule?.severity === NotificationRuleSeverityEnum.Alert}>
+            <option value=${NotificationRuleSeverityEnum.Alert} ?selected=${this.instance?.severity === NotificationRuleSeverityEnum.Alert}>
                 ${t`Alert`}
             </option>
-            <option value=${NotificationRuleSeverityEnum.Warning} ?selected=${this.rule?.severity === NotificationRuleSeverityEnum.Warning}>
+            <option value=${NotificationRuleSeverityEnum.Warning} ?selected=${this.instance?.severity === NotificationRuleSeverityEnum.Warning}>
                 ${t`Warning`}
             </option>
-            <option value=${NotificationRuleSeverityEnum.Notice} ?selected=${this.rule?.severity === NotificationRuleSeverityEnum.Notice}>
+            <option value=${NotificationRuleSeverityEnum.Notice} ?selected=${this.instance?.severity === NotificationRuleSeverityEnum.Notice}>
                 ${t`Notice`}
             </option>
         `;
@@ -55,16 +59,16 @@ export class RuleForm extends Form<NotificationRule> {
                 label=${t`Name`}
                 ?required=${true}
                 name="name">
-                <input type="text" value="${ifDefined(this.rule?.name)}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.name)}" class="pf-c-form-control" required>
             </ak-form-element-horizontal>
             <ak-form-element-horizontal
                 label=${t`Group`}
                 name="group">
                 <select class="pf-c-form-control">
-                    <option value="" ?selected=${this.rule?.group === undefined}>---------</option>
+                    <option value="" ?selected=${this.instance?.group === undefined}>---------</option>
                     ${until(new CoreApi(DEFAULT_CONFIG).coreGroupsList({}).then(groups => {
                         return groups.results.map(group => {
-                            return html`<option value=${ifDefined(group.pk)} ?selected=${this.rule?.group?.groupUuid === group.pk}>${group.name}</option>`;
+                            return html`<option value=${ifDefined(group.pk)} ?selected=${this.instance?.group?.groupUuid === group.pk}>${group.name}</option>`;
                         });
                     }), html`<option>${t`Loading...`}</option>`)}
                 </select>
@@ -76,7 +80,7 @@ export class RuleForm extends Form<NotificationRule> {
                 <select name="users" class="pf-c-form-control" multiple>
                     ${until(new EventsApi(DEFAULT_CONFIG).eventsTransportsList({}).then(transports => {
                         return transports.results.map(transport => {
-                            const selected = Array.from(this.rule?.transports || []).some(su => {
+                            const selected = Array.from(this.instance?.transports || []).some(su => {
                                 return su.uuid == transport.pk;
                             });
                             return html`<option value=${ifDefined(transport.pk)} ?selected=${selected}>${transport.name}</option>`;
diff --git a/web/src/pages/events/RuleListPage.ts b/web/src/pages/events/RuleListPage.ts
index 1d7fb74e2..7ffcd4d30 100644
--- a/web/src/pages/events/RuleListPage.ts
+++ b/web/src/pages/events/RuleListPage.ts
@@ -64,7 +64,7 @@ export class RuleListPage extends TablePage<NotificationRule> {
                 <span slot="header">
                     ${t`Update Notification Rule`}
                 </span>
-                <ak-event-rule-form slot="form" .rule=${item}>
+                <ak-event-rule-form slot="form" .instancePk=${item.pk}>
                 </ak-event-rule-form>
                 <button slot="trigger" class="pf-c-button pf-m-secondary">
                     ${t`Edit`}
diff --git a/web/src/pages/events/TransportForm.ts b/web/src/pages/events/TransportForm.ts
index a919f9ffa..d908e4646 100644
--- a/web/src/pages/events/TransportForm.ts
+++ b/web/src/pages/events/TransportForm.ts
@@ -7,18 +7,22 @@ import { Form } from "../../elements/forms/Form";
 import { ifDefined } from "lit-html/directives/if-defined";
 import "../../elements/forms/HorizontalFormElement";
 import { first } from "../../utils";
+import { ModelForm } from "../../elements/forms/ModelForm";
 
 @customElement("ak-event-transport-form")
-export class TransportForm extends Form<NotificationTransport> {
+export class TransportForm extends ModelForm<NotificationTransport, string> {
 
-    @property({attribute: false})
-    transport?: NotificationTransport;
+    loadInstance(pk: string): Promise<NotificationTransport> {
+        return new EventsApi(DEFAULT_CONFIG).eventsTransportsRead({
+            uuid: pk,
+        });
+    }
 
     @property({type: Boolean})
     showWebhook = false;
 
     getSuccessMessage(): string {
-        if (this.transport) {
+        if (this.instance) {
             return t`Successfully updated transport.`;
         } else {
             return t`Successfully created transport.`;
@@ -26,9 +30,9 @@ export class TransportForm extends Form<NotificationTransport> {
     }
 
     send = (data: NotificationTransport): Promise<NotificationTransport> => {
-        if (this.transport) {
+        if (this.instance) {
             return new EventsApi(DEFAULT_CONFIG).eventsTransportsUpdate({
-                uuid: this.transport.pk || "",
+                uuid: this.instance.pk || "",
                 data: data
             });
         } else {
@@ -40,21 +44,21 @@ export class TransportForm extends Form<NotificationTransport> {
 
     renderTransportModes(): TemplateResult {
         return html`
-            <option value=${NotificationTransportModeEnum.Email} ?selected=${this.transport?.mode === NotificationTransportModeEnum.Email}>
+            <option value=${NotificationTransportModeEnum.Email} ?selected=${this.instance?.mode === NotificationTransportModeEnum.Email}>
                 ${t`Email`}
             </option>
-            <option value=${NotificationTransportModeEnum.Webhook} ?selected=${this.transport?.mode === NotificationTransportModeEnum.Webhook}>
+            <option value=${NotificationTransportModeEnum.Webhook} ?selected=${this.instance?.mode === NotificationTransportModeEnum.Webhook}>
                 ${t`Webhook (generic)`}
             </option>
-            <option value=${NotificationTransportModeEnum.WebhookSlack} ?selected=${this.transport?.mode === NotificationTransportModeEnum.WebhookSlack}>
+            <option value=${NotificationTransportModeEnum.WebhookSlack} ?selected=${this.instance?.mode === NotificationTransportModeEnum.WebhookSlack}>
                 ${t`Webhook (Slack/Discord)`}
             </option>
         `;
     }
 
     firstUpdated(): void {
-        if (this.transport) {
-            this.onModeChange(this.transport.mode);
+        if (this.instance) {
+            this.onModeChange(this.instance.mode);
         }
     }
 
@@ -72,7 +76,7 @@ export class TransportForm extends Form<NotificationTransport> {
                 label=${t`Name`}
                 ?required=${true}
                 name="name">
-                <input type="text" value="${ifDefined(this.transport?.name)}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.name)}" class="pf-c-form-control" required>
             </ak-form-element-horizontal>
             <ak-form-element-horizontal
                 label=${t`Mode`}
@@ -89,11 +93,11 @@ export class TransportForm extends Form<NotificationTransport> {
                 ?hidden=${!this.showWebhook}
                 label=${t`Webhook URL`}
                 name="webhookUrl">
-                <input type="text" value="${ifDefined(this.transport?.webhookUrl)}" class="pf-c-form-control">
+                <input type="text" value="${ifDefined(this.instance?.webhookUrl)}" class="pf-c-form-control">
             </ak-form-element-horizontal>
             <ak-form-element-horizontal name="sendOnce">
                 <div class="pf-c-check">
-                    <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.transport?.sendOnce, false)}>
+                    <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.instance?.sendOnce, false)}>
                     <label class="pf-c-check__label">
                         ${t`Send once`}
                     </label>
diff --git a/web/src/pages/events/TransportListPage.ts b/web/src/pages/events/TransportListPage.ts
index 3bb67d29b..cf3ab4a16 100644
--- a/web/src/pages/events/TransportListPage.ts
+++ b/web/src/pages/events/TransportListPage.ts
@@ -68,7 +68,7 @@ export class TransportListPage extends TablePage<NotificationTransport> {
                 <span slot="header">
                     ${t`Update Notification Transport`}
                 </span>
-                <ak-event-transport-form slot="form" .transport=${item}>
+                <ak-event-transport-form slot="form" .instancePk=${item.pk}>
                 </ak-event-transport-form>
                 <button slot="trigger" class="pf-c-button pf-m-secondary">
                     ${t`Edit`}
diff --git a/web/src/pages/flows/BoundStagesList.ts b/web/src/pages/flows/BoundStagesList.ts
index f54a8b9c0..f1a1d9615 100644
--- a/web/src/pages/flows/BoundStagesList.ts
+++ b/web/src/pages/flows/BoundStagesList.ts
@@ -73,7 +73,7 @@ export class BoundStagesList extends Table<FlowStageBinding> {
                 <span slot="header">
                     ${t`Update Stage binding`}
                 </span>
-                <ak-stage-binding-form slot="form" .fsb=${item}>
+                <ak-stage-binding-form slot="form" .instancePk=${item.pk}>
                 </ak-stage-binding-form>
                 <button slot="trigger" class="pf-c-button pf-m-secondary">
                     ${t`Edit Binding`}
diff --git a/web/src/pages/flows/FlowForm.ts b/web/src/pages/flows/FlowForm.ts
index ef60875cf..39a427226 100644
--- a/web/src/pages/flows/FlowForm.ts
+++ b/web/src/pages/flows/FlowForm.ts
@@ -6,15 +6,19 @@ import { DEFAULT_CONFIG } from "../../api/Config";
 import { Form } from "../../elements/forms/Form";
 import { ifDefined } from "lit-html/directives/if-defined";
 import "../../elements/forms/HorizontalFormElement";
+import { ModelForm } from "../../elements/forms/ModelForm";
 
 @customElement("ak-flow-form")
-export class FlowForm extends Form<Flow> {
+export class FlowForm extends ModelForm<Flow, string> {
 
-    @property({attribute: false})
-    flow?: Flow;
+    loadInstance(pk: string): Promise<Flow> {
+        return new FlowsApi(DEFAULT_CONFIG).flowsInstancesRead({
+            slug: pk,
+        });
+    }
 
     getSuccessMessage(): string {
-        if (this.flow) {
+        if (this.instance) {
             return t`Successfully updated flow.`;
         } else {
             return t`Successfully created flow.`;
@@ -23,9 +27,9 @@ export class FlowForm extends Form<Flow> {
 
     send = (data: Flow): Promise<void | Flow> => {
         let writeOp: Promise<Flow>;
-        if (this.flow) {
+        if (this.instance) {
             writeOp = new FlowsApi(DEFAULT_CONFIG).flowsInstancesUpdate({
-                slug: this.flow.slug,
+                slug: this.instance.slug,
                 data: data
             });
         } else {
@@ -47,25 +51,25 @@ export class FlowForm extends Form<Flow> {
 
     renderDesignations(): TemplateResult {
         return html`
-            <option value=${FlowDesignationEnum.Authentication} ?selected=${this.flow?.designation === FlowDesignationEnum.Authentication}>
+            <option value=${FlowDesignationEnum.Authentication} ?selected=${this.instance?.designation === FlowDesignationEnum.Authentication}>
                 ${t`Authentication`}
             </option>
-            <option value=${FlowDesignationEnum.Authorization} ?selected=${this.flow?.designation === FlowDesignationEnum.Authorization}>
+            <option value=${FlowDesignationEnum.Authorization} ?selected=${this.instance?.designation === FlowDesignationEnum.Authorization}>
                 ${t`Authorization`}
             </option>
-            <option value=${FlowDesignationEnum.Enrollment} ?selected=${this.flow?.designation === FlowDesignationEnum.Enrollment}>
+            <option value=${FlowDesignationEnum.Enrollment} ?selected=${this.instance?.designation === FlowDesignationEnum.Enrollment}>
                 ${t`Enrollment`}
             </option>
-            <option value=${FlowDesignationEnum.Invalidation} ?selected=${this.flow?.designation === FlowDesignationEnum.Invalidation}>
+            <option value=${FlowDesignationEnum.Invalidation} ?selected=${this.instance?.designation === FlowDesignationEnum.Invalidation}>
                 ${t`Invalidation`}
             </option>
-            <option value=${FlowDesignationEnum.Recovery} ?selected=${this.flow?.designation === FlowDesignationEnum.Recovery}>
+            <option value=${FlowDesignationEnum.Recovery} ?selected=${this.instance?.designation === FlowDesignationEnum.Recovery}>
                 ${t`Recovery`}
             </option>
-            <option value=${FlowDesignationEnum.StageConfiguration} ?selected=${this.flow?.designation === FlowDesignationEnum.StageConfiguration}>
+            <option value=${FlowDesignationEnum.StageConfiguration} ?selected=${this.instance?.designation === FlowDesignationEnum.StageConfiguration}>
                 ${t`Stage Configuration`}
             </option>
-            <option value=${FlowDesignationEnum.Unenrollment} ?selected=${this.flow?.designation === FlowDesignationEnum.Unenrollment}>
+            <option value=${FlowDesignationEnum.Unenrollment} ?selected=${this.instance?.designation === FlowDesignationEnum.Unenrollment}>
                 ${t`Unenrollment`}
             </option>
         `;
@@ -77,20 +81,20 @@ export class FlowForm extends Form<Flow> {
                 label=${t`Name`}
                 ?required=${true}
                 name="name">
-                <input type="text" value="${ifDefined(this.flow?.name)}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.name)}" class="pf-c-form-control" required>
             </ak-form-element-horizontal>
             <ak-form-element-horizontal
                 label=${t`Title`}
                 ?required=${true}
                 name="title">
-                <input type="text" value="${ifDefined(this.flow?.title)}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.title)}" class="pf-c-form-control" required>
                 <p class="pf-c-form__helper-text">${t`Shown as the Title in Flow pages.`}</p>
             </ak-form-element-horizontal>
             <ak-form-element-horizontal
                 label=${t`Slug`}
                 ?required=${true}
                 name="slug">
-                <input type="text" value="${ifDefined(this.flow?.slug)}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.slug)}" class="pf-c-form-control" required>
                 <p class="pf-c-form__helper-text">${t`Visible in the URL.`}</p>
             </ak-form-element-horizontal>
             <ak-form-element-horizontal
@@ -98,10 +102,10 @@ export class FlowForm extends Form<Flow> {
                 ?required=${true}
                 name="policyEngineMode">
                 <select class="pf-c-form-control">
-                    <option value=${FlowPolicyEngineModeEnum.Any} ?selected=${this.flow?.policyEngineMode === FlowPolicyEngineModeEnum.Any}>
+                    <option value=${FlowPolicyEngineModeEnum.Any} ?selected=${this.instance?.policyEngineMode === FlowPolicyEngineModeEnum.Any}>
                         ${t`ANY, any policy must match to grant access.`}
                     </option>
-                    <option value=${FlowPolicyEngineModeEnum.All} ?selected=${this.flow?.policyEngineMode === FlowPolicyEngineModeEnum.All}>
+                    <option value=${FlowPolicyEngineModeEnum.All} ?selected=${this.instance?.policyEngineMode === FlowPolicyEngineModeEnum.All}>
                         ${t`ALL, all policies must match to grant access.`}
                     </option>
                 </select>
@@ -111,7 +115,7 @@ export class FlowForm extends Form<Flow> {
                 ?required=${true}
                 name="designation">
                 <select class="pf-c-form-control">
-                    <option value="" ?selected=${this.flow?.designation === undefined}>---------</option>
+                    <option value="" ?selected=${this.instance?.designation === undefined}>---------</option>
                     ${this.renderDesignations()}
                 </select>
                 <p class="pf-c-form__helper-text">${t`Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik.`}</p>
@@ -119,7 +123,7 @@ export class FlowForm extends Form<Flow> {
             <ak-form-element-horizontal
                 label=${t`Background`}
                 name="background">
-                <input type="file" value="${ifDefined(this.flow?.background)}" class="pf-c-form-control">
+                <input type="file" value="${ifDefined(this.instance?.background)}" class="pf-c-form-control">
                 <p class="pf-c-form__helper-text">${t`Background shown during execution.`}</p>
             </ak-form-element-horizontal>
         </form>`;
diff --git a/web/src/pages/flows/FlowListPage.ts b/web/src/pages/flows/FlowListPage.ts
index b335a6d99..89e9d041d 100644
--- a/web/src/pages/flows/FlowListPage.ts
+++ b/web/src/pages/flows/FlowListPage.ts
@@ -68,7 +68,7 @@ export class FlowListPage extends TablePage<Flow> {
                 <span slot="header">
                     ${t`Update Flow`}
                 </span>
-                <ak-flow-form slot="form" .flow=${item}>
+                <ak-flow-form slot="form" .instancePk=${item.pk}>
                 </ak-flow-form>
                 <button slot="trigger" class="pf-c-button pf-m-secondary">
                     ${t`Edit`}
diff --git a/web/src/pages/flows/StageBindingForm.ts b/web/src/pages/flows/StageBindingForm.ts
index 8e1d517f7..c95407868 100644
--- a/web/src/pages/flows/StageBindingForm.ts
+++ b/web/src/pages/flows/StageBindingForm.ts
@@ -8,18 +8,22 @@ import { until } from "lit-html/directives/until";
 import { ifDefined } from "lit-html/directives/if-defined";
 import "../../elements/forms/HorizontalFormElement";
 import { first, groupBy } from "../../utils";
+import { ModelForm } from "../../elements/forms/ModelForm";
 
 @customElement("ak-stage-binding-form")
-export class StageBindingForm extends Form<FlowStageBinding> {
+export class StageBindingForm extends ModelForm<FlowStageBinding, string> {
 
-    @property({attribute: false})
-    fsb?: FlowStageBinding;
+    loadInstance(pk: string): Promise<FlowStageBinding> {
+        return new FlowsApi(DEFAULT_CONFIG).flowsBindingsRead({
+            fsbUuid: pk,
+        });
+    }
 
     @property()
     targetPk?: string;
 
     getSuccessMessage(): string {
-        if (this.fsb) {
+        if (this.instance) {
             return t`Successfully updated binding.`;
         } else {
             return t`Successfully created binding.`;
@@ -27,9 +31,9 @@ export class StageBindingForm extends Form<FlowStageBinding> {
     }
 
     send = (data: FlowStageBinding): Promise<FlowStageBinding> => {
-        if (this.fsb) {
+        if (this.instance) {
             return new FlowsApi(DEFAULT_CONFIG).flowsBindingsUpdate({
-                fsbUuid: this.fsb.pk || "",
+                fsbUuid: this.instance.pk || "",
                 data: data
             });
         } else {
@@ -45,7 +49,7 @@ export class StageBindingForm extends Form<FlowStageBinding> {
             ${groupBy<Stage>(stages, (s => s.verboseName || "")).map(([group, stages]) => {
                 return html`<optgroup label=${group}>
                     ${stages.map(stage => {
-                        const selected = (this.fsb?.stage === stage.pk);
+                        const selected = (this.instance?.stage === stage.pk);
                         return html`<option ?selected=${selected} value=${ifDefined(stage.pk)}>${stage.name}</option>`;
                     })}
                 </optgroup>`;
@@ -54,8 +58,8 @@ export class StageBindingForm extends Form<FlowStageBinding> {
     }
 
     getOrder(): Promise<number> {
-        if (this.fsb) {
-            return Promise.resolve(this.fsb.order);
+        if (this.instance) {
+            return Promise.resolve(this.instance.order);
         }
         return new FlowsApi(DEFAULT_CONFIG).flowsBindingsList({
             target: this.targetPk || "",
@@ -69,9 +73,9 @@ export class StageBindingForm extends Form<FlowStageBinding> {
     }
 
     renderTarget(): TemplateResult {
-        if (this.fsb?.target || this.targetPk) {
+        if (this.instance?.target || this.targetPk) {
             return html`
-            <input required name="target" type="hidden" value=${ifDefined(this.fsb?.target || this.targetPk)}>
+            <input required name="target" type="hidden" value=${ifDefined(this.instance?.target || this.targetPk)}>
             `;
         }
         return html`<ak-form-element-horizontal
@@ -114,7 +118,7 @@ export class StageBindingForm extends Form<FlowStageBinding> {
             </ak-form-element-horizontal>
             <ak-form-element-horizontal name="evaluateOnPlan">
                 <div class="pf-c-check">
-                    <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.fsb?.evaluateOnPlan, true)}>
+                    <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.instance?.evaluateOnPlan, true)}>
                     <label class="pf-c-check__label">
                         ${t`Evaluate on plan`}
                     </label>
@@ -125,7 +129,7 @@ export class StageBindingForm extends Form<FlowStageBinding> {
             </ak-form-element-horizontal>
             <ak-form-element-horizontal name="reEvaluatePolicies">
                 <div class="pf-c-check">
-                    <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.fsb?.reEvaluatePolicies, false)}>
+                    <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.instance?.reEvaluatePolicies, false)}>
                     <label class="pf-c-check__label">
                         ${t`Re-evaluate policies`}
                     </label>
@@ -137,10 +141,10 @@ export class StageBindingForm extends Form<FlowStageBinding> {
                 ?required=${true}
                 name="policyEngineMode">
                 <select class="pf-c-form-control">
-                    <option value=${FlowStageBindingPolicyEngineModeEnum.Any} ?selected=${this.fsb?.policyEngineMode === FlowStageBindingPolicyEngineModeEnum.Any}>
+                    <option value=${FlowStageBindingPolicyEngineModeEnum.Any} ?selected=${this.instance?.policyEngineMode === FlowStageBindingPolicyEngineModeEnum.Any}>
                         ${t`ANY, any policy must match to include this stage access.`}
                     </option>
-                    <option value=${FlowStageBindingPolicyEngineModeEnum.All} ?selected=${this.fsb?.policyEngineMode === FlowStageBindingPolicyEngineModeEnum.All}>
+                    <option value=${FlowStageBindingPolicyEngineModeEnum.All} ?selected=${this.instance?.policyEngineMode === FlowStageBindingPolicyEngineModeEnum.All}>
                         ${t`ALL, all policies must match to include this stage access.`}
                     </option>
                 </select>

From ff9ff18c113fb5255a2d7c6d41c130b855b5a4d5 Mon Sep 17 00:00:00 2001
From: Jens Langhammer <jens.langhammer@beryju.org>
Date: Tue, 11 May 2021 12:05:30 +0200
Subject: [PATCH 04/10] web/admin: migrate more forms

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
---
 web/src/pages/groups/GroupForm.ts             | 40 +++++++-----
 web/src/pages/groups/GroupListPage.ts         |  2 +-
 .../outposts/ServiceConnectionDockerForm.ts   | 37 +++++------
 .../ServiceConnectionKubernetesForm.ts        | 29 ++++-----
 .../outposts/ServiceConnectionListPage.ts     |  2 +-
 web/src/pages/policies/BoundPoliciesList.ts   |  4 +-
 web/src/pages/policies/PolicyBindingForm.ts   | 65 +++++++++----------
 web/src/pages/policies/PolicyListPage.ts      |  2 +-
 .../pages/policies/dummy/DummyPolicyForm.ts   | 33 ++++------
 9 files changed, 100 insertions(+), 114 deletions(-)

diff --git a/web/src/pages/groups/GroupForm.ts b/web/src/pages/groups/GroupForm.ts
index f4d5edc4e..d20b77a3a 100644
--- a/web/src/pages/groups/GroupForm.ts
+++ b/web/src/pages/groups/GroupForm.ts
@@ -13,15 +13,19 @@ import "../../elements/chips/Chip";
 import "./MemberSelectModal";
 import YAML from "yaml";
 import { first } from "../../utils";
+import { ModelForm } from "../../elements/forms/ModelForm";
 
 @customElement("ak-group-form")
-export class GroupForm extends Form<Group> {
+export class GroupForm extends ModelForm<Group, string> {
 
-    @property({attribute: false})
-    group?: Group;
+    loadInstance(pk: string): Promise<Group> {
+        return new CoreApi(DEFAULT_CONFIG).coreGroupsRead({
+            groupUuid: pk
+        });
+    }
 
     getSuccessMessage(): string {
-        if (this.group) {
+        if (this.instance) {
             return t`Successfully updated group.`;
         } else {
             return t`Successfully created group.`;
@@ -29,13 +33,13 @@ export class GroupForm extends Form<Group> {
     }
 
     send = (data: Group): Promise<Group> => {
-        if (this.group?.pk) {
+        if (this.instance?.pk) {
             return new CoreApi(DEFAULT_CONFIG).coreGroupsUpdate({
-                groupUuid: this.group.pk || "",
+                groupUuid: this.instance.pk || "",
                 data: data
             });
         } else {
-            data.users = Array.from(this.group?.users || []) as unknown as Set<number>;
+            data.users = Array.from(this.instance?.users || []) as unknown as Set<number>;
             return new CoreApi(DEFAULT_CONFIG).coreGroupsCreate({
                 data: data
             });
@@ -48,11 +52,11 @@ export class GroupForm extends Form<Group> {
                 label=${t`Name`}
                 ?required=${true}
                 name="name">
-                <input type="text" value="${ifDefined(this.group?.name)}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.name)}" class="pf-c-form-control" required>
             </ak-form-element-horizontal>
             <ak-form-element-horizontal name="isSuperuser">
                 <div class="pf-c-check">
-                    <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.group?.isSuperuser, false)}>
+                    <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.instance?.isSuperuser, false)}>
                     <label class="pf-c-check__label">
                         ${t`Is superuser`}
                     </label>
@@ -63,10 +67,10 @@ export class GroupForm extends Form<Group> {
                 label=${t`Parent`}
                 name="parent">
                 <select class="pf-c-form-control">
-                    <option value="" ?selected=${this.group?.parent === undefined}>---------</option>
+                    <option value="" ?selected=${this.instance?.parent === undefined}>---------</option>
                     ${until(new CoreApi(DEFAULT_CONFIG).coreGroupsList({}).then(groups => {
                         return groups.results.map(group => {
-                            return html`<option value=${ifDefined(group.pk)} ?selected=${this.group?.parent === group.pk}>${group.name}</option>`;
+                            return html`<option value=${ifDefined(group.pk)} ?selected=${this.instance?.parent === group.pk}>${group.name}</option>`;
                         });
                     }), html`<option>${t`Loading...`}</option>`)}
                 </select>
@@ -79,8 +83,8 @@ export class GroupForm extends Form<Group> {
                         .confirm=${(items: User[]) => {
                             // Because the model only has the IDs, map the user list to IDs
                             const ids = items.map(u => u.pk || 0);
-                            if (!this.group) this.group = {} as Group;
-                            this.group.users = new Set(Array.from(this.group?.users || []).concat(ids));
+                            if (!this.instance) this.instance = {} as Group;
+                            this.instance.users = new Set(Array.from(this.instance?.users || []).concat(ids));
                             this.requestUpdate();
                             return Promise.resolve();
                         }}>
@@ -94,7 +98,7 @@ export class GroupForm extends Form<Group> {
                                 ordering: "username",
                             }).then(users => {
                                 return users.results.map(user => {
-                                    const selected = Array.from(this.group?.users || []).some(su => {
+                                    const selected = Array.from(this.instance?.users || []).some(su => {
                                         return su == user.pk;
                                     });
                                     if (!selected) return;
@@ -102,11 +106,11 @@ export class GroupForm extends Form<Group> {
                                         .removable=${true}
                                         value=${ifDefined(user.pk)}
                                         @remove=${() => {
-                                            if (!this.group) return;
-                                            const users = Array.from(this.group?.users || []);
+                                            if (!this.instance) return;
+                                            const users = Array.from(this.instance?.users || []);
                                             const idx = users.indexOf(user.pk || 0);
                                             users.splice(idx, 1);
-                                            this.group.users = new Set(users);
+                                            this.instance.users = new Set(users);
                                             this.requestUpdate();
                                         }}>
                                         ${user.username}
@@ -122,7 +126,7 @@ export class GroupForm extends Form<Group> {
                 label=${t`Attributes`}
                 ?required=${true}
                 name="attributes">
-                <ak-codemirror mode="yaml" value="${YAML.stringify(first(this.group?.attributes, {}))}">
+                <ak-codemirror mode="yaml" value="${YAML.stringify(first(this.instance?.attributes, {}))}">
                 </ak-codemirror>
                 <p class="pf-c-form__helper-text">${t`Set custom attributes using YAML or JSON.`}</p>
             </ak-form-element-horizontal>
diff --git a/web/src/pages/groups/GroupListPage.ts b/web/src/pages/groups/GroupListPage.ts
index 2caa7e7d0..9c2d71bec 100644
--- a/web/src/pages/groups/GroupListPage.ts
+++ b/web/src/pages/groups/GroupListPage.ts
@@ -63,7 +63,7 @@ export class GroupListPage extends TablePage<Group> {
                 <span slot="header">
                     ${t`Update Group`}
                 </span>
-                <ak-group-form slot="form" .group=${item}>
+                <ak-group-form slot="form" .instancePk=${item.pk}>
                 </ak-group-form>
                 <button slot="trigger" class="pf-c-button pf-m-secondary">
                     ${t`Edit`}
diff --git a/web/src/pages/outposts/ServiceConnectionDockerForm.ts b/web/src/pages/outposts/ServiceConnectionDockerForm.ts
index db8ceafa8..0c55ee0d3 100644
--- a/web/src/pages/outposts/ServiceConnectionDockerForm.ts
+++ b/web/src/pages/outposts/ServiceConnectionDockerForm.ts
@@ -1,30 +1,25 @@
 import { CryptoApi, DockerServiceConnection, OutpostsApi } from "authentik-api";
 import { t } from "@lingui/macro";
-import { customElement, property } from "lit-element";
+import { customElement } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../api/Config";
-import { Form } from "../../elements/forms/Form";
 import { until } from "lit-html/directives/until";
 import { ifDefined } from "lit-html/directives/if-defined";
 import "../../elements/forms/HorizontalFormElement";
 import { first } from "../../utils";
+import { ModelForm } from "../../elements/forms/ModelForm";
 
 @customElement("ak-service-connection-docker-form")
-export class ServiceConnectionDockerForm extends Form<DockerServiceConnection> {
+export class ServiceConnectionDockerForm extends ModelForm<DockerServiceConnection, string> {
 
-    set scUUID(value: string) {
-        new OutpostsApi(DEFAULT_CONFIG).outpostsServiceConnectionsDockerRead({
-            uuid: value,
-        }).then(sc => {
-            this.sc = sc;
+    loadInstance(pk: string): Promise<DockerServiceConnection> {
+        return new OutpostsApi(DEFAULT_CONFIG).outpostsServiceConnectionsDockerRead({
+            uuid: pk,
         });
     }
 
-    @property({attribute: false})
-    sc?: DockerServiceConnection;
-
     getSuccessMessage(): string {
-        if (this.sc) {
+        if (this.instance) {
             return t`Successfully updated service-connection.`;
         } else {
             return t`Successfully created service-connection.`;
@@ -32,9 +27,9 @@ export class ServiceConnectionDockerForm extends Form<DockerServiceConnection> {
     }
 
     send = (data: DockerServiceConnection): Promise<DockerServiceConnection> => {
-        if (this.sc) {
+        if (this.instance) {
             return new OutpostsApi(DEFAULT_CONFIG).outpostsServiceConnectionsDockerUpdate({
-                uuid: this.sc.pk || "",
+                uuid: this.instance.pk || "",
                 data: data
             });
         } else {
@@ -50,11 +45,11 @@ export class ServiceConnectionDockerForm extends Form<DockerServiceConnection> {
                 label=${t`Name`}
                 ?required=${true}
                 name="name">
-                <input type="text" value="${ifDefined(this.sc?.name)}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.name)}" class="pf-c-form-control" required>
             </ak-form-element-horizontal>
             <ak-form-element-horizontal name="local">
                 <div class="pf-c-check">
-                    <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.sc?.local, false)}>
+                    <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.instance?.local, false)}>
                     <label class="pf-c-check__label">
                         ${t`Local`}
                     </label>
@@ -65,19 +60,19 @@ export class ServiceConnectionDockerForm extends Form<DockerServiceConnection> {
                 label=${t`Docker URL`}
                 ?required=${true}
                 name="url">
-                <input type="text" value="${ifDefined(this.sc?.url)}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.url)}" class="pf-c-form-control" required>
                 <p class="pf-c-form__helper-text">${t`Can be in the format of 'unix://' when connecting to a local docker daemon, or 'https://:2376' when connecting to a remote system.`}</p>
             </ak-form-element-horizontal>
             <ak-form-element-horizontal
                 label=${t`TLS Verification Certificate`}
                 name="tlsVerification">
                 <select class="pf-c-form-control">
-                    <option value="" ?selected=${this.sc?.tlsVerification === undefined}>---------</option>
+                    <option value="" ?selected=${this.instance?.tlsVerification === undefined}>---------</option>
                     ${until(new CryptoApi(DEFAULT_CONFIG).cryptoCertificatekeypairsList({
                         ordering: "pk"
                     }).then(certs => {
                         return certs.results.map(cert => {
-                            return html`<option value=${ifDefined(cert.pk)} ?selected=${this.sc?.tlsVerification === cert.pk}>${cert.name}</option>`;
+                            return html`<option value=${ifDefined(cert.pk)} ?selected=${this.instance?.tlsVerification === cert.pk}>${cert.name}</option>`;
                         });
                     }), html`<option>${t`Loading...`}</option>`)}
                 </select>
@@ -87,12 +82,12 @@ export class ServiceConnectionDockerForm extends Form<DockerServiceConnection> {
                 label=${t`TLS Authentication Certificate`}
                 name="tlsAuthentication">
                 <select class="pf-c-form-control">
-                    <option value="" ?selected=${this.sc?.tlsAuthentication === undefined}>---------</option>
+                    <option value="" ?selected=${this.instance?.tlsAuthentication === undefined}>---------</option>
                     ${until(new CryptoApi(DEFAULT_CONFIG).cryptoCertificatekeypairsList({
                         ordering: "pk"
                     }).then(certs => {
                         return certs.results.map(cert => {
-                            return html`<option value=${ifDefined(cert.pk)} ?selected=${this.sc?.tlsAuthentication === cert.pk}>${cert.name}</option>`;
+                            return html`<option value=${ifDefined(cert.pk)} ?selected=${this.instance?.tlsAuthentication === cert.pk}>${cert.name}</option>`;
                         });
                     }), html`<option>${t`Loading...`}</option>`)}
                 </select>
diff --git a/web/src/pages/outposts/ServiceConnectionKubernetesForm.ts b/web/src/pages/outposts/ServiceConnectionKubernetesForm.ts
index 4e5252df4..db68af807 100644
--- a/web/src/pages/outposts/ServiceConnectionKubernetesForm.ts
+++ b/web/src/pages/outposts/ServiceConnectionKubernetesForm.ts
@@ -1,31 +1,26 @@
 import { KubernetesServiceConnection, OutpostsApi } from "authentik-api";
 import { t } from "@lingui/macro";
-import { customElement, property } from "lit-element";
+import { customElement } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../api/Config";
-import { Form } from "../../elements/forms/Form";
 import { ifDefined } from "lit-html/directives/if-defined";
 import "../../elements/forms/HorizontalFormElement";
 import "../../elements/CodeMirror";
 import YAML from "yaml";
 import { first } from "../../utils";
+import { ModelForm } from "../../elements/forms/ModelForm";
 
 @customElement("ak-service-connection-kubernetes-form")
-export class ServiceConnectionKubernetesForm extends Form<KubernetesServiceConnection> {
+export class ServiceConnectionKubernetesForm extends ModelForm<KubernetesServiceConnection, string> {
 
-    set scUUID(value: string) {
-        new OutpostsApi(DEFAULT_CONFIG).outpostsServiceConnectionsKubernetesRead({
-            uuid: value,
-        }).then(sc => {
-            this.sc = sc;
+    loadInstance(pk: string): Promise<KubernetesServiceConnection> {
+        return new OutpostsApi(DEFAULT_CONFIG).outpostsServiceConnectionsKubernetesRead({
+            uuid: pk,
         });
     }
 
-    @property({attribute: false})
-    sc?: KubernetesServiceConnection;
-
     getSuccessMessage(): string {
-        if (this.sc) {
+        if (this.instance) {
             return t`Successfully updated service-connection.`;
         } else {
             return t`Successfully created service-connection.`;
@@ -33,9 +28,9 @@ export class ServiceConnectionKubernetesForm extends Form<KubernetesServiceConne
     }
 
     send = (data: KubernetesServiceConnection): Promise<KubernetesServiceConnection> => {
-        if (this.sc) {
+        if (this.instance) {
             return new OutpostsApi(DEFAULT_CONFIG).outpostsServiceConnectionsKubernetesUpdate({
-                uuid: this.sc.pk || "",
+                uuid: this.instance.pk || "",
                 data: data
             });
         } else {
@@ -51,11 +46,11 @@ export class ServiceConnectionKubernetesForm extends Form<KubernetesServiceConne
                 label=${t`Name`}
                 ?required=${true}
                 name="name">
-                <input type="text" value="${ifDefined(this.sc?.name)}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.name)}" class="pf-c-form-control" required>
             </ak-form-element-horizontal>
             <ak-form-element-horizontal name="local">
                 <div class="pf-c-check">
-                    <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.sc?.local, false)}>
+                    <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.instance?.local, false)}>
                     <label class="pf-c-check__label">
                         ${t`Local`}
                     </label>
@@ -65,7 +60,7 @@ export class ServiceConnectionKubernetesForm extends Form<KubernetesServiceConne
             <ak-form-element-horizontal
                 label=${t`Kubeconfig`}
                 name="kubeconfig">
-                <ak-codemirror mode="yaml" value="${YAML.stringify(first(this.sc?.kubeconfig, {}))}">
+                <ak-codemirror mode="yaml" value="${YAML.stringify(first(this.instance?.kubeconfig, {}))}">
                 </ak-codemirror>
                 <p class="pf-c-form__helper-text">${t`Set custom attributes using YAML or JSON.`}</p>
             </ak-form-element-horizontal>
diff --git a/web/src/pages/outposts/ServiceConnectionListPage.ts b/web/src/pages/outposts/ServiceConnectionListPage.ts
index 4a2def0fb..14232fb61 100644
--- a/web/src/pages/outposts/ServiceConnectionListPage.ts
+++ b/web/src/pages/outposts/ServiceConnectionListPage.ts
@@ -82,7 +82,7 @@ export class OutpostServiceConnectionListPage extends TablePage<ServiceConnectio
                 <ak-proxy-form
                     slot="form"
                     .args=${{
-                        "scUUID": item.pk
+                        "instancePk": item.pk
                     }}
                     type=${ifDefined(item.component)}>
                 </ak-proxy-form>
diff --git a/web/src/pages/policies/BoundPoliciesList.ts b/web/src/pages/policies/BoundPoliciesList.ts
index bf93ec5b5..2e6d90409 100644
--- a/web/src/pages/policies/BoundPoliciesList.ts
+++ b/web/src/pages/policies/BoundPoliciesList.ts
@@ -88,7 +88,7 @@ export class BoundPoliciesList extends Table<PolicyBinding> {
                 <span slot="header">
                     ${t`Update Group`}
                 </span>
-                <ak-group-form slot="form" .group=${item.groupObj}>
+                <ak-group-form slot="form" .instancePk=${item.groupObj?.pk}>
                 </ak-group-form>
                 <button slot="trigger" class="pf-c-button pf-m-secondary">
                     ${t`Edit Group`}
@@ -128,7 +128,7 @@ export class BoundPoliciesList extends Table<PolicyBinding> {
                 <span slot="header">
                     ${t`Update Binding`}
                 </span>
-                <ak-policy-binding-form slot="form" .binding=${item} targetPk=${ifDefined(this.target)} ?policyOnly=${this.policyOnly}>
+                <ak-policy-binding-form slot="form" .instancePk=${item.pk} targetPk=${ifDefined(this.target)} ?policyOnly=${this.policyOnly}>
                 </ak-policy-binding-form>
                 <button slot="trigger" class="pf-c-button pf-m-secondary">
                     ${t`Edit Binding`}
diff --git a/web/src/pages/policies/PolicyBindingForm.ts b/web/src/pages/policies/PolicyBindingForm.ts
index 834ed74e8..67fd9a702 100644
--- a/web/src/pages/policies/PolicyBindingForm.ts
+++ b/web/src/pages/policies/PolicyBindingForm.ts
@@ -3,41 +3,38 @@ import { t } from "@lingui/macro";
 import { css, CSSResult, customElement, property } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../api/Config";
-import { Form } from "../../elements/forms/Form";
 import { until } from "lit-html/directives/until";
 import { ifDefined } from "lit-html/directives/if-defined";
 import { first, groupBy } from "../../utils";
 import "../../elements/forms/HorizontalFormElement";
 import PFToggleGroup from "@patternfly/patternfly/components/ToggleGroup/toggle-group.css";
 import PFContent from "@patternfly/patternfly/components/Content/content.css";
+import { ModelForm } from "../../elements/forms/ModelForm";
 
 enum target {
     policy, group, user
 }
 
 @customElement("ak-policy-binding-form")
-export class PolicyBindingForm extends Form<PolicyBinding> {
+export class PolicyBindingForm extends ModelForm<PolicyBinding, string> {
 
-    @property({attribute: false})
-    set binding(value: PolicyBinding | undefined) {
-        this._binding = value;
-        if (value?.policyObj) {
-            this.policyGroupUser = target.policy;
-        }
-        if (value?.groupObj) {
-            this.policyGroupUser = target.group;
-        }
-        if (value?.userObj) {
-            this.policyGroupUser = target.user;
-        }
+    loadInstance(pk: string): Promise<PolicyBinding> {
+        return new PoliciesApi(DEFAULT_CONFIG).policiesBindingsRead({
+            policyBindingUuid: pk
+        }).then(binding => {
+            if (binding?.policyObj) {
+                this.policyGroupUser = target.policy;
+            }
+            if (binding?.groupObj) {
+                this.policyGroupUser = target.group;
+            }
+            if (binding?.userObj) {
+                this.policyGroupUser = target.user;
+            }
+            return binding;
+        });
     }
 
-    get binding(): PolicyBinding | undefined {
-        return this._binding;
-    }
-
-    _binding?: PolicyBinding;
-
     @property()
     targetPk?: string;
 
@@ -48,7 +45,7 @@ export class PolicyBindingForm extends Form<PolicyBinding> {
     policyOnly = false;
 
     getSuccessMessage(): string {
-        if (this.binding) {
+        if (this.instance) {
             return t`Successfully updated binding.`;
         } else {
             return t`Successfully created binding.`;
@@ -64,9 +61,9 @@ export class PolicyBindingForm extends Form<PolicyBinding> {
     }
 
     send = (data: PolicyBinding): Promise<PolicyBinding> => {
-        if (this.binding) {
+        if (this.instance) {
             return new PoliciesApi(DEFAULT_CONFIG).policiesBindingsUpdate({
-                policyBindingUuid: this.binding.pk || "",
+                policyBindingUuid: this.instance.pk || "",
                 data: data
             });
         } else {
@@ -81,7 +78,7 @@ export class PolicyBindingForm extends Form<PolicyBinding> {
             ${groupBy<Policy>(policies, (p => p.verboseName || "")).map(([group, policies]) => {
                 return html`<optgroup label=${group}>
                     ${policies.map(p => {
-                        const selected = (this.binding?.policy === p.pk);
+                        const selected = (this.instance?.policy === p.pk);
                         return html`<option ?selected=${selected} value=${ifDefined(p.pk)}>${p.name}</option>`;
                     })}
                 </optgroup>`;
@@ -90,8 +87,8 @@ export class PolicyBindingForm extends Form<PolicyBinding> {
     }
 
     getOrder(): Promise<number> {
-        if (this.binding) {
-            return Promise.resolve(this.binding.order);
+        if (this.instance) {
+            return Promise.resolve(this.instance.order);
         }
         return new PoliciesApi(DEFAULT_CONFIG).policiesBindingsList({
             target: this.targetPk || "",
@@ -154,7 +151,7 @@ export class PolicyBindingForm extends Form<PolicyBinding> {
                         name="policy"
                         ?hidden=${this.policyGroupUser !== target.policy}>
                         <select class="pf-c-form-control">
-                            <option value="" ?selected=${this.binding?.policy === undefined}>---------</option>
+                            <option value="" ?selected=${this.instance?.policy === undefined}>---------</option>
                             ${until(new PoliciesApi(DEFAULT_CONFIG).policiesAllList({
                                 ordering: "pk"
                             }).then(policies => {
@@ -167,12 +164,12 @@ export class PolicyBindingForm extends Form<PolicyBinding> {
                         name="group"
                         ?hidden=${this.policyGroupUser !== target.group}>
                         <select class="pf-c-form-control">
-                            <option value="" ?selected=${this.binding?.group === undefined}>---------</option>
+                            <option value="" ?selected=${this.instance?.group === undefined}>---------</option>
                             ${until(new CoreApi(DEFAULT_CONFIG).coreGroupsList({
                                 ordering: "pk"
                             }).then(groups => {
                                 return groups.results.map(group => {
-                                    return html`<option value=${ifDefined(group.pk)} ?selected=${group.pk === this.binding?.group}>${group.name}</option>`;
+                                    return html`<option value=${ifDefined(group.pk)} ?selected=${group.pk === this.instance?.group}>${group.name}</option>`;
                                 });
                             }), html`<option>${t`Loading...`}</option>`)}
                         </select>
@@ -182,22 +179,22 @@ export class PolicyBindingForm extends Form<PolicyBinding> {
                         name="user"
                         ?hidden=${this.policyGroupUser !== target.user}>
                         <select class="pf-c-form-control">
-                            <option value="" ?selected=${this.binding?.user === undefined}>---------</option>
+                            <option value="" ?selected=${this.instance?.user === undefined}>---------</option>
                             ${until(new CoreApi(DEFAULT_CONFIG).coreUsersList({
                                 ordering: "pk"
                             }).then(users => {
                                 return users.results.map(user => {
-                                    return html`<option value=${ifDefined(user.pk)} ?selected=${user.pk === this.binding?.user}>${user.name}</option>`;
+                                    return html`<option value=${ifDefined(user.pk)} ?selected=${user.pk === this.instance?.user}>${user.name}</option>`;
                                 });
                             }), html`<option>${t`Loading...`}</option>`)}
                         </select>
                     </ak-form-element-horizontal>
                 </div>
             </div>
-            <input required name="target" type="hidden" value=${ifDefined(this.binding?.target || this.targetPk)}>
+            <input required name="target" type="hidden" value=${ifDefined(this.instance?.target || this.targetPk)}>
             <ak-form-element-horizontal name="enabled">
                 <div class="pf-c-check">
-                    <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.binding?.enabled, true)}>
+                    <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.instance?.enabled, true)}>
                     <label class="pf-c-check__label">
                         ${t`Enabled`}
                     </label>
@@ -213,7 +210,7 @@ export class PolicyBindingForm extends Form<PolicyBinding> {
                 label=${t`Timeout`}
                 ?required=${true}
                 name="timeout">
-                <input type="number" value="${first(this.binding?.timeout, 30)}" class="pf-c-form-control" required>
+                <input type="number" value="${first(this.instance?.timeout, 30)}" class="pf-c-form-control" required>
             </ak-form-element-horizontal>
         </form>`;
     }
diff --git a/web/src/pages/policies/PolicyListPage.ts b/web/src/pages/policies/PolicyListPage.ts
index 69dc15ac0..3acf2f101 100644
--- a/web/src/pages/policies/PolicyListPage.ts
+++ b/web/src/pages/policies/PolicyListPage.ts
@@ -82,7 +82,7 @@ export class PolicyListPage extends TablePage<Policy> {
                 <ak-proxy-form
                     slot="form"
                     .args=${{
-                        "policyUUID": item.pk
+                        "instancePk": item.pk
                     }}
                     type=${ifDefined(item.component)}>
                 </ak-proxy-form>
diff --git a/web/src/pages/policies/dummy/DummyPolicyForm.ts b/web/src/pages/policies/dummy/DummyPolicyForm.ts
index 9caa2f07f..cef3bf67e 100644
--- a/web/src/pages/policies/dummy/DummyPolicyForm.ts
+++ b/web/src/pages/policies/dummy/DummyPolicyForm.ts
@@ -1,30 +1,25 @@
 import { DummyPolicy, PoliciesApi } from "authentik-api";
 import { t } from "@lingui/macro";
-import { customElement, property } from "lit-element";
+import { customElement } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../../api/Config";
-import { Form } from "../../../elements/forms/Form";
 import { ifDefined } from "lit-html/directives/if-defined";
 import "../../../elements/forms/HorizontalFormElement";
 import "../../../elements/forms/FormGroup";
 import { first } from "../../../utils";
+import { ModelForm } from "../../../elements/forms/ModelForm";
 
 @customElement("ak-policy-dummy-form")
-export class DummyPolicyForm extends Form<DummyPolicy> {
+export class DummyPolicyForm extends ModelForm<DummyPolicy, string> {
 
-    set policyUUID(value: string) {
-        new PoliciesApi(DEFAULT_CONFIG).policiesDummyRead({
-            policyUuid: value,
-        }).then(policy => {
-            this.policy = policy;
+    loadInstance(pk: string): Promise<DummyPolicy> {
+        return new PoliciesApi(DEFAULT_CONFIG).policiesDummyRead({
+            policyUuid: pk,
         });
     }
 
-    @property({attribute: false})
-    policy?: DummyPolicy;
-
     getSuccessMessage(): string {
-        if (this.policy) {
+        if (this.instance) {
             return t`Successfully updated policy.`;
         } else {
             return t`Successfully created policy.`;
@@ -32,9 +27,9 @@ export class DummyPolicyForm extends Form<DummyPolicy> {
     }
 
     send = (data: DummyPolicy): Promise<DummyPolicy> => {
-        if (this.policy) {
+        if (this.instance) {
             return new PoliciesApi(DEFAULT_CONFIG).policiesDummyUpdate({
-                policyUuid: this.policy.pk || "",
+                policyUuid: this.instance.pk || "",
                 data: data
             });
         } else {
@@ -53,11 +48,11 @@ export class DummyPolicyForm extends Form<DummyPolicy> {
                 label=${t`Name`}
                 ?required=${true}
                 name="name">
-                <input type="text" value="${ifDefined(this.policy?.name || "")}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.name || "")}" class="pf-c-form-control" required>
             </ak-form-element-horizontal>
             <ak-form-element-horizontal name="executionLogging">
                 <div class="pf-c-check">
-                    <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.policy?.executionLogging, false)}>
+                    <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.instance?.executionLogging, false)}>
                     <label class="pf-c-check__label">
                         ${t`Execution logging`}
                     </label>
@@ -73,7 +68,7 @@ export class DummyPolicyForm extends Form<DummyPolicy> {
                 <div slot="body" class="pf-c-form">
                     <ak-form-element-horizontal name="result">
                         <div class="pf-c-check">
-                            <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.policy?.result, false)}>
+                            <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.instance?.result, false)}>
                             <label class="pf-c-check__label">
                                 ${t`Pass policy?`}
                             </label>
@@ -83,14 +78,14 @@ export class DummyPolicyForm extends Form<DummyPolicy> {
                         label=${t`Wait (min)`}
                         ?required=${true}
                         name="waitMin">
-                        <input type="number" value="${first(this.policy?.waitMin, 1)}" class="pf-c-form-control" required>
+                        <input type="number" value="${first(this.instance?.waitMin, 1)}" class="pf-c-form-control" required>
                         <p class="pf-c-form__helper-text">${t`The policy takes a random time to execute. This controls the minimum time it will take.`}</p>
                     </ak-form-element-horizontal>
                     <ak-form-element-horizontal
                         label=${t`Wait (max)`}
                         ?required=${true}
                         name="waitMax">
-                        <input type="number" value="${first(this.policy?.waitMax, 5)}" class="pf-c-form-control" required>
+                        <input type="number" value="${first(this.instance?.waitMax, 5)}" class="pf-c-form-control" required>
                     </ak-form-element-horizontal>
                 </div>
             </ak-form-group>

From c99afe0ad4a2cc0016138063db2e652cd6e7a21e Mon Sep 17 00:00:00 2001
From: Jens Langhammer <jens.langhammer@beryju.org>
Date: Tue, 11 May 2021 12:12:31 +0200
Subject: [PATCH 05/10] web/admin: remove unused imports

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
---
 web/src/elements/forms/ModelForm.ts           |   6 +-
 web/src/locales/en.po                         | 846 +++++++++---------
 web/src/locales/pseudo-LOCALE.po              | 846 +++++++++---------
 web/src/pages/applications/ApplicationForm.ts |   1 -
 .../pages/applications/ApplicationViewPage.ts |   2 +-
 .../pages/crypto/CertificateKeyPairForm.ts    |   3 +-
 web/src/pages/events/RuleForm.ts              |   3 +-
 web/src/pages/events/TransportForm.ts         |   1 -
 web/src/pages/flows/FlowForm.ts               |   3 +-
 web/src/pages/flows/StageBindingForm.ts       |   1 -
 web/src/pages/groups/GroupForm.ts             |   3 +-
 web/src/pages/outposts/OutpostForm.ts         |   2 +-
 .../PropertyMappingLDAPForm.ts                |   2 +-
 .../PropertyMappingSAMLForm.ts                |   2 +-
 .../PropertyMappingScopeForm.ts               |   2 +-
 .../pages/providers/ldap/LDAPProviderForm.ts  |   2 +-
 .../pages/providers/saml/SAMLProviderForm.ts  |   4 +-
 web/src/pages/sources/plex/PlexSourceForm.ts  |   7 +-
 web/src/pages/sources/saml/SAMLSourceForm.ts  |   3 +-
 19 files changed, 890 insertions(+), 849 deletions(-)

diff --git a/web/src/elements/forms/ModelForm.ts b/web/src/elements/forms/ModelForm.ts
index e5fd7fdef..1294a4443 100644
--- a/web/src/elements/forms/ModelForm.ts
+++ b/web/src/elements/forms/ModelForm.ts
@@ -17,7 +17,11 @@ export abstract class ModelForm<T, PKT extends string | number> extends Form<T>
     private _instancePk?: PKT;
 
     @property({ attribute: false })
-    instance?: T;
+    instance?: T = this.defaultInstance;
+
+    get defaultInstance(): T | undefined {
+        return undefined;
+    }
 
     constructor() {
         super();
diff --git a/web/src/locales/en.po b/web/src/locales/en.po
index adde97f89..148947ed9 100644
--- a/web/src/locales/en.po
+++ b/web/src/locales/en.po
@@ -15,7 +15,7 @@ msgstr ""
 
 #: src/pages/providers/oauth2/OAuth2ProviderForm.ts:141
 #: src/pages/providers/oauth2/OAuth2ProviderForm.ts:149
-#: src/pages/providers/saml/SAMLProviderForm.ts:202
+#: src/pages/providers/saml/SAMLProviderForm.ts:201
 #: src/pages/stages/user_login/UserLoginStageForm.ts:71
 msgid "(Format: hours=-1;minutes=-2;seconds=-3)."
 msgstr "(Format: hours=-1;minutes=-2;seconds=-3)."
@@ -36,30 +36,30 @@ msgstr "8 digits, not compatible with apps like Google Authenticator"
 msgid "A newer version of the frontend is available."
 msgstr "A newer version of the frontend is available."
 
-#: src/pages/policies/dummy/DummyPolicyForm.ts:53
+#: src/pages/policies/dummy/DummyPolicyForm.ts:51
 msgid "A policy used for testing. Always returns the same result as specified below after waiting a random duration."
 msgstr "A policy used for testing. Always returns the same result as specified below after waiting a random duration."
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:82
+#: src/pages/providers/saml/SAMLProviderForm.ts:81
 #: src/pages/providers/saml/SAMLProviderViewPage.ts:84
 msgid "ACS URL"
 msgstr "ACS URL"
 
-#: src/pages/applications/ApplicationForm.ts:149
-#: src/pages/flows/FlowForm.ts:109
+#: src/pages/applications/ApplicationForm.ts:154
+#: src/pages/flows/FlowForm.ts:114
 msgid "ALL, all policies must match to grant access."
 msgstr "ALL, all policies must match to grant access."
 
-#: src/pages/flows/StageBindingForm.ts:144
+#: src/pages/flows/StageBindingForm.ts:149
 msgid "ALL, all policies must match to include this stage access."
 msgstr "ALL, all policies must match to include this stage access."
 
-#: src/pages/applications/ApplicationForm.ts:146
-#: src/pages/flows/FlowForm.ts:106
+#: src/pages/applications/ApplicationForm.ts:151
+#: src/pages/flows/FlowForm.ts:111
 msgid "ANY, any policy must match to grant access."
 msgstr "ANY, any policy must match to grant access."
 
-#: src/pages/flows/StageBindingForm.ts:141
+#: src/pages/flows/StageBindingForm.ts:146
 msgid "ANY, any policy must match to include this stage access."
 msgstr "ANY, any policy must match to include this stage access."
 
@@ -79,7 +79,7 @@ msgstr "Access Key"
 msgid "Access code validity"
 msgstr "Access code validity"
 
-#: src/pages/sources/oauth/OAuthSourceForm.ts:73
+#: src/pages/sources/oauth/OAuthSourceForm.ts:74
 msgid "Access token URL"
 msgstr "Access token URL"
 
@@ -100,31 +100,31 @@ msgstr "Active"
 msgid "Add"
 msgstr "Add"
 
-#: src/pages/sources/ldap/LDAPSourceForm.ts:202
+#: src/pages/sources/ldap/LDAPSourceForm.ts:200
 msgid "Addition Group DN"
 msgstr "Addition Group DN"
 
-#: src/pages/sources/ldap/LDAPSourceForm.ts:196
+#: src/pages/sources/ldap/LDAPSourceForm.ts:194
 msgid "Addition User DN"
 msgstr "Addition User DN"
 
-#: src/pages/sources/ldap/LDAPSourceForm.ts:205
+#: src/pages/sources/ldap/LDAPSourceForm.ts:203
 msgid "Additional group DN, prepended to the Base DN."
 msgstr "Additional group DN, prepended to the Base DN."
 
-#: src/pages/sources/ldap/LDAPSourceForm.ts:199
+#: src/pages/sources/ldap/LDAPSourceForm.ts:197
 msgid "Additional user DN, prepended to the Base DN."
 msgstr "Additional user DN, prepended to the Base DN."
 
 #: src/pages/providers/oauth2/OAuth2ProviderForm.ts:132
 #: src/pages/providers/proxy/ProxyProviderForm.ts:153
-#: src/pages/providers/saml/SAMLProviderForm.ts:117
-#: src/pages/sources/saml/SAMLSourceForm.ts:134
+#: src/pages/providers/saml/SAMLProviderForm.ts:116
+#: src/pages/sources/saml/SAMLSourceForm.ts:132
 msgid "Advanced protocol settings"
 msgstr "Advanced protocol settings"
 
 #: src/pages/policies/password/PasswordPolicyForm.ts:119
-#: src/pages/sources/ldap/LDAPSourceForm.ts:140
+#: src/pages/sources/ldap/LDAPSourceForm.ts:138
 msgid "Advanced settings"
 msgstr "Advanced settings"
 
@@ -132,7 +132,7 @@ msgstr "Advanced settings"
 msgid "Affected model:"
 msgstr "Affected model:"
 
-#: src/pages/events/RuleForm.ts:45
+#: src/pages/events/RuleForm.ts:50
 msgid "Alert"
 msgstr "Alert"
 
@@ -140,11 +140,11 @@ msgstr "Alert"
 msgid "Algorithm used to sign the JWT Tokens."
 msgstr "Algorithm used to sign the JWT Tokens."
 
-#: src/pages/sources/saml/SAMLSourceForm.ts:141
+#: src/pages/sources/saml/SAMLSourceForm.ts:139
 msgid "Allow IDP-initiated logins"
 msgstr "Allow IDP-initiated logins"
 
-#: src/pages/sources/plex/PlexSourceForm.ts:147
+#: src/pages/sources/plex/PlexSourceForm.ts:150
 msgid "Allow friends to authenticate via Plex, even if you don't share any servers"
 msgstr "Allow friends to authenticate via Plex, even if you don't share any servers"
 
@@ -160,11 +160,11 @@ msgstr "Allow users to use Applications based on properties, enforce Password Cr
 msgid "Allowed count"
 msgstr "Allowed count"
 
-#: src/pages/sources/plex/PlexSourceForm.ts:152
+#: src/pages/sources/plex/PlexSourceForm.ts:155
 msgid "Allowed servers"
 msgstr "Allowed servers"
 
-#: src/pages/sources/saml/SAMLSourceForm.ts:144
+#: src/pages/sources/saml/SAMLSourceForm.ts:142
 msgid "Allows authentication flows initiated by the IdP. This can be a security risk, as no validation of the request ID is done."
 msgstr "Allows authentication flows initiated by the IdP. This can be a security risk, as no validation of the request ID is done."
 
@@ -172,7 +172,7 @@ msgstr "Allows authentication flows initiated by the IdP. This can be a security
 msgid "Allows/denys requests based on the users and/or the IPs reputation."
 msgstr "Allows/denys requests based on the users and/or the IPs reputation."
 
-#: src/pages/sources/saml/SAMLSourceForm.ts:96
+#: src/pages/sources/saml/SAMLSourceForm.ts:94
 msgid "Also known as Entity ID. Defaults the Metadata URL."
 msgstr "Also known as Entity ID. Defaults the Metadata URL."
 
@@ -200,18 +200,17 @@ msgstr "Application Icon"
 msgid "Application requires following permissions"
 msgstr "Application requires following permissions"
 
-#: src/pages/applications/ApplicationForm.ts:90
+#: src/pages/applications/ApplicationForm.ts:95
 msgid "Application's display Name."
 msgstr "Application's display Name."
 
 #: src/interfaces/AdminInterface.ts:38
-#: src/pages/LibraryPage.ts:93
 #: src/pages/LibraryPage.ts:130
 #: src/pages/applications/ApplicationListPage.ts:28
 msgid "Applications"
 msgstr "Applications"
 
-#: src/pages/admin-overview/AdminOverviewPage.ts:105
+#: src/pages/admin-overview/AdminOverviewPage.ts:111
 msgid "Apps with most usage"
 msgstr "Apps with most usage"
 
@@ -223,15 +222,15 @@ msgstr "Are you sure you want to delete {0} {objName} ?"
 msgid "Are you sure you want to update {0} \"{1}\"?"
 msgstr "Are you sure you want to update {0} \"{1}\"?"
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:209
+#: src/pages/providers/saml/SAMLProviderForm.ts:208
 msgid "Assertion not valid on or after current time + this value (Format: hours=1;minutes=2;seconds=3)."
 msgstr "Assertion not valid on or after current time + this value (Format: hours=1;minutes=2;seconds=3)."
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:197
+#: src/pages/providers/saml/SAMLProviderForm.ts:196
 msgid "Assertion valid not before"
 msgstr "Assertion valid not before"
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:205
+#: src/pages/providers/saml/SAMLProviderForm.ts:204
 msgid "Assertion valid not on or after"
 msgstr "Assertion valid not on or after"
 
@@ -255,32 +254,32 @@ msgstr "Assigned to {0} objects."
 msgid "Attempted to log in as {0}"
 msgstr "Attempted to log in as {0}"
 
-#: src/pages/property-mappings/PropertyMappingSAMLForm.ts:63
+#: src/pages/property-mappings/PropertyMappingSAMLForm.ts:61
 msgid "Attribute name used for SAML Assertions. Can be a URN OID, a schema reference, or a any other string. If this property mapping is used for NameID Property, this field is discarded."
 msgstr "Attribute name used for SAML Assertions. Can be a URN OID, a schema reference, or a any other string. If this property mapping is used for NameID Property, this field is discarded."
 
-#: src/pages/groups/GroupForm.ts:134
+#: src/pages/groups/GroupForm.ts:139
 #: src/pages/stages/invitation/InvitationForm.ts:52
 #: src/pages/users/UserForm.ts:77
 msgid "Attributes"
 msgstr "Attributes"
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:108
+#: src/pages/providers/saml/SAMLProviderForm.ts:107
 #: src/pages/providers/saml/SAMLProviderViewPage.ts:92
 msgid "Audience"
 msgstr "Audience"
 
-#: src/flows/sources/plex/PlexLoginInit.ts:56
+#: src/flows/sources/plex/PlexLoginInit.ts:68
 msgid "Authenticating with Plex..."
 msgstr "Authenticating with Plex..."
 
-#: src/pages/flows/FlowForm.ts:55
+#: src/pages/flows/FlowForm.ts:60
 msgid "Authentication"
 msgstr "Authentication"
 
-#: src/pages/sources/oauth/OAuthSourceForm.ts:212
-#: src/pages/sources/plex/PlexSourceForm.ts:182
-#: src/pages/sources/saml/SAMLSourceForm.ts:245
+#: src/pages/sources/oauth/OAuthSourceForm.ts:231
+#: src/pages/sources/plex/PlexSourceForm.ts:185
+#: src/pages/sources/saml/SAMLSourceForm.ts:243
 msgid "Authentication flow"
 msgstr "Authentication flow"
 
@@ -289,7 +288,7 @@ msgstr "Authentication flow"
 msgid "Authenticator"
 msgstr "Authenticator"
 
-#: src/pages/flows/FlowForm.ts:58
+#: src/pages/flows/FlowForm.ts:63
 msgid "Authorization"
 msgstr "Authorization"
 
@@ -297,14 +296,14 @@ msgstr "Authorization"
 msgid "Authorization Code"
 msgstr "Authorization Code"
 
-#: src/pages/sources/oauth/OAuthSourceForm.ts:66
+#: src/pages/sources/oauth/OAuthSourceForm.ts:67
 #: src/pages/sources/oauth/OAuthSourceViewPage.ts:96
 msgid "Authorization URL"
 msgstr "Authorization URL"
 
 #: src/pages/providers/oauth2/OAuth2ProviderForm.ts:62
 #: src/pages/providers/proxy/ProxyProviderForm.ts:104
-#: src/pages/providers/saml/SAMLProviderForm.ts:59
+#: src/pages/providers/saml/SAMLProviderForm.ts:58
 #: src/pages/providers/saml/SAMLProviderImportForm.ts:44
 msgid "Authorization flow"
 msgstr "Authorization flow"
@@ -321,11 +320,11 @@ msgstr "Authorized application:"
 msgid "Backends"
 msgstr "Backends"
 
-#: src/pages/flows/FlowForm.ts:124
+#: src/pages/flows/FlowForm.ts:129
 msgid "Background"
 msgstr "Background"
 
-#: src/pages/flows/FlowForm.ts:127
+#: src/pages/flows/FlowForm.ts:132
 #: src/pages/flows/FlowImportForm.ts:37
 msgid "Background shown during execution."
 msgstr "Background shown during execution."
@@ -338,13 +337,13 @@ msgstr "Backup finished with errors."
 msgid "Backup finished with warnings."
 msgstr "Backup finished with warnings."
 
-#: src/pages/admin-overview/AdminOverviewPage.ts:84
+#: src/pages/admin-overview/AdminOverviewPage.ts:94
 msgid "Backup status"
 msgstr "Backup status"
 
-#: src/pages/providers/ldap/LDAPProviderForm.ts:97
+#: src/pages/providers/ldap/LDAPProviderForm.ts:95
 #: src/pages/providers/ldap/LDAPProviderViewPage.ts:82
-#: src/pages/sources/ldap/LDAPSourceForm.ts:131
+#: src/pages/sources/ldap/LDAPSourceForm.ts:129
 #: src/pages/sources/ldap/LDAPSourceViewPage.ts:80
 msgid "Base DN"
 msgstr "Base DN"
@@ -369,15 +368,15 @@ msgstr "Based on the username"
 msgid "Basic-Auth"
 msgstr "Basic-Auth"
 
-#: src/pages/sources/ldap/LDAPSourceForm.ts:118
+#: src/pages/sources/ldap/LDAPSourceForm.ts:116
 msgid "Bind CN"
 msgstr "Bind CN"
 
-#: src/pages/sources/ldap/LDAPSourceForm.ts:124
+#: src/pages/sources/ldap/LDAPSourceForm.ts:122
 msgid "Bind Password"
 msgstr "Bind Password"
 
-#: src/pages/providers/ldap/LDAPProviderForm.ts:60
+#: src/pages/providers/ldap/LDAPProviderForm.ts:58
 msgid "Bind flow"
 msgstr "Bind flow"
 
@@ -391,7 +390,7 @@ msgstr "Bind stage"
 msgid "Binding"
 msgstr "Binding"
 
-#: src/pages/sources/saml/SAMLSourceForm.ts:99
+#: src/pages/sources/saml/SAMLSourceForm.ts:97
 msgid "Binding Type"
 msgstr "Binding Type"
 
@@ -404,15 +403,15 @@ msgstr "Build hash: {0}"
 msgid "Built-in"
 msgstr "Built-in"
 
-#: src/pages/outposts/ServiceConnectionDockerForm.ts:88
+#: src/pages/outposts/ServiceConnectionDockerForm.ts:86
 msgid "CA which the endpoint's Certificate is verified against. Can be left empty for no validation."
 msgstr "CA which the endpoint's Certificate is verified against. Can be left empty for no validation."
 
-#: src/pages/admin-overview/graphs/FlowStatusCard.ts:54
+#: src/pages/admin-overview/charts/FlowStatusChart.ts:54
 msgid "Cached flows"
 msgstr "Cached flows"
 
-#: src/pages/admin-overview/graphs/PolicyStatusCard.ts:59
+#: src/pages/admin-overview/charts/PolicyStatusChart.ts:59
 msgid "Cached policies"
 msgstr "Cached policies"
 
@@ -420,7 +419,7 @@ msgstr "Cached policies"
 msgid "Callback URL"
 msgstr "Callback URL"
 
-#: src/pages/outposts/ServiceConnectionDockerForm.ts:72
+#: src/pages/outposts/ServiceConnectionDockerForm.ts:70
 msgid "Can be in the format of 'unix://' when connecting to a local docker daemon, or 'https://:2376' when connecting to a remote system."
 msgstr "Can be in the format of 'unix://' when connecting to a local docker daemon, or 'https://:2376' when connecting to a remote system."
 
@@ -436,7 +435,7 @@ msgstr "Cancel"
 msgid "Case insensitive matching"
 msgstr "Case insensitive matching"
 
-#: src/pages/crypto/CertificateKeyPairForm.ts:51
+#: src/pages/crypto/CertificateKeyPairForm.ts:56
 #: src/pages/providers/proxy/ProxyProviderForm.ts:157
 msgid "Certificate"
 msgstr "Certificate"
@@ -449,7 +448,7 @@ msgstr "Certificate Fingerprint"
 msgid "Certificate Subjet"
 msgstr "Certificate Subjet"
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:135
+#: src/pages/providers/saml/SAMLProviderForm.ts:134
 msgid "Certificate used to sign outgoing Responses going to the Service Provider."
 msgstr "Certificate used to sign outgoing Responses going to the Service Provider."
 
@@ -461,7 +460,7 @@ msgstr "Certificate-Key Pair"
 msgid "Certificate-Key Pairs"
 msgstr "Certificate-Key Pairs"
 
-#: src/pages/outposts/ServiceConnectionDockerForm.ts:104
+#: src/pages/outposts/ServiceConnectionDockerForm.ts:102
 msgid "Certificate/Key used for authentication. Can be left empty for no authentication."
 msgstr "Certificate/Key used for authentication. Can be left empty for no authentication."
 
@@ -537,7 +536,7 @@ msgstr "Click to copy token"
 
 #: src/pages/providers/oauth2/OAuth2ProviderForm.ts:107
 #: src/pages/providers/oauth2/OAuth2ProviderViewPage.ts:99
-#: src/pages/sources/plex/PlexSourceForm.ts:138
+#: src/pages/sources/plex/PlexSourceForm.ts:141
 msgid "Client ID"
 msgstr "Client ID"
 
@@ -601,7 +600,7 @@ msgstr "Configure how long access codes are valid for."
 msgid "Configure how long refresh tokens and their id_tokens are valid for."
 msgstr "Configure how long refresh tokens and their id_tokens are valid for."
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:193
+#: src/pages/providers/saml/SAMLProviderForm.ts:192
 msgid "Configure how the NameID value will be created. When left empty, the NameIDPolicy of the incoming request will be respected."
 msgstr "Configure how the NameID value will be created. When left empty, the NameIDPolicy of the incoming request will be respected."
 
@@ -613,7 +612,7 @@ msgstr "Configure how the issuer field of the ID Token should be filled."
 msgid "Configure settings relevant to your user profile."
 msgstr "Configure settings relevant to your user profile."
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:201
+#: src/pages/providers/saml/SAMLProviderForm.ts:200
 msgid "Configure the maximum allowed time drift for an asseration."
 msgstr "Configure the maximum allowed time drift for an asseration."
 
@@ -633,7 +632,7 @@ msgstr "Connected."
 msgid "Connection error, reconnecting..."
 msgstr "Connection error, reconnecting..."
 
-#: src/pages/sources/ldap/LDAPSourceForm.ts:100
+#: src/pages/sources/ldap/LDAPSourceForm.ts:98
 #: src/pages/stages/email/EmailStageForm.ts:58
 msgid "Connection settings"
 msgstr "Connection settings"
@@ -654,19 +653,19 @@ msgstr "Consent expires."
 msgid "Consent given last indefinitely"
 msgstr "Consent given last indefinitely"
 
-#: src/pages/sources/ldap/LDAPSourceForm.ts:219
+#: src/pages/sources/ldap/LDAPSourceForm.ts:217
 msgid "Consider Objects matching this filter to be Groups."
 msgstr "Consider Objects matching this filter to be Groups."
 
-#: src/pages/sources/ldap/LDAPSourceForm.ts:212
+#: src/pages/sources/ldap/LDAPSourceForm.ts:210
 msgid "Consider Objects matching this filter to be Users."
 msgstr "Consider Objects matching this filter to be Users."
 
-#: src/pages/sources/oauth/OAuthSourceForm.ts:148
+#: src/pages/sources/oauth/OAuthSourceForm.ts:167
 msgid "Consumer key"
 msgstr "Consumer key"
 
-#: src/pages/sources/oauth/OAuthSourceForm.ts:154
+#: src/pages/sources/oauth/OAuthSourceForm.ts:173
 msgid "Consumer secret"
 msgstr "Consumer secret"
 
@@ -707,7 +706,7 @@ msgstr "Copy"
 msgid "Copy Key"
 msgstr "Copy Key"
 
-#: src/pages/applications/ApplicationForm.ts:120
+#: src/pages/applications/ApplicationForm.ts:125
 #: src/pages/applications/ApplicationListPage.ts:121
 #: src/pages/applications/ApplicationListPage.ts:129
 #: src/pages/crypto/CertificateKeyPairListPage.ts:122
@@ -825,11 +824,11 @@ msgstr "Create Token"
 msgid "Create User"
 msgstr "Create User"
 
-#: src/pages/applications/ApplicationForm.ts:111
+#: src/pages/applications/ApplicationForm.ts:116
 msgid "Create provider"
 msgstr "Create provider"
 
-#: src/pages/applications/ApplicationForm.ts:123
+#: src/pages/applications/ApplicationForm.ts:128
 #: src/pages/flows/BoundStagesList.ts:149
 #: src/pages/outposts/ServiceConnectionListPage.ts:122
 #: src/pages/policies/BoundPoliciesList.ts:192
@@ -859,8 +858,8 @@ msgstr "Creation Date"
 msgid "Customisation"
 msgstr "Customisation"
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:256
-#: src/pages/sources/saml/SAMLSourceForm.ts:212
+#: src/pages/providers/saml/SAMLProviderForm.ts:255
+#: src/pages/sources/saml/SAMLSourceForm.ts:210
 msgid "DSA-SHA1"
 msgstr "DSA-SHA1"
 
@@ -872,7 +871,7 @@ msgstr "Date"
 msgid "Date Time"
 msgstr "Date Time"
 
-#: src/pages/flows/FlowForm.ts:121
+#: src/pages/flows/FlowForm.ts:126
 msgid "Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik."
 msgstr "Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik."
 
@@ -924,7 +923,7 @@ msgstr "Delete Refresh Code"
 msgid "Delete account"
 msgstr "Delete account"
 
-#: src/pages/sources/saml/SAMLSourceForm.ts:169
+#: src/pages/sources/saml/SAMLSourceForm.ts:167
 msgid "Delete temporary users after"
 msgstr "Delete temporary users after"
 
@@ -944,14 +943,14 @@ msgstr "Delete {0}"
 msgid "Deny the user access"
 msgstr "Deny the user access"
 
-#: src/pages/applications/ApplicationForm.ts:170
-#: src/pages/property-mappings/PropertyMappingScopeForm.ts:65
+#: src/pages/applications/ApplicationForm.ts:175
+#: src/pages/property-mappings/PropertyMappingScopeForm.ts:63
 #: src/pages/system-tasks/SystemTaskListPage.ts:55
 #: src/pages/user-settings/tokens/UserTokenForm.ts:50
 msgid "Description"
 msgstr "Description"
 
-#: src/pages/property-mappings/PropertyMappingScopeForm.ts:69
+#: src/pages/property-mappings/PropertyMappingScopeForm.ts:67
 msgid "Description shown to the user when consenting. If left empty, the user won't be informed."
 msgstr "Description shown to the user when consenting. If left empty, the user won't be informed."
 
@@ -959,12 +958,12 @@ msgstr "Description shown to the user when consenting. If left empty, the user w
 msgid "Designates whether this user should be treated as active. Unselect this instead of deleting accounts."
 msgstr "Designates whether this user should be treated as active. Unselect this instead of deleting accounts."
 
-#: src/pages/flows/FlowForm.ts:114
+#: src/pages/flows/FlowForm.ts:119
 #: src/pages/flows/FlowListPage.ts:48
 msgid "Designation"
 msgstr "Designation"
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:105
+#: src/pages/providers/saml/SAMLProviderForm.ts:104
 msgid "Determines how authentik sends the response back to the Service Provider."
 msgstr "Determines how authentik sends the response back to the Service Provider."
 
@@ -980,8 +979,8 @@ msgstr "Device classes which can be used to authenticate."
 msgid "Device name"
 msgstr "Device name"
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:220
-#: src/pages/sources/saml/SAMLSourceForm.ts:176
+#: src/pages/providers/saml/SAMLProviderForm.ts:219
+#: src/pages/sources/saml/SAMLSourceForm.ts:174
 msgid "Digest algorithm"
 msgstr "Digest algorithm"
 
@@ -1010,7 +1009,7 @@ msgstr "Disabled"
 msgid "Disconnect"
 msgstr "Disconnect"
 
-#: src/pages/outposts/ServiceConnectionDockerForm.ts:68
+#: src/pages/outposts/ServiceConnectionDockerForm.ts:66
 msgid "Docker URL"
 msgstr "Docker URL"
 
@@ -1083,7 +1082,7 @@ msgid "Either no applications are defined, or you don't have access to any."
 msgstr "Either no applications are defined, or you don't have access to any."
 
 #: src/flows/stages/identification/IdentificationStage.ts:146
-#: src/pages/events/TransportForm.ts:46
+#: src/pages/events/TransportForm.ts:51
 #: src/pages/stages/identification/IdentificationStageForm.ts:81
 #: src/pages/user-settings/UserDetailsPage.ts:71
 #: src/pages/users/UserForm.ts:61
@@ -1091,7 +1090,7 @@ msgstr "Either no applications are defined, or you don't have access to any."
 msgid "Email"
 msgstr "Email"
 
-#: src/pages/sources/saml/SAMLSourceForm.ts:155
+#: src/pages/sources/saml/SAMLSourceForm.ts:153
 msgid "Email address"
 msgstr "Email address"
 
@@ -1108,7 +1107,7 @@ msgstr "Email: Text field with Email type."
 msgid "Enable"
 msgstr "Enable"
 
-#: src/pages/sources/ldap/LDAPSourceForm.ts:113
+#: src/pages/sources/ldap/LDAPSourceForm.ts:111
 msgid "Enable StartTLS"
 msgstr "Enable StartTLS"
 
@@ -1129,21 +1128,21 @@ msgid "Enable this if you don't want to use this provider as a proxy, and want t
 msgstr "Enable this if you don't want to use this provider as a proxy, and want to use it with Traefik's forwardAuth or nginx's auth_request."
 
 #: src/pages/policies/BoundPoliciesList.ts:41
-#: src/pages/policies/PolicyBindingForm.ts:198
-#: src/pages/sources/ldap/LDAPSourceForm.ts:69
-#: src/pages/sources/oauth/OAuthSourceForm.ts:115
-#: src/pages/sources/plex/PlexSourceForm.ts:105
-#: src/pages/sources/saml/SAMLSourceForm.ts:69
+#: src/pages/policies/PolicyBindingForm.ts:199
+#: src/pages/sources/ldap/LDAPSourceForm.ts:67
+#: src/pages/sources/oauth/OAuthSourceForm.ts:134
+#: src/pages/sources/plex/PlexSourceForm.ts:108
+#: src/pages/sources/saml/SAMLSourceForm.ts:67
 msgid "Enabled"
 msgstr "Enabled"
 
-#: src/pages/flows/FlowForm.ts:61
+#: src/pages/flows/FlowForm.ts:66
 msgid "Enrollment"
 msgstr "Enrollment"
 
-#: src/pages/sources/oauth/OAuthSourceForm.ts:233
-#: src/pages/sources/plex/PlexSourceForm.ts:203
-#: src/pages/sources/saml/SAMLSourceForm.ts:266
+#: src/pages/sources/oauth/OAuthSourceForm.ts:252
+#: src/pages/sources/plex/PlexSourceForm.ts:206
+#: src/pages/sources/saml/SAMLSourceForm.ts:264
 #: src/pages/stages/identification/IdentificationStageForm.ts:106
 msgid "Enrollment flow"
 msgstr "Enrollment flow"
@@ -1176,15 +1175,15 @@ msgstr "Error: unsupported source settings: {0}"
 msgid "Error: unsupported stage settings: {0}"
 msgstr "Error: unsupported stage settings: {0}"
 
-#: src/pages/flows/StageBindingForm.ts:119
+#: src/pages/flows/StageBindingForm.ts:124
 msgid "Evaluate on plan"
 msgstr "Evaluate on plan"
 
-#: src/pages/flows/StageBindingForm.ts:133
+#: src/pages/flows/StageBindingForm.ts:138
 msgid "Evaluate policies before the Stage is present to the user."
 msgstr "Evaluate policies before the Stage is present to the user."
 
-#: src/pages/flows/StageBindingForm.ts:123
+#: src/pages/flows/StageBindingForm.ts:128
 msgid "Evaluate policies during the Flow planning process. Disable this for input-based policies. Should be used in conjunction with 'Re-evaluate policies', as with this option disabled, policies are **not** evaluated."
 msgstr "Evaluate policies during the Flow planning process. Disable this for input-based policies. Should be used in conjunction with 'Re-evaluate policies', as with this option disabled, policies are **not** evaluated."
 
@@ -1222,7 +1221,7 @@ msgstr "Execute flow"
 msgid "Executes the python snippet to determine whether to allow or deny a request."
 msgstr "Executes the python snippet to determine whether to allow or deny a request."
 
-#: src/pages/policies/dummy/DummyPolicyForm.ts:65
+#: src/pages/policies/dummy/DummyPolicyForm.ts:63
 #: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:66
 #: src/pages/policies/expiry/ExpiryPolicyForm.ts:65
 #: src/pages/policies/expression/ExpressionPolicyForm.ts:66
@@ -1267,16 +1266,16 @@ msgstr "Export"
 
 #: src/pages/events/EventInfo.ts:133
 #: src/pages/policies/expression/ExpressionPolicyForm.ts:79
-#: src/pages/property-mappings/PropertyMappingLDAPForm.ts:65
-#: src/pages/property-mappings/PropertyMappingSAMLForm.ts:75
-#: src/pages/property-mappings/PropertyMappingScopeForm.ts:72
+#: src/pages/property-mappings/PropertyMappingLDAPForm.ts:63
+#: src/pages/property-mappings/PropertyMappingSAMLForm.ts:73
+#: src/pages/property-mappings/PropertyMappingScopeForm.ts:70
 msgid "Expression"
 msgstr "Expression"
 
 #: src/pages/policies/expression/ExpressionPolicyForm.ts:85
-#: src/pages/property-mappings/PropertyMappingLDAPForm.ts:71
-#: src/pages/property-mappings/PropertyMappingSAMLForm.ts:81
-#: src/pages/property-mappings/PropertyMappingScopeForm.ts:78
+#: src/pages/property-mappings/PropertyMappingLDAPForm.ts:69
+#: src/pages/property-mappings/PropertyMappingSAMLForm.ts:79
+#: src/pages/property-mappings/PropertyMappingScopeForm.ts:76
 msgid "Expression using Python."
 msgstr "Expression using Python."
 
@@ -1296,7 +1295,7 @@ msgstr "External host"
 msgid "Failed attempts before cancel"
 msgstr "Failed attempts before cancel"
 
-#: src/pages/admin-overview/graphs/LDAPSyncStatusCard.ts:76
+#: src/pages/admin-overview/charts/LDAPSyncStatusChart.ts:76
 msgid "Failed sources"
 msgstr "Failed sources"
 
@@ -1321,15 +1320,15 @@ msgstr "Field Key"
 msgid "Field key to check, field keys defined in Prompt stages are available."
 msgstr "Field key to check, field keys defined in Prompt stages are available."
 
-#: src/pages/property-mappings/PropertyMappingLDAPForm.ts:62
+#: src/pages/property-mappings/PropertyMappingLDAPForm.ts:60
 msgid "Field of the user object this value is written to."
 msgstr "Field of the user object this value is written to."
 
-#: src/pages/sources/ldap/LDAPSourceForm.ts:233
+#: src/pages/sources/ldap/LDAPSourceForm.ts:231
 msgid "Field which contains a unique Identifier."
 msgstr "Field which contains a unique Identifier."
 
-#: src/pages/sources/ldap/LDAPSourceForm.ts:226
+#: src/pages/sources/ldap/LDAPSourceForm.ts:224
 msgid "Field which contains members of a group."
 msgstr "Field which contains members of a group."
 
@@ -1350,25 +1349,25 @@ msgstr "Flow"
 msgid "Flow Overview"
 msgstr "Flow Overview"
 
-#: src/pages/sources/oauth/OAuthSourceForm.ts:208
-#: src/pages/sources/plex/PlexSourceForm.ts:178
-#: src/pages/sources/saml/SAMLSourceForm.ts:220
+#: src/pages/sources/oauth/OAuthSourceForm.ts:227
+#: src/pages/sources/plex/PlexSourceForm.ts:181
+#: src/pages/sources/saml/SAMLSourceForm.ts:218
 msgid "Flow settings"
 msgstr "Flow settings"
 
-#: src/pages/sources/oauth/OAuthSourceForm.ts:230
-#: src/pages/sources/plex/PlexSourceForm.ts:200
-#: src/pages/sources/saml/SAMLSourceForm.ts:263
+#: src/pages/sources/oauth/OAuthSourceForm.ts:249
+#: src/pages/sources/plex/PlexSourceForm.ts:203
+#: src/pages/sources/saml/SAMLSourceForm.ts:261
 msgid "Flow to use when authenticating existing users."
 msgstr "Flow to use when authenticating existing users."
 
-#: src/pages/sources/oauth/OAuthSourceForm.ts:251
-#: src/pages/sources/plex/PlexSourceForm.ts:221
-#: src/pages/sources/saml/SAMLSourceForm.ts:284
+#: src/pages/sources/oauth/OAuthSourceForm.ts:270
+#: src/pages/sources/plex/PlexSourceForm.ts:224
+#: src/pages/sources/saml/SAMLSourceForm.ts:282
 msgid "Flow to use when enrolling new users."
 msgstr "Flow to use when enrolling new users."
 
-#: src/pages/sources/saml/SAMLSourceForm.ts:242
+#: src/pages/sources/saml/SAMLSourceForm.ts:240
 msgid "Flow used before authentication."
 msgstr "Flow used before authentication."
 
@@ -1381,13 +1380,13 @@ msgstr "Flow used by an authenticated user to configure their password. If empty
 msgid "Flow used by an authenticated user to configure this Stage. If empty, user will not be able to configure this stage."
 msgstr "Flow used by an authenticated user to configure this Stage. If empty, user will not be able to configure this stage."
 
-#: src/pages/providers/ldap/LDAPProviderForm.ts:74
+#: src/pages/providers/ldap/LDAPProviderForm.ts:72
 msgid "Flow used for users to authenticate. Currently only identification and password stages are supported."
 msgstr "Flow used for users to authenticate. Currently only identification and password stages are supported."
 
 #: src/pages/providers/oauth2/OAuth2ProviderForm.ts:76
 #: src/pages/providers/proxy/ProxyProviderForm.ts:118
-#: src/pages/providers/saml/SAMLProviderForm.ts:73
+#: src/pages/providers/saml/SAMLProviderForm.ts:72
 #: src/pages/providers/saml/SAMLProviderImportForm.ts:57
 msgid "Flow used when authorizing this provider."
 msgstr "Flow used when authorizing this provider."
@@ -1420,7 +1419,7 @@ msgstr "Forgot username or password?"
 msgid "Form didn't return a promise for submitting"
 msgstr "Form didn't return a promise for submitting"
 
-#: src/pages/property-mappings/PropertyMappingSAMLForm.ts:67
+#: src/pages/property-mappings/PropertyMappingSAMLForm.ts:65
 msgid "Friendly Name"
 msgstr "Friendly Name"
 
@@ -1449,23 +1448,23 @@ msgstr "Go to next page"
 msgid "Go to previous page"
 msgstr "Go to previous page"
 
-#: src/pages/events/RuleForm.ts:65
+#: src/pages/events/RuleForm.ts:70
 #: src/pages/groups/GroupListPage.ts:74
-#: src/pages/policies/PolicyBindingForm.ts:124
-#: src/pages/policies/PolicyBindingForm.ts:160
-#: src/pages/providers/ldap/LDAPProviderForm.ts:77
+#: src/pages/policies/PolicyBindingForm.ts:125
+#: src/pages/policies/PolicyBindingForm.ts:161
+#: src/pages/providers/ldap/LDAPProviderForm.ts:75
 msgid "Group"
 msgstr "Group"
 
-#: src/pages/sources/ldap/LDAPSourceForm.ts:170
+#: src/pages/sources/ldap/LDAPSourceForm.ts:168
 msgid "Group Property Mappings"
 msgstr "Group Property Mappings"
 
-#: src/pages/sources/ldap/LDAPSourceForm.ts:222
+#: src/pages/sources/ldap/LDAPSourceForm.ts:220
 msgid "Group membership field"
 msgstr "Group membership field"
 
-#: src/pages/sources/ldap/LDAPSourceForm.ts:215
+#: src/pages/sources/ldap/LDAPSourceForm.ts:213
 msgid "Group object filter"
 msgstr "Group object filter"
 
@@ -1478,6 +1477,7 @@ msgid "Group {0}"
 msgstr "Group {0}"
 
 #: src/interfaces/AdminInterface.ts:103
+#: src/pages/admin-overview/AdminOverviewPage.ts:76
 #: src/pages/groups/GroupListPage.ts:27
 msgid "Groups"
 msgstr "Groups"
@@ -1498,11 +1498,11 @@ msgstr "HTTP-Basic Username Key"
 msgid "Health and Version"
 msgstr "Health and Version"
 
-#: src/pages/admin-overview/graphs/OutpostStatusCard.ts:70
+#: src/pages/admin-overview/charts/OutpostStatusChart.ts:70
 msgid "Healthy outposts"
 msgstr "Healthy outposts"
 
-#: src/pages/admin-overview/graphs/LDAPSyncStatusCard.ts:75
+#: src/pages/admin-overview/charts/LDAPSyncStatusChart.ts:75
 msgid "Healthy sources"
 msgstr "Healthy sources"
 
@@ -1518,14 +1518,14 @@ msgstr "Hide managed mappings"
 msgid "Hide service-accounts"
 msgstr "Hide service-accounts"
 
-#: src/pages/events/RuleForm.ts:93
-#: src/pages/groups/GroupForm.ts:131
-#: src/pages/outposts/OutpostForm.ts:110
+#: src/pages/events/RuleForm.ts:98
+#: src/pages/groups/GroupForm.ts:136
+#: src/pages/outposts/OutpostForm.ts:115
 #: src/pages/providers/oauth2/OAuth2ProviderForm.ts:188
-#: src/pages/providers/saml/SAMLProviderForm.ts:177
-#: src/pages/sources/ldap/LDAPSourceForm.ts:167
-#: src/pages/sources/ldap/LDAPSourceForm.ts:193
-#: src/pages/sources/plex/PlexSourceForm.ts:165
+#: src/pages/providers/saml/SAMLProviderForm.ts:176
+#: src/pages/sources/ldap/LDAPSourceForm.ts:165
+#: src/pages/sources/ldap/LDAPSourceForm.ts:191
+#: src/pages/sources/plex/PlexSourceForm.ts:168
 #: src/pages/stages/authenticator_validate/AuthenticatorValidateStageForm.ts:114
 #: src/pages/stages/identification/IdentificationStageForm.ts:85
 #: src/pages/stages/password/PasswordStageForm.ts:86
@@ -1542,7 +1542,7 @@ msgstr "How many attempts a user has before the flow is canceled. To lock the us
 msgid "ID"
 msgstr "ID"
 
-#: src/pages/applications/ApplicationForm.ts:165
+#: src/pages/applications/ApplicationForm.ts:170
 msgid "Icon"
 msgstr "Icon"
 
@@ -1558,12 +1558,12 @@ msgstr "Identifier"
 msgid "Identity & Cryptography"
 msgstr "Identity & Cryptography"
 
-#: src/pages/outposts/ServiceConnectionDockerForm.ts:65
-#: src/pages/outposts/ServiceConnectionKubernetesForm.ts:66
+#: src/pages/outposts/ServiceConnectionDockerForm.ts:63
+#: src/pages/outposts/ServiceConnectionKubernetesForm.ts:64
 msgid "If enabled, use the local connection. Required Docker socket/Kubernetes Integration."
 msgstr "If enabled, use the local connection. Required Docker socket/Kubernetes Integration."
 
-#: src/pages/applications/ApplicationForm.ts:162
+#: src/pages/applications/ApplicationForm.ts:167
 msgid "If left empty, authentik will try to extract the launch URL based on the selected provider."
 msgstr "If left empty, authentik will try to extract the launch URL based on the selected provider."
 
@@ -1608,7 +1608,7 @@ msgstr "Include claims in id_token"
 msgid "Internal Host"
 msgstr "Internal Host"
 
-#: src/pages/applications/ApplicationForm.ts:97
+#: src/pages/applications/ApplicationForm.ts:102
 msgid "Internal application name, used in URLs."
 msgstr "Internal application name, used in URLs."
 
@@ -1620,7 +1620,7 @@ msgstr "Internal host"
 msgid "Internal host SSL Validation"
 msgstr "Internal host SSL Validation"
 
-#: src/pages/flows/FlowForm.ts:64
+#: src/pages/flows/FlowForm.ts:69
 msgid "Invalidation"
 msgstr "Invalidation"
 
@@ -1633,13 +1633,13 @@ msgstr "Invitations"
 msgid "Is active"
 msgstr "Is active"
 
-#: src/pages/groups/GroupForm.ts:62
+#: src/pages/groups/GroupForm.ts:67
 msgid "Is superuser"
 msgstr "Is superuser"
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:88
+#: src/pages/providers/saml/SAMLProviderForm.ts:87
 #: src/pages/providers/saml/SAMLProviderViewPage.ts:100
-#: src/pages/sources/saml/SAMLSourceForm.ts:93
+#: src/pages/sources/saml/SAMLSourceForm.ts:91
 #: src/pages/sources/saml/SAMLSourceViewPage.ts:90
 msgid "Issuer"
 msgstr "Issuer"
@@ -1656,23 +1656,23 @@ msgstr "JWT Algorithm"
 msgid "Key used to sign the tokens. Only required when JWT Algorithm is set to RS256."
 msgstr "Key used to sign the tokens. Only required when JWT Algorithm is set to RS256."
 
-#: src/pages/sources/saml/SAMLSourceForm.ts:128
+#: src/pages/sources/saml/SAMLSourceForm.ts:126
 msgid "Keypair which is used to sign outgoing requests. Leave empty to disable signing."
 msgstr "Keypair which is used to sign outgoing requests. Leave empty to disable signing."
 
-#: src/pages/outposts/ServiceConnectionKubernetesForm.ts:69
+#: src/pages/outposts/ServiceConnectionKubernetesForm.ts:67
 msgid "Kubeconfig"
 msgstr "Kubeconfig"
 
-#: src/pages/outposts/OutpostForm.ts:58
+#: src/pages/outposts/OutpostForm.ts:63
 msgid "LDAP (Technical preview)"
 msgstr "LDAP (Technical preview)"
 
-#: src/pages/providers/ldap/LDAPProviderForm.ts:101
+#: src/pages/providers/ldap/LDAPProviderForm.ts:99
 msgid "LDAP DN under which bind requests and search requests can be made."
 msgstr "LDAP DN under which bind requests and search requests can be made."
 
-#: src/pages/admin-overview/AdminOverviewPage.ts:66
+#: src/pages/admin-overview/AdminOverviewPage.ts:81
 msgid "LDAP Sync status"
 msgstr "LDAP Sync status"
 
@@ -1708,7 +1708,7 @@ msgstr "Last sync: {0}"
 msgid "Launch"
 msgstr "Launch"
 
-#: src/pages/applications/ApplicationForm.ts:159
+#: src/pages/applications/ApplicationForm.ts:164
 msgid "Launch URL"
 msgstr "Launch URL"
 
@@ -1720,22 +1720,22 @@ msgstr "Let the user identify themselves with their username or Email address."
 msgid "Library"
 msgstr "Library"
 
-#: src/pages/sources/oauth/OAuthSourceForm.ts:128
-#: src/pages/sources/plex/PlexSourceForm.ts:118
+#: src/pages/sources/oauth/OAuthSourceForm.ts:147
+#: src/pages/sources/plex/PlexSourceForm.ts:121
 msgid "Link to a user with identical email address. Can have security implications when a source doesn't validate email addresses"
 msgstr "Link to a user with identical email address. Can have security implications when a source doesn't validate email addresses"
 
-#: src/pages/sources/oauth/OAuthSourceForm.ts:134
-#: src/pages/sources/plex/PlexSourceForm.ts:124
+#: src/pages/sources/oauth/OAuthSourceForm.ts:153
+#: src/pages/sources/plex/PlexSourceForm.ts:127
 msgid "Link to a user with identical username address. Can have security implications when a username is used with another source."
 msgstr "Link to a user with identical username address. Can have security implications when a username is used with another source."
 
-#: src/pages/sources/oauth/OAuthSourceForm.ts:125
-#: src/pages/sources/plex/PlexSourceForm.ts:115
+#: src/pages/sources/oauth/OAuthSourceForm.ts:144
+#: src/pages/sources/plex/PlexSourceForm.ts:118
 msgid "Link users on unique identifier"
 msgstr "Link users on unique identifier"
 
-#: src/pages/sources/plex/PlexSourceForm.ts:170
+#: src/pages/sources/plex/PlexSourceForm.ts:173
 msgid "Load servers"
 msgstr "Load servers"
 
@@ -1763,49 +1763,49 @@ msgid "Loading"
 msgstr "Loading"
 
 #: src/elements/Spinner.ts:29
-#: src/pages/applications/ApplicationForm.ts:106
-#: src/pages/events/RuleForm.ts:74
-#: src/pages/events/RuleForm.ts:90
-#: src/pages/flows/StageBindingForm.ts:89
-#: src/pages/flows/StageBindingForm.ts:106
-#: src/pages/groups/GroupForm.ts:77
-#: src/pages/groups/GroupForm.ts:127
-#: src/pages/outposts/OutpostForm.ts:75
-#: src/pages/outposts/OutpostForm.ts:97
-#: src/pages/outposts/OutpostForm.ts:108
-#: src/pages/outposts/ServiceConnectionDockerForm.ts:86
-#: src/pages/outposts/ServiceConnectionDockerForm.ts:102
-#: src/pages/policies/PolicyBindingForm.ts:156
-#: src/pages/policies/PolicyBindingForm.ts:172
-#: src/pages/policies/PolicyBindingForm.ts:188
+#: src/pages/applications/ApplicationForm.ts:111
+#: src/pages/events/RuleForm.ts:79
+#: src/pages/events/RuleForm.ts:95
+#: src/pages/flows/StageBindingForm.ts:94
+#: src/pages/flows/StageBindingForm.ts:111
+#: src/pages/groups/GroupForm.ts:82
+#: src/pages/groups/GroupForm.ts:132
+#: src/pages/outposts/OutpostForm.ts:80
+#: src/pages/outposts/OutpostForm.ts:102
+#: src/pages/outposts/OutpostForm.ts:113
+#: src/pages/outposts/ServiceConnectionDockerForm.ts:84
+#: src/pages/outposts/ServiceConnectionDockerForm.ts:100
+#: src/pages/policies/PolicyBindingForm.ts:157
+#: src/pages/policies/PolicyBindingForm.ts:173
+#: src/pages/policies/PolicyBindingForm.ts:189
 #: src/pages/policies/PolicyTestForm.ts:71
 #: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:88
 #: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:108
 #: src/pages/property-mappings/PropertyMappingTestForm.ts:61
-#: src/pages/providers/ldap/LDAPProviderForm.ts:72
-#: src/pages/providers/ldap/LDAPProviderForm.ts:86
+#: src/pages/providers/ldap/LDAPProviderForm.ts:70
+#: src/pages/providers/ldap/LDAPProviderForm.ts:84
 #: src/pages/providers/oauth2/OAuth2ProviderForm.ts:74
 #: src/pages/providers/oauth2/OAuth2ProviderForm.ts:185
 #: src/pages/providers/oauth2/OAuth2ProviderForm.ts:207
 #: src/pages/providers/proxy/ProxyProviderForm.ts:116
 #: src/pages/providers/proxy/ProxyProviderForm.ts:168
-#: src/pages/providers/saml/SAMLProviderForm.ts:71
-#: src/pages/providers/saml/SAMLProviderForm.ts:133
-#: src/pages/providers/saml/SAMLProviderForm.ts:149
-#: src/pages/providers/saml/SAMLProviderForm.ts:175
-#: src/pages/providers/saml/SAMLProviderForm.ts:191
+#: src/pages/providers/saml/SAMLProviderForm.ts:70
+#: src/pages/providers/saml/SAMLProviderForm.ts:132
+#: src/pages/providers/saml/SAMLProviderForm.ts:148
+#: src/pages/providers/saml/SAMLProviderForm.ts:174
+#: src/pages/providers/saml/SAMLProviderForm.ts:190
 #: src/pages/providers/saml/SAMLProviderImportForm.ts:55
-#: src/pages/sources/ldap/LDAPSourceForm.ts:164
-#: src/pages/sources/ldap/LDAPSourceForm.ts:190
-#: src/pages/sources/oauth/OAuthSourceForm.ts:200
-#: src/pages/sources/oauth/OAuthSourceForm.ts:228
-#: src/pages/sources/oauth/OAuthSourceForm.ts:249
-#: src/pages/sources/plex/PlexSourceForm.ts:198
-#: src/pages/sources/plex/PlexSourceForm.ts:219
-#: src/pages/sources/saml/SAMLSourceForm.ts:126
-#: src/pages/sources/saml/SAMLSourceForm.ts:240
-#: src/pages/sources/saml/SAMLSourceForm.ts:261
-#: src/pages/sources/saml/SAMLSourceForm.ts:282
+#: src/pages/sources/ldap/LDAPSourceForm.ts:162
+#: src/pages/sources/ldap/LDAPSourceForm.ts:188
+#: src/pages/sources/oauth/OAuthSourceForm.ts:219
+#: src/pages/sources/oauth/OAuthSourceForm.ts:247
+#: src/pages/sources/oauth/OAuthSourceForm.ts:268
+#: src/pages/sources/plex/PlexSourceForm.ts:201
+#: src/pages/sources/plex/PlexSourceForm.ts:222
+#: src/pages/sources/saml/SAMLSourceForm.ts:124
+#: src/pages/sources/saml/SAMLSourceForm.ts:238
+#: src/pages/sources/saml/SAMLSourceForm.ts:259
+#: src/pages/sources/saml/SAMLSourceForm.ts:280
 #: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts:90
 #: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts:96
 #: src/pages/stages/authenticator_validate/AuthenticatorValidateStageForm.ts:131
@@ -1818,8 +1818,8 @@ msgstr "Loading"
 msgid "Loading..."
 msgstr "Loading..."
 
-#: src/pages/outposts/ServiceConnectionDockerForm.ts:62
-#: src/pages/outposts/ServiceConnectionKubernetesForm.ts:63
+#: src/pages/outposts/ServiceConnectionDockerForm.ts:60
+#: src/pages/outposts/ServiceConnectionKubernetesForm.ts:61
 #: src/pages/outposts/ServiceConnectionListPage.ts:55
 msgid "Local"
 msgstr "Local"
@@ -1828,7 +1828,7 @@ msgstr "Local"
 msgid "Log the currently pending user in."
 msgstr "Log the currently pending user in."
 
-#: src/pages/sources/ldap/LDAPSourceForm.ts:88
+#: src/pages/sources/ldap/LDAPSourceForm.ts:86
 msgid "Login password is synced from LDAP into authentik automatically. Enable this option only to write password changes in authentik back to LDAP."
 msgstr "Login password is synced from LDAP into authentik automatically. Enable this option only to write password changes in authentik back to LDAP."
 
@@ -1840,7 +1840,7 @@ msgstr "Login to continue to {0}."
 msgid "Logins"
 msgstr "Logins"
 
-#: src/pages/admin-overview/AdminOverviewPage.ts:100
+#: src/pages/admin-overview/AdminOverviewPage.ts:106
 #: src/pages/applications/ApplicationViewPage.ts:128
 msgid "Logins over the last 24 hours"
 msgstr "Logins over the last 24 hours"
@@ -1877,7 +1877,7 @@ msgstr "Matches an event against a set of criteria. If any of the configured val
 msgid "Maximum age (in days)"
 msgstr "Maximum age (in days)"
 
-#: src/pages/groups/GroupForm.ts:81
+#: src/pages/groups/GroupForm.ts:86
 #: src/pages/groups/GroupListPage.ts:47
 msgid "Members"
 msgstr "Members"
@@ -1911,7 +1911,7 @@ msgstr "Minimum amount of Uppercase Characters"
 msgid "Minimum length"
 msgstr "Minimum length"
 
-#: src/pages/events/TransportForm.ts:79
+#: src/pages/events/TransportForm.ts:84
 #: src/pages/events/TransportListPage.ts:47
 #: src/pages/stages/consent/ConsentStageForm.ts:68
 msgid "Mode"
@@ -1925,56 +1925,60 @@ msgstr "Model Name"
 msgid "Monitor"
 msgstr "Monitor"
 
-#: src/pages/applications/ApplicationForm.ts:86
+#: src/pages/LibraryPage.ts:93
+msgid "My Applications"
+msgstr "My Applications"
+
+#: src/pages/applications/ApplicationForm.ts:91
 #: src/pages/applications/ApplicationListPage.ts:58
-#: src/pages/crypto/CertificateKeyPairForm.ts:45
+#: src/pages/crypto/CertificateKeyPairForm.ts:50
 #: src/pages/crypto/CertificateKeyPairListPage.ts:51
 #: src/pages/events/EventInfo.ts:51
-#: src/pages/events/RuleForm.ts:59
+#: src/pages/events/RuleForm.ts:64
 #: src/pages/events/RuleListPage.ts:47
-#: src/pages/events/TransportForm.ts:73
+#: src/pages/events/TransportForm.ts:78
 #: src/pages/events/TransportListPage.ts:46
 #: src/pages/flows/BoundStagesList.ts:39
-#: src/pages/flows/FlowForm.ts:81
+#: src/pages/flows/FlowForm.ts:86
 #: src/pages/flows/FlowListPage.ts:47
-#: src/pages/groups/GroupForm.ts:53
+#: src/pages/groups/GroupForm.ts:58
 #: src/pages/groups/GroupListPage.ts:45
 #: src/pages/groups/MemberSelectModal.ts:45
-#: src/pages/outposts/OutpostForm.ts:47
+#: src/pages/outposts/OutpostForm.ts:52
 #: src/pages/outposts/OutpostListPage.ts:50
-#: src/pages/outposts/ServiceConnectionDockerForm.ts:53
-#: src/pages/outposts/ServiceConnectionKubernetesForm.ts:54
+#: src/pages/outposts/ServiceConnectionDockerForm.ts:51
+#: src/pages/outposts/ServiceConnectionKubernetesForm.ts:52
 #: src/pages/outposts/ServiceConnectionListPage.ts:53
 #: src/pages/policies/PolicyListPage.ts:56
-#: src/pages/policies/dummy/DummyPolicyForm.ts:56
+#: src/pages/policies/dummy/DummyPolicyForm.ts:54
 #: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:57
 #: src/pages/policies/expiry/ExpiryPolicyForm.ts:56
 #: src/pages/policies/expression/ExpressionPolicyForm.ts:57
 #: src/pages/policies/hibp/HaveIBeenPwnedPolicyForm.ts:57
 #: src/pages/policies/password/PasswordPolicyForm.ts:56
 #: src/pages/policies/reputation/ReputationPolicyForm.ts:56
-#: src/pages/property-mappings/PropertyMappingLDAPForm.ts:52
+#: src/pages/property-mappings/PropertyMappingLDAPForm.ts:50
 #: src/pages/property-mappings/PropertyMappingListPage.ts:54
-#: src/pages/property-mappings/PropertyMappingSAMLForm.ts:52
-#: src/pages/property-mappings/PropertyMappingScopeForm.ts:52
+#: src/pages/property-mappings/PropertyMappingSAMLForm.ts:50
+#: src/pages/property-mappings/PropertyMappingScopeForm.ts:50
 #: src/pages/providers/ProviderListPage.ts:53
-#: src/pages/providers/ldap/LDAPProviderForm.ts:54
+#: src/pages/providers/ldap/LDAPProviderForm.ts:52
 #: src/pages/providers/ldap/LDAPProviderViewPage.ts:64
 #: src/pages/providers/oauth2/OAuth2ProviderForm.ts:56
 #: src/pages/providers/oauth2/OAuth2ProviderViewPage.ts:73
 #: src/pages/providers/proxy/ProxyProviderForm.ts:98
 #: src/pages/providers/proxy/ProxyProviderViewPage.ts:64
-#: src/pages/providers/saml/SAMLProviderForm.ts:53
+#: src/pages/providers/saml/SAMLProviderForm.ts:52
 #: src/pages/providers/saml/SAMLProviderImportForm.ts:38
 #: src/pages/providers/saml/SAMLProviderViewPage.ts:66
 #: src/pages/sources/SourcesListPage.ts:52
-#: src/pages/sources/ldap/LDAPSourceForm.ts:54
+#: src/pages/sources/ldap/LDAPSourceForm.ts:52
 #: src/pages/sources/ldap/LDAPSourceViewPage.ts:64
-#: src/pages/sources/oauth/OAuthSourceForm.ts:100
+#: src/pages/sources/oauth/OAuthSourceForm.ts:108
 #: src/pages/sources/oauth/OAuthSourceViewPage.ts:64
-#: src/pages/sources/plex/PlexSourceForm.ts:90
+#: src/pages/sources/plex/PlexSourceForm.ts:93
 #: src/pages/sources/plex/PlexSourceViewPage.ts:63
-#: src/pages/sources/saml/SAMLSourceForm.ts:54
+#: src/pages/sources/saml/SAMLSourceForm.ts:52
 #: src/pages/sources/saml/SAMLSourceViewPage.ts:66
 #: src/pages/stages/StageListPage.ts:65
 #: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts:57
@@ -2005,11 +2009,11 @@ msgstr "Name"
 msgid "Name of the form field, also used to store the value."
 msgstr "Name of the form field, also used to store the value."
 
-#: src/pages/sources/saml/SAMLSourceForm.ts:147
+#: src/pages/sources/saml/SAMLSourceForm.ts:145
 msgid "NameID Policy"
 msgstr "NameID Policy"
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:180
+#: src/pages/providers/saml/SAMLProviderForm.ts:179
 msgid "NameID Property Mapping"
 msgstr "NameID Property Mapping"
 
@@ -2117,7 +2121,7 @@ msgstr "Not synced yet."
 msgid "Not you?"
 msgstr "Not you?"
 
-#: src/pages/events/RuleForm.ts:51
+#: src/pages/events/RuleForm.ts:56
 msgid "Notice"
 msgstr "Notice"
 
@@ -2160,11 +2164,11 @@ msgstr "OAuth Refresh Codes"
 msgid "Object"
 msgstr "Object"
 
-#: src/pages/property-mappings/PropertyMappingLDAPForm.ts:58
+#: src/pages/property-mappings/PropertyMappingLDAPForm.ts:56
 msgid "Object field"
 msgstr "Object field"
 
-#: src/pages/sources/ldap/LDAPSourceForm.ts:229
+#: src/pages/sources/ldap/LDAPSourceForm.ts:227
 msgid "Object uniqueness field"
 msgstr "Object uniqueness field"
 
@@ -2182,7 +2186,7 @@ msgstr "On behalf of {0}"
 msgid "Only fail the policy, don't invalidate user's password."
 msgstr "Only fail the policy, don't invalidate user's password."
 
-#: src/pages/events/TransportForm.ts:102
+#: src/pages/events/TransportForm.ts:107
 msgid "Only send notification once, for example when sending a webhook into a chat channel."
 msgstr "Only send notification once, for example when sending a webhook into a chat channel."
 
@@ -2198,11 +2202,11 @@ msgstr "OpenID Configuration Issuer"
 msgid "OpenID Configuration URL"
 msgstr "OpenID Configuration URL"
 
-#: src/pages/crypto/CertificateKeyPairForm.ts:63
+#: src/pages/crypto/CertificateKeyPairForm.ts:68
 msgid "Optional Private Key. If this is set, you can use this keypair for encryption."
 msgstr "Optional Private Key. If this is set, you can use this keypair for encryption."
 
-#: src/pages/sources/saml/SAMLSourceForm.ts:90
+#: src/pages/sources/saml/SAMLSourceForm.ts:88
 msgid "Optional URL if the IDP supports Single-Logout."
 msgstr "Optional URL if the IDP supports Single-Logout."
 
@@ -2226,20 +2230,20 @@ msgstr "Optional, comma-separated SubjectAlt Names."
 msgid "Optionally pre-fill the input value"
 msgstr "Optionally pre-fill the input value"
 
-#: src/pages/property-mappings/PropertyMappingSAMLForm.ts:71
+#: src/pages/property-mappings/PropertyMappingSAMLForm.ts:69
 msgid "Optionally set the 'FriendlyName' value of the Assertion attribute."
 msgstr "Optionally set the 'FriendlyName' value of the Assertion attribute."
 
 #: src/pages/flows/BoundStagesList.ts:38
-#: src/pages/flows/StageBindingForm.ts:110
+#: src/pages/flows/StageBindingForm.ts:115
 #: src/pages/policies/BoundPoliciesList.ts:42
-#: src/pages/policies/PolicyBindingForm.ts:203
+#: src/pages/policies/PolicyBindingForm.ts:204
 #: src/pages/stages/prompt/PromptForm.ts:119
 #: src/pages/stages/prompt/PromptListPage.ts:49
 msgid "Order"
 msgstr "Order"
 
-#: src/pages/admin-overview/graphs/OutpostStatusCard.ts:71
+#: src/pages/admin-overview/charts/OutpostStatusChart.ts:71
 msgid "Outdated outposts"
 msgstr "Outdated outposts"
 
@@ -2255,7 +2259,7 @@ msgstr "Outpost Deployment Info"
 msgid "Outpost Service-connection"
 msgstr "Outpost Service-connection"
 
-#: src/pages/admin-overview/AdminOverviewPage.ts:71
+#: src/pages/admin-overview/AdminOverviewPage.ts:66
 msgid "Outpost status"
 msgstr "Outpost status"
 
@@ -2283,16 +2287,16 @@ msgstr "Outposts are deployments of authentik components to support different en
 msgid "Overview"
 msgstr "Overview"
 
-#: src/pages/crypto/CertificateKeyPairForm.ts:56
+#: src/pages/crypto/CertificateKeyPairForm.ts:61
 msgid "PEM-encoded Certificate data."
 msgstr "PEM-encoded Certificate data."
 
-#: src/pages/groups/GroupForm.ts:68
+#: src/pages/groups/GroupForm.ts:73
 #: src/pages/groups/GroupListPage.ts:46
 msgid "Parent"
 msgstr "Parent"
 
-#: src/pages/policies/dummy/DummyPolicyForm.ts:81
+#: src/pages/policies/dummy/DummyPolicyForm.ts:79
 msgid "Pass policy?"
 msgstr "Pass policy?"
 
@@ -2314,7 +2318,7 @@ msgstr "Password field"
 msgid "Password: Masked input, password is validated against sources. Policies still have to be applied to this Stage. If two of these are used in the same stage, they are ensured to be identical."
 msgstr "Password: Masked input, password is validated against sources. Policies still have to be applied to this Stage. If two of these are used in the same stage, they are ensured to be identical."
 
-#: src/pages/sources/saml/SAMLSourceForm.ts:152
+#: src/pages/sources/saml/SAMLSourceForm.ts:150
 msgid "Persistent"
 msgstr "Persistent"
 
@@ -2338,9 +2342,9 @@ msgstr "Please enter your password"
 msgid "Policies"
 msgstr "Policies"
 
-#: src/pages/policies/PolicyBindingForm.ts:107
-#: src/pages/policies/PolicyBindingForm.ts:116
-#: src/pages/policies/PolicyBindingForm.ts:147
+#: src/pages/policies/PolicyBindingForm.ts:108
+#: src/pages/policies/PolicyBindingForm.ts:117
+#: src/pages/policies/PolicyBindingForm.ts:148
 #: src/pages/policies/PolicyListPage.ts:108
 msgid "Policy"
 msgstr "Policy"
@@ -2364,10 +2368,10 @@ msgstr "Policy Bindings"
 msgid "Policy binding"
 msgstr "Policy binding"
 
-#: src/pages/applications/ApplicationForm.ts:141
+#: src/pages/applications/ApplicationForm.ts:146
 #: src/pages/applications/ApplicationViewPage.ts:81
-#: src/pages/flows/FlowForm.ts:101
-#: src/pages/flows/StageBindingForm.ts:136
+#: src/pages/flows/FlowForm.ts:106
+#: src/pages/flows/StageBindingForm.ts:141
 msgid "Policy engine mode"
 msgstr "Policy engine mode"
 
@@ -2375,7 +2379,7 @@ msgstr "Policy engine mode"
 msgid "Policy {0}"
 msgstr "Policy {0}"
 
-#: src/pages/policies/dummy/DummyPolicyForm.ts:74
+#: src/pages/policies/dummy/DummyPolicyForm.ts:72
 #: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:75
 #: src/pages/policies/expiry/ExpiryPolicyForm.ts:74
 #: src/pages/policies/expression/ExpressionPolicyForm.ts:75
@@ -2385,15 +2389,15 @@ msgstr "Policy {0}"
 msgid "Policy-specific settings"
 msgstr "Policy-specific settings"
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:102
+#: src/pages/providers/saml/SAMLProviderForm.ts:101
 msgid "Post"
 msgstr "Post"
 
-#: src/pages/sources/saml/SAMLSourceForm.ts:110
+#: src/pages/sources/saml/SAMLSourceForm.ts:108
 msgid "Post binding"
 msgstr "Post binding"
 
-#: src/pages/sources/saml/SAMLSourceForm.ts:107
+#: src/pages/sources/saml/SAMLSourceForm.ts:105
 msgid "Post binding (auto-submit)"
 msgstr "Post binding (auto-submit)"
 
@@ -2401,11 +2405,11 @@ msgstr "Post binding (auto-submit)"
 msgid "Powered by authentik"
 msgstr "Powered by authentik"
 
-#: src/pages/sources/saml/SAMLSourceForm.ts:224
+#: src/pages/sources/saml/SAMLSourceForm.ts:222
 msgid "Pre-authentication flow"
 msgstr "Pre-authentication flow"
 
-#: src/pages/crypto/CertificateKeyPairForm.ts:61
+#: src/pages/crypto/CertificateKeyPairForm.ts:66
 #: src/pages/stages/captcha/CaptchaStageForm.ts:73
 msgid "Private Key"
 msgstr "Private Key"
@@ -2418,7 +2422,7 @@ msgstr "Private key available?"
 msgid "Private key, acquired from https://www.google.com/recaptcha/intro/v3.html."
 msgstr "Private key, acquired from https://www.google.com/recaptcha/intro/v3.html."
 
-#: src/pages/sources/oauth/OAuthSourceForm.ts:80
+#: src/pages/sources/oauth/OAuthSourceForm.ts:81
 msgid "Profile URL"
 msgstr "Profile URL"
 
@@ -2445,25 +2449,25 @@ msgstr "Property Mapping"
 msgid "Property Mappings"
 msgstr "Property Mappings"
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:155
+#: src/pages/providers/saml/SAMLProviderForm.ts:154
 msgid "Property mappings"
 msgstr "Property mappings"
 
-#: src/pages/sources/ldap/LDAPSourceForm.ts:192
+#: src/pages/sources/ldap/LDAPSourceForm.ts:190
 msgid "Property mappings used to group creation."
 msgstr "Property mappings used to group creation."
 
-#: src/pages/sources/ldap/LDAPSourceForm.ts:166
+#: src/pages/sources/ldap/LDAPSourceForm.ts:164
 msgid "Property mappings used to user creation."
 msgstr "Property mappings used to user creation."
 
-#: src/pages/providers/ldap/LDAPProviderForm.ts:93
+#: src/pages/providers/ldap/LDAPProviderForm.ts:91
 #: src/pages/providers/oauth2/OAuth2ProviderForm.ts:81
 #: src/pages/providers/proxy/ProxyProviderForm.ts:123
-#: src/pages/providers/saml/SAMLProviderForm.ts:78
-#: src/pages/sources/oauth/OAuthSourceForm.ts:144
-#: src/pages/sources/plex/PlexSourceForm.ts:134
-#: src/pages/sources/saml/SAMLSourceForm.ts:76
+#: src/pages/providers/saml/SAMLProviderForm.ts:77
+#: src/pages/sources/oauth/OAuthSourceForm.ts:163
+#: src/pages/sources/plex/PlexSourceForm.ts:137
+#: src/pages/sources/saml/SAMLSourceForm.ts:74
 msgid "Protocol settings"
 msgstr "Protocol settings"
 
@@ -2473,9 +2477,10 @@ msgstr "Provide support for protocols like SAML and OAuth to assigned applicatio
 
 #: src/elements/oauth/UserCodeList.ts:29
 #: src/elements/oauth/UserRefreshList.ts:29
-#: src/pages/applications/ApplicationForm.ts:100
+#: src/pages/applications/ApplicationForm.ts:105
 #: src/pages/applications/ApplicationListPage.ts:60
 #: src/pages/applications/ApplicationViewPage.ts:68
+#: src/pages/providers/ProviderListPage.ts:92
 msgid "Provider"
 msgstr "Provider"
 
@@ -2484,18 +2489,18 @@ msgstr "Provider"
 msgid "Provider Type"
 msgstr "Provider Type"
 
-#: src/pages/sources/oauth/OAuthSourceForm.ts:161
+#: src/pages/sources/oauth/OAuthSourceForm.ts:180
 msgid "Provider type"
 msgstr "Provider type"
 
 #: src/interfaces/AdminInterface.ts:44
-#: src/pages/outposts/OutpostForm.ts:83
+#: src/pages/outposts/OutpostForm.ts:88
 #: src/pages/outposts/OutpostListPage.ts:51
 #: src/pages/providers/ProviderListPage.ts:35
 msgid "Providers"
 msgstr "Providers"
 
-#: src/pages/outposts/OutpostForm.ts:57
+#: src/pages/outposts/OutpostForm.ts:62
 msgid "Proxy"
 msgstr "Proxy"
 
@@ -2511,7 +2516,7 @@ msgstr "Public Key"
 msgid "Public key, acquired from https://www.google.com/recaptcha/intro/v3.html."
 msgstr "Public key, acquired from https://www.google.com/recaptcha/intro/v3.html."
 
-#: src/pages/applications/ApplicationForm.ts:175
+#: src/pages/applications/ApplicationForm.ts:180
 msgid "Publisher"
 msgstr "Publisher"
 
@@ -2523,31 +2528,31 @@ msgstr "RS256 (Asymmetric Encryption)"
 msgid "RSA Key"
 msgstr "RSA Key"
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:244
-#: src/pages/sources/saml/SAMLSourceForm.ts:200
+#: src/pages/providers/saml/SAMLProviderForm.ts:243
+#: src/pages/sources/saml/SAMLSourceForm.ts:198
 msgid "RSA-SHA1"
 msgstr "RSA-SHA1"
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:247
-#: src/pages/sources/saml/SAMLSourceForm.ts:203
+#: src/pages/providers/saml/SAMLProviderForm.ts:246
+#: src/pages/sources/saml/SAMLSourceForm.ts:201
 msgid "RSA-SHA256"
 msgstr "RSA-SHA256"
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:250
-#: src/pages/sources/saml/SAMLSourceForm.ts:206
+#: src/pages/providers/saml/SAMLProviderForm.ts:249
+#: src/pages/sources/saml/SAMLSourceForm.ts:204
 msgid "RSA-SHA384"
 msgstr "RSA-SHA384"
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:253
-#: src/pages/sources/saml/SAMLSourceForm.ts:209
+#: src/pages/providers/saml/SAMLProviderForm.ts:252
+#: src/pages/sources/saml/SAMLSourceForm.ts:207
 msgid "RSA-SHA512"
 msgstr "RSA-SHA512"
 
-#: src/pages/flows/StageBindingForm.ts:130
+#: src/pages/flows/StageBindingForm.ts:135
 msgid "Re-evaluate policies"
 msgstr "Re-evaluate policies"
 
-#: src/pages/flows/FlowForm.ts:67
+#: src/pages/flows/FlowForm.ts:72
 msgid "Recovery"
 msgstr "Recovery"
 
@@ -2559,7 +2564,7 @@ msgstr "Recovery flow"
 msgid "Recovery keys"
 msgstr "Recovery keys"
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:99
+#: src/pages/providers/saml/SAMLProviderForm.ts:98
 msgid "Redirect"
 msgstr "Redirect"
 
@@ -2571,7 +2576,7 @@ msgstr "Redirect URIs"
 msgid "Redirect URIs/Origins"
 msgstr "Redirect URIs/Origins"
 
-#: src/pages/sources/saml/SAMLSourceForm.ts:104
+#: src/pages/sources/saml/SAMLSourceForm.ts:102
 msgid "Redirect binding"
 msgstr "Redirect binding"
 
@@ -2613,7 +2618,7 @@ msgstr "Request"
 msgid "Request has been denied."
 msgstr "Request has been denied."
 
-#: src/pages/sources/oauth/OAuthSourceForm.ts:87
+#: src/pages/sources/oauth/OAuthSourceForm.ts:88
 msgid "Request token URL"
 msgstr "Request token URL"
 
@@ -2662,31 +2667,31 @@ msgstr "Return home"
 msgid "Return to device picker"
 msgstr "Return to device picker"
 
-#: src/pages/property-mappings/PropertyMappingSAMLForm.ts:58
+#: src/pages/property-mappings/PropertyMappingSAMLForm.ts:56
 msgid "SAML Attribute Name"
 msgstr "SAML Attribute Name"
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:225
-#: src/pages/sources/saml/SAMLSourceForm.ts:181
+#: src/pages/providers/saml/SAMLProviderForm.ts:224
+#: src/pages/sources/saml/SAMLSourceForm.ts:179
 msgid "SHA1"
 msgstr "SHA1"
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:228
-#: src/pages/sources/saml/SAMLSourceForm.ts:184
+#: src/pages/providers/saml/SAMLProviderForm.ts:227
+#: src/pages/sources/saml/SAMLSourceForm.ts:182
 msgid "SHA256"
 msgstr "SHA256"
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:231
-#: src/pages/sources/saml/SAMLSourceForm.ts:187
+#: src/pages/providers/saml/SAMLProviderForm.ts:230
+#: src/pages/sources/saml/SAMLSourceForm.ts:185
 msgid "SHA384"
 msgstr "SHA384"
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:234
-#: src/pages/sources/saml/SAMLSourceForm.ts:190
+#: src/pages/providers/saml/SAMLProviderForm.ts:233
+#: src/pages/sources/saml/SAMLSourceForm.ts:188
 msgid "SHA512"
 msgstr "SHA512"
 
-#: src/pages/sources/saml/SAMLSourceForm.ts:87
+#: src/pages/sources/saml/SAMLSourceForm.ts:85
 #: src/pages/sources/saml/SAMLSourceViewPage.ts:82
 msgid "SLO URL"
 msgstr "SLO URL"
@@ -2707,7 +2712,7 @@ msgstr "SMTP Port"
 msgid "SMTP Username"
 msgstr "SMTP Username"
 
-#: src/pages/sources/saml/SAMLSourceForm.ts:80
+#: src/pages/sources/saml/SAMLSourceForm.ts:78
 #: src/pages/sources/saml/SAMLSourceViewPage.ts:74
 msgid "SSO URL"
 msgstr "SSO URL"
@@ -2716,11 +2721,11 @@ msgstr "SSO URL"
 msgid "Same identifier is used for all providers"
 msgstr "Same identifier is used for all providers"
 
-#: src/pages/property-mappings/PropertyMappingScopeForm.ts:58
+#: src/pages/property-mappings/PropertyMappingScopeForm.ts:56
 msgid "Scope name"
 msgstr "Scope name"
 
-#: src/pages/property-mappings/PropertyMappingScopeForm.ts:62
+#: src/pages/property-mappings/PropertyMappingScopeForm.ts:60
 msgid "Scope which the client can specify to access these properties."
 msgstr "Scope which the client can specify to access these properties."
 
@@ -2739,13 +2744,13 @@ msgid "Secret:"
 msgstr "Secret:"
 
 #: src/pages/policies/expression/ExpressionPolicyForm.ts:87
-#: src/pages/property-mappings/PropertyMappingLDAPForm.ts:73
-#: src/pages/property-mappings/PropertyMappingSAMLForm.ts:83
-#: src/pages/property-mappings/PropertyMappingScopeForm.ts:80
+#: src/pages/property-mappings/PropertyMappingLDAPForm.ts:71
+#: src/pages/property-mappings/PropertyMappingSAMLForm.ts:81
+#: src/pages/property-mappings/PropertyMappingScopeForm.ts:78
 msgid "See documentation for a list of all variables."
 msgstr "See documentation for a list of all variables."
 
-#: src/pages/applications/ApplicationForm.ts:108
+#: src/pages/applications/ApplicationForm.ts:113
 msgid "Select a provider that this application should use. Alternatively, create a new provider."
 msgstr "Select a provider that this application should use. Alternatively, create a new provider."
 
@@ -2769,11 +2774,11 @@ msgstr "Select users to add"
 msgid "Select which scopes can be used by the client. The client stil has to specify the scope to access the data."
 msgstr "Select which scopes can be used by the client. The client stil has to specify the scope to access the data."
 
-#: src/pages/sources/plex/PlexSourceForm.ts:164
+#: src/pages/sources/plex/PlexSourceForm.ts:167
 msgid "Select which server a user has to be a member of to be allowed to authenticate."
 msgstr "Select which server a user has to be a member of to be allowed to authenticate."
 
-#: src/pages/events/RuleForm.ts:92
+#: src/pages/events/RuleForm.ts:97
 msgid "Select which transports should be used to notify the user. If none are selected, the notification will only be shown in the authentik UI."
 msgstr "Select which transports should be used to notify the user. If none are selected, the notification will only be shown in the authentik UI."
 
@@ -2781,7 +2786,7 @@ msgstr "Select which transports should be used to notify the user. If none are s
 msgid "Selected policies are executed when the stage is submitted to validate the data."
 msgstr "Selected policies are executed when the stage is submitted to validate the data."
 
-#: src/pages/outposts/OutpostForm.ts:77
+#: src/pages/outposts/OutpostForm.ts:82
 msgid "Selecting a service-connection enables the management of the outpost by authentik."
 msgstr "Selecting a service-connection enables the management of the outpost by authentik."
 
@@ -2797,7 +2802,7 @@ msgstr "Send Email again."
 msgid "Send notifications whenever a specific Event is created and matched by policies."
 msgstr "Send notifications whenever a specific Event is created and matched by policies."
 
-#: src/pages/events/TransportForm.ts:99
+#: src/pages/events/TransportForm.ts:104
 msgid "Send once"
 msgstr "Send once"
 
@@ -2809,7 +2814,7 @@ msgstr "Sent to group"
 msgid "Separator: Static Separator Line"
 msgstr "Separator: Static Separator Line"
 
-#: src/pages/sources/ldap/LDAPSourceForm.ts:104
+#: src/pages/sources/ldap/LDAPSourceForm.ts:102
 #: src/pages/sources/ldap/LDAPSourceViewPage.ts:72
 msgid "Server URI"
 msgstr "Server URI"
@@ -2822,11 +2827,11 @@ msgstr "Server validation of credential failed: {err}"
 msgid "Service Connections"
 msgstr "Service Connections"
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:94
+#: src/pages/providers/saml/SAMLProviderForm.ts:93
 msgid "Service Provider Binding"
 msgstr "Service Provider Binding"
 
-#: src/pages/outposts/OutpostForm.ts:62
+#: src/pages/outposts/OutpostForm.ts:67
 msgid "Service connection"
 msgstr "Service connection"
 
@@ -2834,11 +2839,11 @@ msgstr "Service connection"
 msgid "Session duration"
 msgstr "Session duration"
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:216
+#: src/pages/providers/saml/SAMLProviderForm.ts:215
 msgid "Session not valid on or after current time + this value (Format: hours=1;minutes=2;seconds=3)."
 msgstr "Session not valid on or after current time + this value (Format: hours=1;minutes=2;seconds=3)."
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:212
+#: src/pages/providers/saml/SAMLProviderForm.ts:211
 msgid "Session valid not on or after"
 msgstr "Session valid not on or after"
 
@@ -2850,15 +2855,15 @@ msgstr "Set HTTP-Basic Authentication"
 msgid "Set a custom HTTP-Basic Authentication header based on values from authentik."
 msgstr "Set a custom HTTP-Basic Authentication header based on values from authentik."
 
-#: src/pages/groups/GroupForm.ts:139
-#: src/pages/outposts/OutpostForm.ts:121
-#: src/pages/outposts/ServiceConnectionKubernetesForm.ts:73
+#: src/pages/groups/GroupForm.ts:144
+#: src/pages/outposts/OutpostForm.ts:127
+#: src/pages/outposts/ServiceConnectionKubernetesForm.ts:71
 #: src/pages/policies/PolicyTestForm.ts:79
 #: src/pages/users/UserForm.ts:82
 msgid "Set custom attributes using YAML or JSON."
 msgstr "Set custom attributes using YAML or JSON."
 
-#: src/pages/events/RuleForm.ts:96
+#: src/pages/events/RuleForm.ts:101
 #: src/pages/events/RuleListPage.ts:48
 msgid "Severity"
 msgstr "Severity"
@@ -2871,7 +2876,7 @@ msgstr "Show arbitrary input fields to the user, for example during enrollment.
 msgid "Show matched user"
 msgstr "Show matched user"
 
-#: src/pages/flows/FlowForm.ts:91
+#: src/pages/flows/FlowForm.ts:96
 msgid "Shown as the Title in Flow pages."
 msgstr "Shown as the Title in Flow pages."
 
@@ -2879,16 +2884,16 @@ msgstr "Shown as the Title in Flow pages."
 msgid "Sign up."
 msgstr "Sign up."
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:239
-#: src/pages/sources/saml/SAMLSourceForm.ts:195
+#: src/pages/providers/saml/SAMLProviderForm.ts:238
+#: src/pages/sources/saml/SAMLSourceForm.ts:193
 msgid "Signature algorithm"
 msgstr "Signature algorithm"
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:121
+#: src/pages/providers/saml/SAMLProviderForm.ts:120
 msgid "Signing Certificate"
 msgstr "Signing Certificate"
 
-#: src/pages/sources/saml/SAMLSourceForm.ts:115
+#: src/pages/sources/saml/SAMLSourceForm.ts:113
 msgid "Signing keypair"
 msgstr "Signing keypair"
 
@@ -2904,13 +2909,13 @@ msgstr "Single use"
 msgid "Skip path regex"
 msgstr "Skip path regex"
 
-#: src/pages/applications/ApplicationForm.ts:93
+#: src/pages/applications/ApplicationForm.ts:98
 #: src/pages/applications/ApplicationListPage.ts:59
-#: src/pages/flows/FlowForm.ts:94
-#: src/pages/sources/ldap/LDAPSourceForm.ts:60
-#: src/pages/sources/oauth/OAuthSourceForm.ts:106
-#: src/pages/sources/plex/PlexSourceForm.ts:96
-#: src/pages/sources/saml/SAMLSourceForm.ts:60
+#: src/pages/flows/FlowForm.ts:99
+#: src/pages/sources/ldap/LDAPSourceForm.ts:58
+#: src/pages/sources/oauth/OAuthSourceForm.ts:114
+#: src/pages/sources/plex/PlexSourceForm.ts:99
+#: src/pages/sources/saml/SAMLSourceForm.ts:58
 msgid "Slug"
 msgstr "Slug"
 
@@ -2918,7 +2923,6 @@ msgstr "Slug"
 msgid "Something went wrong! Please try again later."
 msgstr "Something went wrong! Please try again later."
 
-#: src/pages/providers/ProviderListPage.ts:92
 #: src/pages/sources/SourcesListPage.ts:88
 msgid "Source"
 msgstr "Source"
@@ -2936,7 +2940,7 @@ msgstr "Sources"
 msgid "Sources of identities, which can either be synced into authentik's database, like LDAP, or can be used by users to authenticate and enroll themselves, like OAuth and social logins"
 msgstr "Sources of identities, which can either be synced into authentik's database, like LDAP, or can be used by users to authenticate and enroll themselves, like OAuth and social logins"
 
-#: src/pages/flows/StageBindingForm.ts:98
+#: src/pages/flows/StageBindingForm.ts:103
 msgid "Stage"
 msgstr "Stage"
 
@@ -2944,7 +2948,7 @@ msgstr "Stage"
 msgid "Stage Bindings"
 msgstr "Stage Bindings"
 
-#: src/pages/flows/FlowForm.ts:70
+#: src/pages/flows/FlowForm.ts:75
 msgid "Stage Configuration"
 msgstr "Stage Configuration"
 
@@ -3055,24 +3059,24 @@ msgstr "Successful"
 msgid "Successfully copied TOTP Config."
 msgstr "Successfully copied TOTP Config."
 
-#: src/pages/applications/ApplicationForm.ts:55
+#: src/pages/applications/ApplicationForm.ts:60
 msgid "Successfully created application."
 msgstr "Successfully created application."
 
-#: src/pages/flows/StageBindingForm.ts:39
-#: src/pages/policies/PolicyBindingForm.ts:64
+#: src/pages/flows/StageBindingForm.ts:44
+#: src/pages/policies/PolicyBindingForm.ts:65
 msgid "Successfully created binding."
 msgstr "Successfully created binding."
 
-#: src/pages/crypto/CertificateKeyPairForm.ts:38
+#: src/pages/crypto/CertificateKeyPairForm.ts:43
 msgid "Successfully created certificate-key pair."
 msgstr "Successfully created certificate-key pair."
 
-#: src/pages/flows/FlowForm.ts:48
+#: src/pages/flows/FlowForm.ts:53
 msgid "Successfully created flow."
 msgstr "Successfully created flow."
 
-#: src/pages/groups/GroupForm.ts:46
+#: src/pages/groups/GroupForm.ts:51
 msgid "Successfully created group."
 msgstr "Successfully created group."
 
@@ -3080,17 +3084,17 @@ msgstr "Successfully created group."
 msgid "Successfully created invitation."
 msgstr "Successfully created invitation."
 
-#: src/pages/property-mappings/PropertyMappingLDAPForm.ts:45
-#: src/pages/property-mappings/PropertyMappingSAMLForm.ts:45
-#: src/pages/property-mappings/PropertyMappingScopeForm.ts:45
+#: src/pages/property-mappings/PropertyMappingLDAPForm.ts:43
+#: src/pages/property-mappings/PropertyMappingSAMLForm.ts:43
+#: src/pages/property-mappings/PropertyMappingScopeForm.ts:43
 msgid "Successfully created mapping."
 msgstr "Successfully created mapping."
 
-#: src/pages/outposts/OutpostForm.ts:40
+#: src/pages/outposts/OutpostForm.ts:45
 msgid "Successfully created outpost."
 msgstr "Successfully created outpost."
 
-#: src/pages/policies/dummy/DummyPolicyForm.ts:46
+#: src/pages/policies/dummy/DummyPolicyForm.ts:44
 #: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:47
 #: src/pages/policies/expiry/ExpiryPolicyForm.ts:46
 #: src/pages/policies/expression/ExpressionPolicyForm.ts:47
@@ -3104,26 +3108,26 @@ msgstr "Successfully created policy."
 msgid "Successfully created prompt."
 msgstr "Successfully created prompt."
 
-#: src/pages/providers/ldap/LDAPProviderForm.ts:47
+#: src/pages/providers/ldap/LDAPProviderForm.ts:45
 #: src/pages/providers/oauth2/OAuth2ProviderForm.ts:49
 #: src/pages/providers/proxy/ProxyProviderForm.ts:51
-#: src/pages/providers/saml/SAMLProviderForm.ts:46
+#: src/pages/providers/saml/SAMLProviderForm.ts:45
 msgid "Successfully created provider."
 msgstr "Successfully created provider."
 
-#: src/pages/events/RuleForm.ts:38
+#: src/pages/events/RuleForm.ts:43
 msgid "Successfully created rule."
 msgstr "Successfully created rule."
 
-#: src/pages/outposts/ServiceConnectionDockerForm.ts:46
-#: src/pages/outposts/ServiceConnectionKubernetesForm.ts:47
+#: src/pages/outposts/ServiceConnectionDockerForm.ts:44
+#: src/pages/outposts/ServiceConnectionKubernetesForm.ts:45
 msgid "Successfully created service-connection."
 msgstr "Successfully created service-connection."
 
-#: src/pages/sources/ldap/LDAPSourceForm.ts:47
-#: src/pages/sources/oauth/OAuthSourceForm.ts:51
-#: src/pages/sources/plex/PlexSourceForm.ts:63
-#: src/pages/sources/saml/SAMLSourceForm.ts:47
+#: src/pages/sources/ldap/LDAPSourceForm.ts:45
+#: src/pages/sources/oauth/OAuthSourceForm.ts:52
+#: src/pages/sources/plex/PlexSourceForm.ts:66
+#: src/pages/sources/saml/SAMLSourceForm.ts:45
 msgid "Successfully created source."
 msgstr "Successfully created source."
 
@@ -3151,7 +3155,7 @@ msgstr "Successfully created stage."
 msgid "Successfully created token."
 msgstr "Successfully created token."
 
-#: src/pages/events/TransportForm.ts:39
+#: src/pages/events/TransportForm.ts:44
 msgid "Successfully created transport."
 msgstr "Successfully created transport."
 
@@ -3185,16 +3189,16 @@ msgstr "Successfully imported provider."
 msgid "Successfully sent test-request."
 msgstr "Successfully sent test-request."
 
-#: src/pages/applications/ApplicationForm.ts:52
+#: src/pages/applications/ApplicationForm.ts:57
 msgid "Successfully updated application."
 msgstr "Successfully updated application."
 
-#: src/pages/flows/StageBindingForm.ts:36
-#: src/pages/policies/PolicyBindingForm.ts:61
+#: src/pages/flows/StageBindingForm.ts:41
+#: src/pages/policies/PolicyBindingForm.ts:62
 msgid "Successfully updated binding."
 msgstr "Successfully updated binding."
 
-#: src/pages/crypto/CertificateKeyPairForm.ts:35
+#: src/pages/crypto/CertificateKeyPairForm.ts:40
 msgid "Successfully updated certificate-key pair."
 msgstr "Successfully updated certificate-key pair."
 
@@ -3206,11 +3210,11 @@ msgstr "Successfully updated details."
 msgid "Successfully updated device."
 msgstr "Successfully updated device."
 
-#: src/pages/flows/FlowForm.ts:45
+#: src/pages/flows/FlowForm.ts:50
 msgid "Successfully updated flow."
 msgstr "Successfully updated flow."
 
-#: src/pages/groups/GroupForm.ts:43
+#: src/pages/groups/GroupForm.ts:48
 msgid "Successfully updated group."
 msgstr "Successfully updated group."
 
@@ -3218,17 +3222,17 @@ msgstr "Successfully updated group."
 msgid "Successfully updated invitation."
 msgstr "Successfully updated invitation."
 
-#: src/pages/property-mappings/PropertyMappingLDAPForm.ts:42
-#: src/pages/property-mappings/PropertyMappingSAMLForm.ts:42
-#: src/pages/property-mappings/PropertyMappingScopeForm.ts:42
+#: src/pages/property-mappings/PropertyMappingLDAPForm.ts:40
+#: src/pages/property-mappings/PropertyMappingSAMLForm.ts:40
+#: src/pages/property-mappings/PropertyMappingScopeForm.ts:40
 msgid "Successfully updated mapping."
 msgstr "Successfully updated mapping."
 
-#: src/pages/outposts/OutpostForm.ts:37
+#: src/pages/outposts/OutpostForm.ts:42
 msgid "Successfully updated outpost."
 msgstr "Successfully updated outpost."
 
-#: src/pages/policies/dummy/DummyPolicyForm.ts:43
+#: src/pages/policies/dummy/DummyPolicyForm.ts:41
 #: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:44
 #: src/pages/policies/expiry/ExpiryPolicyForm.ts:43
 #: src/pages/policies/expression/ExpressionPolicyForm.ts:44
@@ -3242,26 +3246,26 @@ msgstr "Successfully updated policy."
 msgid "Successfully updated prompt."
 msgstr "Successfully updated prompt."
 
-#: src/pages/providers/ldap/LDAPProviderForm.ts:44
+#: src/pages/providers/ldap/LDAPProviderForm.ts:42
 #: src/pages/providers/oauth2/OAuth2ProviderForm.ts:46
 #: src/pages/providers/proxy/ProxyProviderForm.ts:48
-#: src/pages/providers/saml/SAMLProviderForm.ts:43
+#: src/pages/providers/saml/SAMLProviderForm.ts:42
 msgid "Successfully updated provider."
 msgstr "Successfully updated provider."
 
-#: src/pages/events/RuleForm.ts:35
+#: src/pages/events/RuleForm.ts:40
 msgid "Successfully updated rule."
 msgstr "Successfully updated rule."
 
-#: src/pages/outposts/ServiceConnectionDockerForm.ts:43
-#: src/pages/outposts/ServiceConnectionKubernetesForm.ts:44
+#: src/pages/outposts/ServiceConnectionDockerForm.ts:41
+#: src/pages/outposts/ServiceConnectionKubernetesForm.ts:42
 msgid "Successfully updated service-connection."
 msgstr "Successfully updated service-connection."
 
-#: src/pages/sources/ldap/LDAPSourceForm.ts:44
-#: src/pages/sources/oauth/OAuthSourceForm.ts:48
-#: src/pages/sources/plex/PlexSourceForm.ts:60
-#: src/pages/sources/saml/SAMLSourceForm.ts:44
+#: src/pages/sources/ldap/LDAPSourceForm.ts:42
+#: src/pages/sources/oauth/OAuthSourceForm.ts:49
+#: src/pages/sources/plex/PlexSourceForm.ts:63
+#: src/pages/sources/saml/SAMLSourceForm.ts:42
 msgid "Successfully updated source."
 msgstr "Successfully updated source."
 
@@ -3289,7 +3293,7 @@ msgstr "Successfully updated stage."
 msgid "Successfully updated token."
 msgstr "Successfully updated token."
 
-#: src/pages/events/TransportForm.ts:36
+#: src/pages/events/TransportForm.ts:41
 msgid "Successfully updated transport."
 msgstr "Successfully updated transport."
 
@@ -3309,6 +3313,14 @@ msgstr "Superuser"
 msgid "Superuser privileges?"
 msgstr "Superuser privileges?"
 
+#: src/pages/admin-overview/charts/GroupCountStatusChart.ts:55
+msgid "Superuser-groups"
+msgstr "Superuser-groups"
+
+#: src/pages/admin-overview/charts/UserCountStatusChart.ts:55
+msgid "Superusers"
+msgstr "Superusers"
+
 #: src/pages/policies/password/PasswordPolicyForm.ts:123
 msgid "Symbol charset"
 msgstr "Symbol charset"
@@ -3317,7 +3329,7 @@ msgstr "Symbol charset"
 msgid "Sync"
 msgstr "Sync"
 
-#: src/pages/sources/ldap/LDAPSourceForm.ts:94
+#: src/pages/sources/ldap/LDAPSourceForm.ts:92
 msgid "Sync groups"
 msgstr "Sync groups"
 
@@ -3325,7 +3337,7 @@ msgstr "Sync groups"
 msgid "Sync status"
 msgstr "Sync status"
 
-#: src/pages/sources/ldap/LDAPSourceForm.ts:77
+#: src/pages/sources/ldap/LDAPSourceForm.ts:75
 msgid "Sync users"
 msgstr "Sync users"
 
@@ -3338,11 +3350,11 @@ msgstr "System Overview"
 msgid "System Tasks"
 msgstr "System Tasks"
 
-#: src/pages/outposts/ServiceConnectionDockerForm.ts:91
+#: src/pages/outposts/ServiceConnectionDockerForm.ts:89
 msgid "TLS Authentication Certificate"
 msgstr "TLS Authentication Certificate"
 
-#: src/pages/outposts/ServiceConnectionDockerForm.ts:75
+#: src/pages/outposts/ServiceConnectionDockerForm.ts:73
 msgid "TLS Verification Certificate"
 msgstr "TLS Verification Certificate"
 
@@ -3350,7 +3362,7 @@ msgstr "TLS Verification Certificate"
 msgid "TOTP Authenticators"
 msgstr "TOTP Authenticators"
 
-#: src/pages/flows/StageBindingForm.ts:78
+#: src/pages/flows/StageBindingForm.ts:83
 msgid "Target"
 msgstr "Target"
 
@@ -3394,7 +3406,7 @@ msgstr "The URL \"{0}\" was not found."
 msgid "The external URL you'll access the outpost at."
 msgstr "The external URL you'll access the outpost at."
 
-#: src/pages/policies/dummy/DummyPolicyForm.ts:90
+#: src/pages/policies/dummy/DummyPolicyForm.ts:88
 msgid "The policy takes a random time to execute. This controls the minimum time it will take."
 msgstr "The policy takes a random time to execute. This controls the minimum time it will take."
 
@@ -3444,7 +3456,7 @@ msgstr "Threshold"
 msgid "Time in minutes the token sent is valid."
 msgstr "Time in minutes the token sent is valid."
 
-#: src/pages/sources/saml/SAMLSourceForm.ts:173
+#: src/pages/sources/saml/SAMLSourceForm.ts:171
 msgid "Time offset when temporary users should be deleted. This only applies if your IDP uses the NameID Format 'transient', and the user doesn't log out manually. (Format: hours=1;minutes=2;seconds=3)."
 msgstr "Time offset when temporary users should be deleted. This only applies if your IDP uses the NameID Format 'transient', and the user doesn't log out manually. (Format: hours=1;minutes=2;seconds=3)."
 
@@ -3453,12 +3465,12 @@ msgid "Time-based One-Time Passwords"
 msgstr "Time-based One-Time Passwords"
 
 #: src/pages/policies/BoundPoliciesList.ts:43
-#: src/pages/policies/PolicyBindingForm.ts:209
+#: src/pages/policies/PolicyBindingForm.ts:210
 #: src/pages/stages/email/EmailStageForm.ts:101
 msgid "Timeout"
 msgstr "Timeout"
 
-#: src/pages/flows/FlowForm.ts:87
+#: src/pages/flows/FlowForm.ts:92
 msgid "Title"
 msgstr "Title"
 
@@ -3495,28 +3507,36 @@ msgstr "Tokens"
 msgid "Tokens are used throughout authentik for Email validation stages, Recovery keys and API access."
 msgstr "Tokens are used throughout authentik for Email validation stages, Recovery keys and API access."
 
-#: src/pages/admin-overview/graphs/FlowStatusCard.ts:53
+#: src/pages/admin-overview/charts/FlowStatusChart.ts:53
 msgid "Total flows"
 msgstr "Total flows"
 
-#: src/pages/admin-overview/graphs/PolicyStatusCard.ts:58
+#: src/pages/admin-overview/charts/GroupCountStatusChart.ts:54
+msgid "Total groups"
+msgstr "Total groups"
+
+#: src/pages/admin-overview/charts/PolicyStatusChart.ts:58
 msgid "Total policies"
 msgstr "Total policies"
 
+#: src/pages/admin-overview/charts/UserCountStatusChart.ts:54
+msgid "Total users"
+msgstr "Total users"
+
 #: src/flows/stages/authenticator_validate/AuthenticatorValidateStage.ts:80
 msgid "Traditional authenticator"
 msgstr "Traditional authenticator"
 
-#: src/pages/sources/saml/SAMLSourceForm.ts:164
+#: src/pages/sources/saml/SAMLSourceForm.ts:162
 msgid "Transient"
 msgstr "Transient"
 
-#: src/pages/events/RuleForm.ts:78
+#: src/pages/events/RuleForm.ts:83
 msgid "Transports"
 msgstr "Transports"
 
 #: src/pages/flows/BoundStagesList.ts:40
-#: src/pages/outposts/OutpostForm.ts:53
+#: src/pages/outposts/OutpostForm.ts:58
 #: src/pages/outposts/ServiceConnectionListPage.ts:54
 #: src/pages/policies/PolicyListPage.ts:57
 #: src/pages/property-mappings/PropertyMappingListPage.ts:55
@@ -3527,7 +3547,7 @@ msgstr "Transports"
 msgid "Type"
 msgstr "Type"
 
-#: src/pages/applications/ApplicationForm.ts:155
+#: src/pages/applications/ApplicationForm.ts:160
 msgid "UI settings"
 msgstr "UI settings"
 
@@ -3535,35 +3555,35 @@ msgstr "UI settings"
 msgid "UID"
 msgstr "UID"
 
-#: src/pages/sources/oauth/OAuthSourceForm.ts:62
+#: src/pages/sources/oauth/OAuthSourceForm.ts:63
 msgid "URL settings"
 msgstr "URL settings"
 
-#: src/pages/sources/saml/SAMLSourceForm.ts:84
+#: src/pages/sources/saml/SAMLSourceForm.ts:82
 msgid "URL that the initial Login request is sent to."
 msgstr "URL that the initial Login request is sent to."
 
-#: src/pages/sources/oauth/OAuthSourceForm.ts:70
+#: src/pages/sources/oauth/OAuthSourceForm.ts:71
 msgid "URL the user is redirect to to consent the authorization."
 msgstr "URL the user is redirect to to consent the authorization."
 
-#: src/pages/sources/oauth/OAuthSourceForm.ts:84
+#: src/pages/sources/oauth/OAuthSourceForm.ts:85
 msgid "URL used by authentik to get user information."
 msgstr "URL used by authentik to get user information."
 
-#: src/pages/sources/oauth/OAuthSourceForm.ts:77
+#: src/pages/sources/oauth/OAuthSourceForm.ts:78
 msgid "URL used by authentik to retrieve tokens."
 msgstr "URL used by authentik to retrieve tokens."
 
-#: src/pages/sources/oauth/OAuthSourceForm.ts:90
+#: src/pages/sources/oauth/OAuthSourceForm.ts:91
 msgid "URL used to request the initial token. This URL is only required for OAuth 1."
 msgstr "URL used to request the initial token. This URL is only required for OAuth 1."
 
-#: src/pages/admin-overview/graphs/PolicyStatusCard.ts:60
+#: src/pages/admin-overview/charts/PolicyStatusChart.ts:60
 msgid "Unbound policies"
 msgstr "Unbound policies"
 
-#: src/pages/flows/FlowForm.ts:73
+#: src/pages/flows/FlowForm.ts:78
 msgid "Unenrollment"
 msgstr "Unenrollment"
 
@@ -3571,7 +3591,7 @@ msgstr "Unenrollment"
 msgid "Unhealthy"
 msgstr "Unhealthy"
 
-#: src/pages/admin-overview/graphs/OutpostStatusCard.ts:72
+#: src/pages/admin-overview/charts/OutpostStatusChart.ts:72
 msgid "Unhealthy outposts"
 msgstr "Unhealthy outposts"
 
@@ -3579,7 +3599,7 @@ msgstr "Unhealthy outposts"
 msgid "Unknown"
 msgstr "Unknown"
 
-#: src/pages/admin-overview/graphs/LDAPSyncStatusCard.ts:77
+#: src/pages/admin-overview/charts/LDAPSyncStatusChart.ts:77
 msgid "Unsynced sources"
 msgstr "Unsynced sources"
 
@@ -3751,22 +3771,26 @@ msgstr "Use a security key to prove your identity."
 msgid "Use global settings"
 msgstr "Use global settings"
 
-#: src/pages/sources/oauth/OAuthSourceForm.ts:131
-#: src/pages/sources/plex/PlexSourceForm.ts:121
+#: src/pages/sources/oauth/OAuthSourceForm.ts:150
+#: src/pages/sources/plex/PlexSourceForm.ts:124
 msgid "Use the user's email address, but deny enrollment when the email address already exists."
 msgstr "Use the user's email address, but deny enrollment when the email address already exists."
 
-#: src/pages/sources/oauth/OAuthSourceForm.ts:137
-#: src/pages/sources/plex/PlexSourceForm.ts:127
+#: src/pages/sources/oauth/OAuthSourceForm.ts:156
+#: src/pages/sources/plex/PlexSourceForm.ts:130
 msgid "Use the user's username, but deny enrollment when the username already exists."
 msgstr "Use the user's username, but deny enrollment when the username already exists."
 
+#: src/pages/sources/oauth/OAuthSourceForm.ts:126
+msgid "Use this redirect URL:"
+msgstr "Use this redirect URL:"
+
 #: src/elements/events/ObjectChangelog.ts:39
 #: src/elements/events/UserEvents.ts:36
 #: src/pages/events/EventInfo.ts:83
 #: src/pages/events/EventListPage.ts:44
-#: src/pages/policies/PolicyBindingForm.ts:132
-#: src/pages/policies/PolicyBindingForm.ts:176
+#: src/pages/policies/PolicyBindingForm.ts:133
+#: src/pages/policies/PolicyBindingForm.ts:177
 #: src/pages/policies/PolicyTestForm.ts:61
 #: src/pages/property-mappings/PropertyMappingTestForm.ts:51
 #: src/pages/tokens/TokenListPage.ts:45
@@ -3780,7 +3804,7 @@ msgstr "User"
 msgid "User Info"
 msgstr "User Info"
 
-#: src/pages/sources/ldap/LDAPSourceForm.ts:144
+#: src/pages/sources/ldap/LDAPSourceForm.ts:142
 msgid "User Property Mappings"
 msgstr "User Property Mappings"
 
@@ -3801,16 +3825,16 @@ msgstr "User events"
 msgid "User fields"
 msgstr "User fields"
 
-#: src/pages/sources/oauth/OAuthSourceForm.ts:120
-#: src/pages/sources/plex/PlexSourceForm.ts:110
+#: src/pages/sources/oauth/OAuthSourceForm.ts:139
+#: src/pages/sources/plex/PlexSourceForm.ts:113
 msgid "User matching mode"
 msgstr "User matching mode"
 
-#: src/pages/sources/ldap/LDAPSourceForm.ts:208
+#: src/pages/sources/ldap/LDAPSourceForm.ts:206
 msgid "User object filter"
 msgstr "User object filter"
 
-#: src/pages/sources/ldap/LDAPSourceForm.ts:85
+#: src/pages/sources/ldap/LDAPSourceForm.ts:83
 msgid "User password writeback"
 msgstr "User password writeback"
 
@@ -3853,16 +3877,16 @@ msgid "Username: Same as Text input, but checks for and prevents duplicate usern
 msgstr "Username: Same as Text input, but checks for and prevents duplicate usernames."
 
 #: src/interfaces/AdminInterface.ts:100
-#: src/pages/admin-overview/AdminOverviewPage.ts:88
+#: src/pages/admin-overview/AdminOverviewPage.ts:71
 #: src/pages/users/UserListPage.ts:33
 msgid "Users"
 msgstr "Users"
 
-#: src/pages/groups/GroupForm.ts:65
+#: src/pages/groups/GroupForm.ts:70
 msgid "Users added to this group will be superusers."
 msgstr "Users added to this group will be superusers."
 
-#: src/pages/providers/ldap/LDAPProviderForm.ts:88
+#: src/pages/providers/ldap/LDAPProviderForm.ts:86
 msgid "Users in the selected group can do search queries."
 msgstr "Users in the selected group can do search queries."
 
@@ -3894,7 +3918,7 @@ msgstr "Validation Policies"
 msgid "Validity days"
 msgstr "Validity days"
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:138
+#: src/pages/providers/saml/SAMLProviderForm.ts:137
 msgid "Verification Certificate"
 msgstr "Verification Certificate"
 
@@ -3902,7 +3926,7 @@ msgstr "Verification Certificate"
 msgid "Verify the user's email address by sending them a one-time-link. Can also be used for recovery to verify the user's authenticity."
 msgstr "Verify the user's email address by sending them a one-time-link. Can also be used for recovery to verify the user's authenticity."
 
-#: src/pages/admin-overview/AdminOverviewPage.ts:80
+#: src/pages/admin-overview/AdminOverviewPage.ts:90
 msgid "Version"
 msgstr "Version"
 
@@ -3918,27 +3942,23 @@ msgstr "View Deployment Info"
 msgid "View deployment documentation"
 msgstr "View deployment documentation"
 
-#: src/pages/flows/FlowForm.ts:98
+#: src/pages/flows/FlowForm.ts:103
 msgid "Visible in the URL."
 msgstr "Visible in the URL."
 
-#: src/pages/policies/dummy/DummyPolicyForm.ts:93
+#: src/pages/policies/dummy/DummyPolicyForm.ts:91
 msgid "Wait (max)"
 msgstr "Wait (max)"
 
-#: src/pages/policies/dummy/DummyPolicyForm.ts:86
+#: src/pages/policies/dummy/DummyPolicyForm.ts:84
 msgid "Wait (min)"
 msgstr "Wait (min)"
 
-#: src/pages/events/RuleForm.ts:48
+#: src/pages/events/RuleForm.ts:53
 #: src/pages/system-tasks/SystemTaskListPage.ts:66
 msgid "Warning"
 msgstr "Warning"
 
-#: src/pages/admin-overview/cards/ProviderStatusCard.ts:24
-msgid "Warning: At least one Provider has no application assigned."
-msgstr "Warning: At least one Provider has no application assigned."
-
 #: src/pages/policies/PolicyListPage.ts:71
 msgid "Warning: Policy is not assigned."
 msgstr "Warning: Policy is not assigned."
@@ -3955,15 +3975,15 @@ msgstr "WebAuthn Authenticators"
 msgid "WebAuthn Devices"
 msgstr "WebAuthn Devices"
 
-#: src/pages/events/TransportForm.ts:52
+#: src/pages/events/TransportForm.ts:57
 msgid "Webhook (Slack/Discord)"
 msgstr "Webhook (Slack/Discord)"
 
-#: src/pages/events/TransportForm.ts:49
+#: src/pages/events/TransportForm.ts:54
 msgid "Webhook (generic)"
 msgstr "Webhook (generic)"
 
-#: src/pages/events/TransportForm.ts:91
+#: src/pages/events/TransportForm.ts:96
 msgid "Webhook URL"
 msgstr "Webhook URL"
 
@@ -3983,11 +4003,11 @@ msgstr "When enabled, the invitation will be deleted after usage."
 msgid "When enabled, user fields are matched regardless of their casing."
 msgstr "When enabled, user fields are matched regardless of their casing."
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:151
+#: src/pages/providers/saml/SAMLProviderForm.ts:150
 msgid "When selected, incoming assertion's Signatures will be validated against this certificate. To allow unsigned Requests, leave on default."
 msgstr "When selected, incoming assertion's Signatures will be validated against this certificate. To allow unsigned Requests, leave on default."
 
-#: src/pages/policies/dummy/DummyPolicyForm.ts:69
+#: src/pages/policies/dummy/DummyPolicyForm.ts:67
 #: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:70
 #: src/pages/policies/expiry/ExpiryPolicyForm.ts:69
 #: src/pages/policies/expression/ExpressionPolicyForm.ts:70
@@ -4001,11 +4021,11 @@ msgstr "When this option is enabled, all executions of this policy will be logge
 msgid "Whoops!"
 msgstr "Whoops!"
 
-#: src/pages/sources/saml/SAMLSourceForm.ts:158
+#: src/pages/sources/saml/SAMLSourceForm.ts:156
 msgid "Windows"
 msgstr "Windows"
 
-#: src/pages/admin-overview/AdminOverviewPage.ts:92
+#: src/pages/admin-overview/AdminOverviewPage.ts:98
 msgid "Workers"
 msgstr "Workers"
 
@@ -4017,7 +4037,7 @@ msgstr ""
 "Write any data from the flow's context's 'prompt_data' to the currently pending user. If no user\n"
 "is pending, a new user is created, and data is written to them."
 
-#: src/pages/sources/saml/SAMLSourceForm.ts:161
+#: src/pages/sources/saml/SAMLSourceForm.ts:159
 msgid "X509 Subject"
 msgstr "X509 Subject"
 
diff --git a/web/src/locales/pseudo-LOCALE.po b/web/src/locales/pseudo-LOCALE.po
index 9103f167f..4fa139ff7 100644
--- a/web/src/locales/pseudo-LOCALE.po
+++ b/web/src/locales/pseudo-LOCALE.po
@@ -15,7 +15,7 @@ msgstr ""
 
 #: src/pages/providers/oauth2/OAuth2ProviderForm.ts:141
 #: src/pages/providers/oauth2/OAuth2ProviderForm.ts:149
-#: src/pages/providers/saml/SAMLProviderForm.ts:202
+#: src/pages/providers/saml/SAMLProviderForm.ts:201
 #: src/pages/stages/user_login/UserLoginStageForm.ts:71
 msgid "(Format: hours=-1;minutes=-2;seconds=-3)."
 msgstr ""
@@ -36,30 +36,30 @@ msgstr ""
 msgid "A newer version of the frontend is available."
 msgstr ""
 
-#: src/pages/policies/dummy/DummyPolicyForm.ts:53
+#: src/pages/policies/dummy/DummyPolicyForm.ts:51
 msgid "A policy used for testing. Always returns the same result as specified below after waiting a random duration."
 msgstr ""
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:82
+#: src/pages/providers/saml/SAMLProviderForm.ts:81
 #: src/pages/providers/saml/SAMLProviderViewPage.ts:84
 msgid "ACS URL"
 msgstr ""
 
-#: src/pages/applications/ApplicationForm.ts:149
-#: src/pages/flows/FlowForm.ts:109
+#: src/pages/applications/ApplicationForm.ts:154
+#: src/pages/flows/FlowForm.ts:114
 msgid "ALL, all policies must match to grant access."
 msgstr ""
 
-#: src/pages/flows/StageBindingForm.ts:144
+#: src/pages/flows/StageBindingForm.ts:149
 msgid "ALL, all policies must match to include this stage access."
 msgstr ""
 
-#: src/pages/applications/ApplicationForm.ts:146
-#: src/pages/flows/FlowForm.ts:106
+#: src/pages/applications/ApplicationForm.ts:151
+#: src/pages/flows/FlowForm.ts:111
 msgid "ANY, any policy must match to grant access."
 msgstr ""
 
-#: src/pages/flows/StageBindingForm.ts:141
+#: src/pages/flows/StageBindingForm.ts:146
 msgid "ANY, any policy must match to include this stage access."
 msgstr ""
 
@@ -79,7 +79,7 @@ msgstr ""
 msgid "Access code validity"
 msgstr ""
 
-#: src/pages/sources/oauth/OAuthSourceForm.ts:73
+#: src/pages/sources/oauth/OAuthSourceForm.ts:74
 msgid "Access token URL"
 msgstr ""
 
@@ -100,31 +100,31 @@ msgstr ""
 msgid "Add"
 msgstr ""
 
-#: src/pages/sources/ldap/LDAPSourceForm.ts:202
+#: src/pages/sources/ldap/LDAPSourceForm.ts:200
 msgid "Addition Group DN"
 msgstr ""
 
-#: src/pages/sources/ldap/LDAPSourceForm.ts:196
+#: src/pages/sources/ldap/LDAPSourceForm.ts:194
 msgid "Addition User DN"
 msgstr ""
 
-#: src/pages/sources/ldap/LDAPSourceForm.ts:205
+#: src/pages/sources/ldap/LDAPSourceForm.ts:203
 msgid "Additional group DN, prepended to the Base DN."
 msgstr ""
 
-#: src/pages/sources/ldap/LDAPSourceForm.ts:199
+#: src/pages/sources/ldap/LDAPSourceForm.ts:197
 msgid "Additional user DN, prepended to the Base DN."
 msgstr ""
 
 #: src/pages/providers/oauth2/OAuth2ProviderForm.ts:132
 #: src/pages/providers/proxy/ProxyProviderForm.ts:153
-#: src/pages/providers/saml/SAMLProviderForm.ts:117
-#: src/pages/sources/saml/SAMLSourceForm.ts:134
+#: src/pages/providers/saml/SAMLProviderForm.ts:116
+#: src/pages/sources/saml/SAMLSourceForm.ts:132
 msgid "Advanced protocol settings"
 msgstr ""
 
 #: src/pages/policies/password/PasswordPolicyForm.ts:119
-#: src/pages/sources/ldap/LDAPSourceForm.ts:140
+#: src/pages/sources/ldap/LDAPSourceForm.ts:138
 msgid "Advanced settings"
 msgstr ""
 
@@ -132,7 +132,7 @@ msgstr ""
 msgid "Affected model:"
 msgstr ""
 
-#: src/pages/events/RuleForm.ts:45
+#: src/pages/events/RuleForm.ts:50
 msgid "Alert"
 msgstr ""
 
@@ -140,11 +140,11 @@ msgstr ""
 msgid "Algorithm used to sign the JWT Tokens."
 msgstr ""
 
-#: src/pages/sources/saml/SAMLSourceForm.ts:141
+#: src/pages/sources/saml/SAMLSourceForm.ts:139
 msgid "Allow IDP-initiated logins"
 msgstr ""
 
-#: src/pages/sources/plex/PlexSourceForm.ts:147
+#: src/pages/sources/plex/PlexSourceForm.ts:150
 msgid "Allow friends to authenticate via Plex, even if you don't share any servers"
 msgstr ""
 
@@ -160,11 +160,11 @@ msgstr ""
 msgid "Allowed count"
 msgstr ""
 
-#: src/pages/sources/plex/PlexSourceForm.ts:152
+#: src/pages/sources/plex/PlexSourceForm.ts:155
 msgid "Allowed servers"
 msgstr ""
 
-#: src/pages/sources/saml/SAMLSourceForm.ts:144
+#: src/pages/sources/saml/SAMLSourceForm.ts:142
 msgid "Allows authentication flows initiated by the IdP. This can be a security risk, as no validation of the request ID is done."
 msgstr ""
 
@@ -172,7 +172,7 @@ msgstr ""
 msgid "Allows/denys requests based on the users and/or the IPs reputation."
 msgstr ""
 
-#: src/pages/sources/saml/SAMLSourceForm.ts:96
+#: src/pages/sources/saml/SAMLSourceForm.ts:94
 msgid "Also known as Entity ID. Defaults the Metadata URL."
 msgstr ""
 
@@ -200,18 +200,17 @@ msgstr ""
 msgid "Application requires following permissions"
 msgstr ""
 
-#: src/pages/applications/ApplicationForm.ts:90
+#: src/pages/applications/ApplicationForm.ts:95
 msgid "Application's display Name."
 msgstr ""
 
 #: src/interfaces/AdminInterface.ts:38
-#: src/pages/LibraryPage.ts:93
 #: src/pages/LibraryPage.ts:130
 #: src/pages/applications/ApplicationListPage.ts:28
 msgid "Applications"
 msgstr ""
 
-#: src/pages/admin-overview/AdminOverviewPage.ts:105
+#: src/pages/admin-overview/AdminOverviewPage.ts:111
 msgid "Apps with most usage"
 msgstr ""
 
@@ -223,15 +222,15 @@ msgstr ""
 msgid "Are you sure you want to update {0} \"{1}\"?"
 msgstr ""
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:209
+#: src/pages/providers/saml/SAMLProviderForm.ts:208
 msgid "Assertion not valid on or after current time + this value (Format: hours=1;minutes=2;seconds=3)."
 msgstr ""
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:197
+#: src/pages/providers/saml/SAMLProviderForm.ts:196
 msgid "Assertion valid not before"
 msgstr ""
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:205
+#: src/pages/providers/saml/SAMLProviderForm.ts:204
 msgid "Assertion valid not on or after"
 msgstr ""
 
@@ -255,32 +254,32 @@ msgstr ""
 msgid "Attempted to log in as {0}"
 msgstr ""
 
-#: src/pages/property-mappings/PropertyMappingSAMLForm.ts:63
+#: src/pages/property-mappings/PropertyMappingSAMLForm.ts:61
 msgid "Attribute name used for SAML Assertions. Can be a URN OID, a schema reference, or a any other string. If this property mapping is used for NameID Property, this field is discarded."
 msgstr ""
 
-#: src/pages/groups/GroupForm.ts:134
+#: src/pages/groups/GroupForm.ts:139
 #: src/pages/stages/invitation/InvitationForm.ts:52
 #: src/pages/users/UserForm.ts:77
 msgid "Attributes"
 msgstr ""
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:108
+#: src/pages/providers/saml/SAMLProviderForm.ts:107
 #: src/pages/providers/saml/SAMLProviderViewPage.ts:92
 msgid "Audience"
 msgstr ""
 
-#: src/flows/sources/plex/PlexLoginInit.ts:56
+#: src/flows/sources/plex/PlexLoginInit.ts:68
 msgid "Authenticating with Plex..."
 msgstr ""
 
-#: src/pages/flows/FlowForm.ts:55
+#: src/pages/flows/FlowForm.ts:60
 msgid "Authentication"
 msgstr ""
 
-#: src/pages/sources/oauth/OAuthSourceForm.ts:212
-#: src/pages/sources/plex/PlexSourceForm.ts:182
-#: src/pages/sources/saml/SAMLSourceForm.ts:245
+#: src/pages/sources/oauth/OAuthSourceForm.ts:231
+#: src/pages/sources/plex/PlexSourceForm.ts:185
+#: src/pages/sources/saml/SAMLSourceForm.ts:243
 msgid "Authentication flow"
 msgstr ""
 
@@ -289,7 +288,7 @@ msgstr ""
 msgid "Authenticator"
 msgstr ""
 
-#: src/pages/flows/FlowForm.ts:58
+#: src/pages/flows/FlowForm.ts:63
 msgid "Authorization"
 msgstr ""
 
@@ -297,14 +296,14 @@ msgstr ""
 msgid "Authorization Code"
 msgstr ""
 
-#: src/pages/sources/oauth/OAuthSourceForm.ts:66
+#: src/pages/sources/oauth/OAuthSourceForm.ts:67
 #: src/pages/sources/oauth/OAuthSourceViewPage.ts:96
 msgid "Authorization URL"
 msgstr ""
 
 #: src/pages/providers/oauth2/OAuth2ProviderForm.ts:62
 #: src/pages/providers/proxy/ProxyProviderForm.ts:104
-#: src/pages/providers/saml/SAMLProviderForm.ts:59
+#: src/pages/providers/saml/SAMLProviderForm.ts:58
 #: src/pages/providers/saml/SAMLProviderImportForm.ts:44
 msgid "Authorization flow"
 msgstr ""
@@ -321,11 +320,11 @@ msgstr ""
 msgid "Backends"
 msgstr ""
 
-#: src/pages/flows/FlowForm.ts:124
+#: src/pages/flows/FlowForm.ts:129
 msgid "Background"
 msgstr ""
 
-#: src/pages/flows/FlowForm.ts:127
+#: src/pages/flows/FlowForm.ts:132
 #: src/pages/flows/FlowImportForm.ts:37
 msgid "Background shown during execution."
 msgstr ""
@@ -338,13 +337,13 @@ msgstr ""
 msgid "Backup finished with warnings."
 msgstr ""
 
-#: src/pages/admin-overview/AdminOverviewPage.ts:84
+#: src/pages/admin-overview/AdminOverviewPage.ts:94
 msgid "Backup status"
 msgstr ""
 
-#: src/pages/providers/ldap/LDAPProviderForm.ts:97
+#: src/pages/providers/ldap/LDAPProviderForm.ts:95
 #: src/pages/providers/ldap/LDAPProviderViewPage.ts:82
-#: src/pages/sources/ldap/LDAPSourceForm.ts:131
+#: src/pages/sources/ldap/LDAPSourceForm.ts:129
 #: src/pages/sources/ldap/LDAPSourceViewPage.ts:80
 msgid "Base DN"
 msgstr ""
@@ -369,15 +368,15 @@ msgstr ""
 msgid "Basic-Auth"
 msgstr ""
 
-#: src/pages/sources/ldap/LDAPSourceForm.ts:118
+#: src/pages/sources/ldap/LDAPSourceForm.ts:116
 msgid "Bind CN"
 msgstr ""
 
-#: src/pages/sources/ldap/LDAPSourceForm.ts:124
+#: src/pages/sources/ldap/LDAPSourceForm.ts:122
 msgid "Bind Password"
 msgstr ""
 
-#: src/pages/providers/ldap/LDAPProviderForm.ts:60
+#: src/pages/providers/ldap/LDAPProviderForm.ts:58
 msgid "Bind flow"
 msgstr ""
 
@@ -391,7 +390,7 @@ msgstr ""
 msgid "Binding"
 msgstr ""
 
-#: src/pages/sources/saml/SAMLSourceForm.ts:99
+#: src/pages/sources/saml/SAMLSourceForm.ts:97
 msgid "Binding Type"
 msgstr ""
 
@@ -404,15 +403,15 @@ msgstr ""
 msgid "Built-in"
 msgstr ""
 
-#: src/pages/outposts/ServiceConnectionDockerForm.ts:88
+#: src/pages/outposts/ServiceConnectionDockerForm.ts:86
 msgid "CA which the endpoint's Certificate is verified against. Can be left empty for no validation."
 msgstr ""
 
-#: src/pages/admin-overview/graphs/FlowStatusCard.ts:54
+#: src/pages/admin-overview/charts/FlowStatusChart.ts:54
 msgid "Cached flows"
 msgstr ""
 
-#: src/pages/admin-overview/graphs/PolicyStatusCard.ts:59
+#: src/pages/admin-overview/charts/PolicyStatusChart.ts:59
 msgid "Cached policies"
 msgstr ""
 
@@ -420,7 +419,7 @@ msgstr ""
 msgid "Callback URL"
 msgstr ""
 
-#: src/pages/outposts/ServiceConnectionDockerForm.ts:72
+#: src/pages/outposts/ServiceConnectionDockerForm.ts:70
 msgid "Can be in the format of 'unix://' when connecting to a local docker daemon, or 'https://:2376' when connecting to a remote system."
 msgstr ""
 
@@ -436,7 +435,7 @@ msgstr ""
 msgid "Case insensitive matching"
 msgstr ""
 
-#: src/pages/crypto/CertificateKeyPairForm.ts:51
+#: src/pages/crypto/CertificateKeyPairForm.ts:56
 #: src/pages/providers/proxy/ProxyProviderForm.ts:157
 msgid "Certificate"
 msgstr ""
@@ -449,7 +448,7 @@ msgstr ""
 msgid "Certificate Subjet"
 msgstr ""
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:135
+#: src/pages/providers/saml/SAMLProviderForm.ts:134
 msgid "Certificate used to sign outgoing Responses going to the Service Provider."
 msgstr ""
 
@@ -461,7 +460,7 @@ msgstr ""
 msgid "Certificate-Key Pairs"
 msgstr ""
 
-#: src/pages/outposts/ServiceConnectionDockerForm.ts:104
+#: src/pages/outposts/ServiceConnectionDockerForm.ts:102
 msgid "Certificate/Key used for authentication. Can be left empty for no authentication."
 msgstr ""
 
@@ -535,7 +534,7 @@ msgstr ""
 
 #: src/pages/providers/oauth2/OAuth2ProviderForm.ts:107
 #: src/pages/providers/oauth2/OAuth2ProviderViewPage.ts:99
-#: src/pages/sources/plex/PlexSourceForm.ts:138
+#: src/pages/sources/plex/PlexSourceForm.ts:141
 msgid "Client ID"
 msgstr ""
 
@@ -599,7 +598,7 @@ msgstr ""
 msgid "Configure how long refresh tokens and their id_tokens are valid for."
 msgstr ""
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:193
+#: src/pages/providers/saml/SAMLProviderForm.ts:192
 msgid "Configure how the NameID value will be created. When left empty, the NameIDPolicy of the incoming request will be respected."
 msgstr ""
 
@@ -611,7 +610,7 @@ msgstr ""
 msgid "Configure settings relevant to your user profile."
 msgstr ""
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:201
+#: src/pages/providers/saml/SAMLProviderForm.ts:200
 msgid "Configure the maximum allowed time drift for an asseration."
 msgstr ""
 
@@ -631,7 +630,7 @@ msgstr ""
 msgid "Connection error, reconnecting..."
 msgstr ""
 
-#: src/pages/sources/ldap/LDAPSourceForm.ts:100
+#: src/pages/sources/ldap/LDAPSourceForm.ts:98
 #: src/pages/stages/email/EmailStageForm.ts:58
 msgid "Connection settings"
 msgstr ""
@@ -652,19 +651,19 @@ msgstr ""
 msgid "Consent given last indefinitely"
 msgstr ""
 
-#: src/pages/sources/ldap/LDAPSourceForm.ts:219
+#: src/pages/sources/ldap/LDAPSourceForm.ts:217
 msgid "Consider Objects matching this filter to be Groups."
 msgstr ""
 
-#: src/pages/sources/ldap/LDAPSourceForm.ts:212
+#: src/pages/sources/ldap/LDAPSourceForm.ts:210
 msgid "Consider Objects matching this filter to be Users."
 msgstr ""
 
-#: src/pages/sources/oauth/OAuthSourceForm.ts:148
+#: src/pages/sources/oauth/OAuthSourceForm.ts:167
 msgid "Consumer key"
 msgstr ""
 
-#: src/pages/sources/oauth/OAuthSourceForm.ts:154
+#: src/pages/sources/oauth/OAuthSourceForm.ts:173
 msgid "Consumer secret"
 msgstr ""
 
@@ -705,7 +704,7 @@ msgstr ""
 msgid "Copy Key"
 msgstr ""
 
-#: src/pages/applications/ApplicationForm.ts:120
+#: src/pages/applications/ApplicationForm.ts:125
 #: src/pages/applications/ApplicationListPage.ts:121
 #: src/pages/applications/ApplicationListPage.ts:129
 #: src/pages/crypto/CertificateKeyPairListPage.ts:122
@@ -823,11 +822,11 @@ msgstr ""
 msgid "Create User"
 msgstr ""
 
-#: src/pages/applications/ApplicationForm.ts:111
+#: src/pages/applications/ApplicationForm.ts:116
 msgid "Create provider"
 msgstr ""
 
-#: src/pages/applications/ApplicationForm.ts:123
+#: src/pages/applications/ApplicationForm.ts:128
 #: src/pages/flows/BoundStagesList.ts:149
 #: src/pages/outposts/ServiceConnectionListPage.ts:122
 #: src/pages/policies/BoundPoliciesList.ts:192
@@ -857,8 +856,8 @@ msgstr ""
 msgid "Customisation"
 msgstr ""
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:256
-#: src/pages/sources/saml/SAMLSourceForm.ts:212
+#: src/pages/providers/saml/SAMLProviderForm.ts:255
+#: src/pages/sources/saml/SAMLSourceForm.ts:210
 msgid "DSA-SHA1"
 msgstr ""
 
@@ -870,7 +869,7 @@ msgstr ""
 msgid "Date Time"
 msgstr ""
 
-#: src/pages/flows/FlowForm.ts:121
+#: src/pages/flows/FlowForm.ts:126
 msgid "Decides what this Flow is used for. For example, the Authentication flow is redirect to when an un-authenticated user visits authentik."
 msgstr ""
 
@@ -922,7 +921,7 @@ msgstr ""
 msgid "Delete account"
 msgstr ""
 
-#: src/pages/sources/saml/SAMLSourceForm.ts:169
+#: src/pages/sources/saml/SAMLSourceForm.ts:167
 msgid "Delete temporary users after"
 msgstr ""
 
@@ -940,14 +939,14 @@ msgstr ""
 msgid "Deny the user access"
 msgstr ""
 
-#: src/pages/applications/ApplicationForm.ts:170
-#: src/pages/property-mappings/PropertyMappingScopeForm.ts:65
+#: src/pages/applications/ApplicationForm.ts:175
+#: src/pages/property-mappings/PropertyMappingScopeForm.ts:63
 #: src/pages/system-tasks/SystemTaskListPage.ts:55
 #: src/pages/user-settings/tokens/UserTokenForm.ts:50
 msgid "Description"
 msgstr ""
 
-#: src/pages/property-mappings/PropertyMappingScopeForm.ts:69
+#: src/pages/property-mappings/PropertyMappingScopeForm.ts:67
 msgid "Description shown to the user when consenting. If left empty, the user won't be informed."
 msgstr ""
 
@@ -955,12 +954,12 @@ msgstr ""
 msgid "Designates whether this user should be treated as active. Unselect this instead of deleting accounts."
 msgstr ""
 
-#: src/pages/flows/FlowForm.ts:114
+#: src/pages/flows/FlowForm.ts:119
 #: src/pages/flows/FlowListPage.ts:48
 msgid "Designation"
 msgstr ""
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:105
+#: src/pages/providers/saml/SAMLProviderForm.ts:104
 msgid "Determines how authentik sends the response back to the Service Provider."
 msgstr ""
 
@@ -976,8 +975,8 @@ msgstr ""
 msgid "Device name"
 msgstr ""
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:220
-#: src/pages/sources/saml/SAMLSourceForm.ts:176
+#: src/pages/providers/saml/SAMLProviderForm.ts:219
+#: src/pages/sources/saml/SAMLSourceForm.ts:174
 msgid "Digest algorithm"
 msgstr ""
 
@@ -1006,7 +1005,7 @@ msgstr ""
 msgid "Disconnect"
 msgstr ""
 
-#: src/pages/outposts/ServiceConnectionDockerForm.ts:68
+#: src/pages/outposts/ServiceConnectionDockerForm.ts:66
 msgid "Docker URL"
 msgstr ""
 
@@ -1079,7 +1078,7 @@ msgid "Either no applications are defined, or you don't have access to any."
 msgstr ""
 
 #: src/flows/stages/identification/IdentificationStage.ts:146
-#: src/pages/events/TransportForm.ts:46
+#: src/pages/events/TransportForm.ts:51
 #: src/pages/stages/identification/IdentificationStageForm.ts:81
 #: src/pages/user-settings/UserDetailsPage.ts:71
 #: src/pages/users/UserForm.ts:61
@@ -1087,7 +1086,7 @@ msgstr ""
 msgid "Email"
 msgstr ""
 
-#: src/pages/sources/saml/SAMLSourceForm.ts:155
+#: src/pages/sources/saml/SAMLSourceForm.ts:153
 msgid "Email address"
 msgstr ""
 
@@ -1104,7 +1103,7 @@ msgstr ""
 msgid "Enable"
 msgstr ""
 
-#: src/pages/sources/ldap/LDAPSourceForm.ts:113
+#: src/pages/sources/ldap/LDAPSourceForm.ts:111
 msgid "Enable StartTLS"
 msgstr ""
 
@@ -1125,21 +1124,21 @@ msgid "Enable this if you don't want to use this provider as a proxy, and want t
 msgstr ""
 
 #: src/pages/policies/BoundPoliciesList.ts:41
-#: src/pages/policies/PolicyBindingForm.ts:198
-#: src/pages/sources/ldap/LDAPSourceForm.ts:69
-#: src/pages/sources/oauth/OAuthSourceForm.ts:115
-#: src/pages/sources/plex/PlexSourceForm.ts:105
-#: src/pages/sources/saml/SAMLSourceForm.ts:69
+#: src/pages/policies/PolicyBindingForm.ts:199
+#: src/pages/sources/ldap/LDAPSourceForm.ts:67
+#: src/pages/sources/oauth/OAuthSourceForm.ts:134
+#: src/pages/sources/plex/PlexSourceForm.ts:108
+#: src/pages/sources/saml/SAMLSourceForm.ts:67
 msgid "Enabled"
 msgstr ""
 
-#: src/pages/flows/FlowForm.ts:61
+#: src/pages/flows/FlowForm.ts:66
 msgid "Enrollment"
 msgstr ""
 
-#: src/pages/sources/oauth/OAuthSourceForm.ts:233
-#: src/pages/sources/plex/PlexSourceForm.ts:203
-#: src/pages/sources/saml/SAMLSourceForm.ts:266
+#: src/pages/sources/oauth/OAuthSourceForm.ts:252
+#: src/pages/sources/plex/PlexSourceForm.ts:206
+#: src/pages/sources/saml/SAMLSourceForm.ts:264
 #: src/pages/stages/identification/IdentificationStageForm.ts:106
 msgid "Enrollment flow"
 msgstr ""
@@ -1172,15 +1171,15 @@ msgstr ""
 msgid "Error: unsupported stage settings: {0}"
 msgstr ""
 
-#: src/pages/flows/StageBindingForm.ts:119
+#: src/pages/flows/StageBindingForm.ts:124
 msgid "Evaluate on plan"
 msgstr ""
 
-#: src/pages/flows/StageBindingForm.ts:133
+#: src/pages/flows/StageBindingForm.ts:138
 msgid "Evaluate policies before the Stage is present to the user."
 msgstr ""
 
-#: src/pages/flows/StageBindingForm.ts:123
+#: src/pages/flows/StageBindingForm.ts:128
 msgid "Evaluate policies during the Flow planning process. Disable this for input-based policies. Should be used in conjunction with 'Re-evaluate policies', as with this option disabled, policies are **not** evaluated."
 msgstr ""
 
@@ -1218,7 +1217,7 @@ msgstr ""
 msgid "Executes the python snippet to determine whether to allow or deny a request."
 msgstr ""
 
-#: src/pages/policies/dummy/DummyPolicyForm.ts:65
+#: src/pages/policies/dummy/DummyPolicyForm.ts:63
 #: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:66
 #: src/pages/policies/expiry/ExpiryPolicyForm.ts:65
 #: src/pages/policies/expression/ExpressionPolicyForm.ts:66
@@ -1263,16 +1262,16 @@ msgstr ""
 
 #: src/pages/events/EventInfo.ts:133
 #: src/pages/policies/expression/ExpressionPolicyForm.ts:79
-#: src/pages/property-mappings/PropertyMappingLDAPForm.ts:65
-#: src/pages/property-mappings/PropertyMappingSAMLForm.ts:75
-#: src/pages/property-mappings/PropertyMappingScopeForm.ts:72
+#: src/pages/property-mappings/PropertyMappingLDAPForm.ts:63
+#: src/pages/property-mappings/PropertyMappingSAMLForm.ts:73
+#: src/pages/property-mappings/PropertyMappingScopeForm.ts:70
 msgid "Expression"
 msgstr ""
 
 #: src/pages/policies/expression/ExpressionPolicyForm.ts:85
-#: src/pages/property-mappings/PropertyMappingLDAPForm.ts:71
-#: src/pages/property-mappings/PropertyMappingSAMLForm.ts:81
-#: src/pages/property-mappings/PropertyMappingScopeForm.ts:78
+#: src/pages/property-mappings/PropertyMappingLDAPForm.ts:69
+#: src/pages/property-mappings/PropertyMappingSAMLForm.ts:79
+#: src/pages/property-mappings/PropertyMappingScopeForm.ts:76
 msgid "Expression using Python."
 msgstr ""
 
@@ -1292,7 +1291,7 @@ msgstr ""
 msgid "Failed attempts before cancel"
 msgstr ""
 
-#: src/pages/admin-overview/graphs/LDAPSyncStatusCard.ts:76
+#: src/pages/admin-overview/charts/LDAPSyncStatusChart.ts:76
 msgid "Failed sources"
 msgstr ""
 
@@ -1317,15 +1316,15 @@ msgstr ""
 msgid "Field key to check, field keys defined in Prompt stages are available."
 msgstr ""
 
-#: src/pages/property-mappings/PropertyMappingLDAPForm.ts:62
+#: src/pages/property-mappings/PropertyMappingLDAPForm.ts:60
 msgid "Field of the user object this value is written to."
 msgstr ""
 
-#: src/pages/sources/ldap/LDAPSourceForm.ts:233
+#: src/pages/sources/ldap/LDAPSourceForm.ts:231
 msgid "Field which contains a unique Identifier."
 msgstr ""
 
-#: src/pages/sources/ldap/LDAPSourceForm.ts:226
+#: src/pages/sources/ldap/LDAPSourceForm.ts:224
 msgid "Field which contains members of a group."
 msgstr ""
 
@@ -1346,25 +1345,25 @@ msgstr ""
 msgid "Flow Overview"
 msgstr ""
 
-#: src/pages/sources/oauth/OAuthSourceForm.ts:208
-#: src/pages/sources/plex/PlexSourceForm.ts:178
-#: src/pages/sources/saml/SAMLSourceForm.ts:220
+#: src/pages/sources/oauth/OAuthSourceForm.ts:227
+#: src/pages/sources/plex/PlexSourceForm.ts:181
+#: src/pages/sources/saml/SAMLSourceForm.ts:218
 msgid "Flow settings"
 msgstr ""
 
-#: src/pages/sources/oauth/OAuthSourceForm.ts:230
-#: src/pages/sources/plex/PlexSourceForm.ts:200
-#: src/pages/sources/saml/SAMLSourceForm.ts:263
+#: src/pages/sources/oauth/OAuthSourceForm.ts:249
+#: src/pages/sources/plex/PlexSourceForm.ts:203
+#: src/pages/sources/saml/SAMLSourceForm.ts:261
 msgid "Flow to use when authenticating existing users."
 msgstr ""
 
-#: src/pages/sources/oauth/OAuthSourceForm.ts:251
-#: src/pages/sources/plex/PlexSourceForm.ts:221
-#: src/pages/sources/saml/SAMLSourceForm.ts:284
+#: src/pages/sources/oauth/OAuthSourceForm.ts:270
+#: src/pages/sources/plex/PlexSourceForm.ts:224
+#: src/pages/sources/saml/SAMLSourceForm.ts:282
 msgid "Flow to use when enrolling new users."
 msgstr ""
 
-#: src/pages/sources/saml/SAMLSourceForm.ts:242
+#: src/pages/sources/saml/SAMLSourceForm.ts:240
 msgid "Flow used before authentication."
 msgstr ""
 
@@ -1377,13 +1376,13 @@ msgstr ""
 msgid "Flow used by an authenticated user to configure this Stage. If empty, user will not be able to configure this stage."
 msgstr ""
 
-#: src/pages/providers/ldap/LDAPProviderForm.ts:74
+#: src/pages/providers/ldap/LDAPProviderForm.ts:72
 msgid "Flow used for users to authenticate. Currently only identification and password stages are supported."
 msgstr ""
 
 #: src/pages/providers/oauth2/OAuth2ProviderForm.ts:76
 #: src/pages/providers/proxy/ProxyProviderForm.ts:118
-#: src/pages/providers/saml/SAMLProviderForm.ts:73
+#: src/pages/providers/saml/SAMLProviderForm.ts:72
 #: src/pages/providers/saml/SAMLProviderImportForm.ts:57
 msgid "Flow used when authorizing this provider."
 msgstr ""
@@ -1416,7 +1415,7 @@ msgstr ""
 msgid "Form didn't return a promise for submitting"
 msgstr ""
 
-#: src/pages/property-mappings/PropertyMappingSAMLForm.ts:67
+#: src/pages/property-mappings/PropertyMappingSAMLForm.ts:65
 msgid "Friendly Name"
 msgstr ""
 
@@ -1445,23 +1444,23 @@ msgstr ""
 msgid "Go to previous page"
 msgstr ""
 
-#: src/pages/events/RuleForm.ts:65
+#: src/pages/events/RuleForm.ts:70
 #: src/pages/groups/GroupListPage.ts:74
-#: src/pages/policies/PolicyBindingForm.ts:124
-#: src/pages/policies/PolicyBindingForm.ts:160
-#: src/pages/providers/ldap/LDAPProviderForm.ts:77
+#: src/pages/policies/PolicyBindingForm.ts:125
+#: src/pages/policies/PolicyBindingForm.ts:161
+#: src/pages/providers/ldap/LDAPProviderForm.ts:75
 msgid "Group"
 msgstr ""
 
-#: src/pages/sources/ldap/LDAPSourceForm.ts:170
+#: src/pages/sources/ldap/LDAPSourceForm.ts:168
 msgid "Group Property Mappings"
 msgstr ""
 
-#: src/pages/sources/ldap/LDAPSourceForm.ts:222
+#: src/pages/sources/ldap/LDAPSourceForm.ts:220
 msgid "Group membership field"
 msgstr ""
 
-#: src/pages/sources/ldap/LDAPSourceForm.ts:215
+#: src/pages/sources/ldap/LDAPSourceForm.ts:213
 msgid "Group object filter"
 msgstr ""
 
@@ -1474,6 +1473,7 @@ msgid "Group {0}"
 msgstr ""
 
 #: src/interfaces/AdminInterface.ts:103
+#: src/pages/admin-overview/AdminOverviewPage.ts:76
 #: src/pages/groups/GroupListPage.ts:27
 msgid "Groups"
 msgstr ""
@@ -1494,11 +1494,11 @@ msgstr ""
 msgid "Health and Version"
 msgstr ""
 
-#: src/pages/admin-overview/graphs/OutpostStatusCard.ts:70
+#: src/pages/admin-overview/charts/OutpostStatusChart.ts:70
 msgid "Healthy outposts"
 msgstr ""
 
-#: src/pages/admin-overview/graphs/LDAPSyncStatusCard.ts:75
+#: src/pages/admin-overview/charts/LDAPSyncStatusChart.ts:75
 msgid "Healthy sources"
 msgstr ""
 
@@ -1514,14 +1514,14 @@ msgstr ""
 msgid "Hide service-accounts"
 msgstr ""
 
-#: src/pages/events/RuleForm.ts:93
-#: src/pages/groups/GroupForm.ts:131
-#: src/pages/outposts/OutpostForm.ts:110
+#: src/pages/events/RuleForm.ts:98
+#: src/pages/groups/GroupForm.ts:136
+#: src/pages/outposts/OutpostForm.ts:115
 #: src/pages/providers/oauth2/OAuth2ProviderForm.ts:188
-#: src/pages/providers/saml/SAMLProviderForm.ts:177
-#: src/pages/sources/ldap/LDAPSourceForm.ts:167
-#: src/pages/sources/ldap/LDAPSourceForm.ts:193
-#: src/pages/sources/plex/PlexSourceForm.ts:165
+#: src/pages/providers/saml/SAMLProviderForm.ts:176
+#: src/pages/sources/ldap/LDAPSourceForm.ts:165
+#: src/pages/sources/ldap/LDAPSourceForm.ts:191
+#: src/pages/sources/plex/PlexSourceForm.ts:168
 #: src/pages/stages/authenticator_validate/AuthenticatorValidateStageForm.ts:114
 #: src/pages/stages/identification/IdentificationStageForm.ts:85
 #: src/pages/stages/password/PasswordStageForm.ts:86
@@ -1538,7 +1538,7 @@ msgstr ""
 msgid "ID"
 msgstr ""
 
-#: src/pages/applications/ApplicationForm.ts:165
+#: src/pages/applications/ApplicationForm.ts:170
 msgid "Icon"
 msgstr ""
 
@@ -1554,12 +1554,12 @@ msgstr ""
 msgid "Identity & Cryptography"
 msgstr ""
 
-#: src/pages/outposts/ServiceConnectionDockerForm.ts:65
-#: src/pages/outposts/ServiceConnectionKubernetesForm.ts:66
+#: src/pages/outposts/ServiceConnectionDockerForm.ts:63
+#: src/pages/outposts/ServiceConnectionKubernetesForm.ts:64
 msgid "If enabled, use the local connection. Required Docker socket/Kubernetes Integration."
 msgstr ""
 
-#: src/pages/applications/ApplicationForm.ts:162
+#: src/pages/applications/ApplicationForm.ts:167
 msgid "If left empty, authentik will try to extract the launch URL based on the selected provider."
 msgstr ""
 
@@ -1604,7 +1604,7 @@ msgstr ""
 msgid "Internal Host"
 msgstr ""
 
-#: src/pages/applications/ApplicationForm.ts:97
+#: src/pages/applications/ApplicationForm.ts:102
 msgid "Internal application name, used in URLs."
 msgstr ""
 
@@ -1616,7 +1616,7 @@ msgstr ""
 msgid "Internal host SSL Validation"
 msgstr ""
 
-#: src/pages/flows/FlowForm.ts:64
+#: src/pages/flows/FlowForm.ts:69
 msgid "Invalidation"
 msgstr ""
 
@@ -1629,13 +1629,13 @@ msgstr ""
 msgid "Is active"
 msgstr ""
 
-#: src/pages/groups/GroupForm.ts:62
+#: src/pages/groups/GroupForm.ts:67
 msgid "Is superuser"
 msgstr ""
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:88
+#: src/pages/providers/saml/SAMLProviderForm.ts:87
 #: src/pages/providers/saml/SAMLProviderViewPage.ts:100
-#: src/pages/sources/saml/SAMLSourceForm.ts:93
+#: src/pages/sources/saml/SAMLSourceForm.ts:91
 #: src/pages/sources/saml/SAMLSourceViewPage.ts:90
 msgid "Issuer"
 msgstr ""
@@ -1652,23 +1652,23 @@ msgstr ""
 msgid "Key used to sign the tokens. Only required when JWT Algorithm is set to RS256."
 msgstr ""
 
-#: src/pages/sources/saml/SAMLSourceForm.ts:128
+#: src/pages/sources/saml/SAMLSourceForm.ts:126
 msgid "Keypair which is used to sign outgoing requests. Leave empty to disable signing."
 msgstr ""
 
-#: src/pages/outposts/ServiceConnectionKubernetesForm.ts:69
+#: src/pages/outposts/ServiceConnectionKubernetesForm.ts:67
 msgid "Kubeconfig"
 msgstr ""
 
-#: src/pages/outposts/OutpostForm.ts:58
+#: src/pages/outposts/OutpostForm.ts:63
 msgid "LDAP (Technical preview)"
 msgstr ""
 
-#: src/pages/providers/ldap/LDAPProviderForm.ts:101
+#: src/pages/providers/ldap/LDAPProviderForm.ts:99
 msgid "LDAP DN under which bind requests and search requests can be made."
 msgstr ""
 
-#: src/pages/admin-overview/AdminOverviewPage.ts:66
+#: src/pages/admin-overview/AdminOverviewPage.ts:81
 msgid "LDAP Sync status"
 msgstr ""
 
@@ -1704,7 +1704,7 @@ msgstr ""
 msgid "Launch"
 msgstr ""
 
-#: src/pages/applications/ApplicationForm.ts:159
+#: src/pages/applications/ApplicationForm.ts:164
 msgid "Launch URL"
 msgstr ""
 
@@ -1716,22 +1716,22 @@ msgstr ""
 msgid "Library"
 msgstr ""
 
-#: src/pages/sources/oauth/OAuthSourceForm.ts:128
-#: src/pages/sources/plex/PlexSourceForm.ts:118
+#: src/pages/sources/oauth/OAuthSourceForm.ts:147
+#: src/pages/sources/plex/PlexSourceForm.ts:121
 msgid "Link to a user with identical email address. Can have security implications when a source doesn't validate email addresses"
 msgstr ""
 
-#: src/pages/sources/oauth/OAuthSourceForm.ts:134
-#: src/pages/sources/plex/PlexSourceForm.ts:124
+#: src/pages/sources/oauth/OAuthSourceForm.ts:153
+#: src/pages/sources/plex/PlexSourceForm.ts:127
 msgid "Link to a user with identical username address. Can have security implications when a username is used with another source."
 msgstr ""
 
-#: src/pages/sources/oauth/OAuthSourceForm.ts:125
-#: src/pages/sources/plex/PlexSourceForm.ts:115
+#: src/pages/sources/oauth/OAuthSourceForm.ts:144
+#: src/pages/sources/plex/PlexSourceForm.ts:118
 msgid "Link users on unique identifier"
 msgstr ""
 
-#: src/pages/sources/plex/PlexSourceForm.ts:170
+#: src/pages/sources/plex/PlexSourceForm.ts:173
 msgid "Load servers"
 msgstr ""
 
@@ -1759,49 +1759,49 @@ msgid "Loading"
 msgstr ""
 
 #: src/elements/Spinner.ts:29
-#: src/pages/applications/ApplicationForm.ts:106
-#: src/pages/events/RuleForm.ts:74
-#: src/pages/events/RuleForm.ts:90
-#: src/pages/flows/StageBindingForm.ts:89
-#: src/pages/flows/StageBindingForm.ts:106
-#: src/pages/groups/GroupForm.ts:77
-#: src/pages/groups/GroupForm.ts:127
-#: src/pages/outposts/OutpostForm.ts:75
-#: src/pages/outposts/OutpostForm.ts:97
-#: src/pages/outposts/OutpostForm.ts:108
-#: src/pages/outposts/ServiceConnectionDockerForm.ts:86
-#: src/pages/outposts/ServiceConnectionDockerForm.ts:102
-#: src/pages/policies/PolicyBindingForm.ts:156
-#: src/pages/policies/PolicyBindingForm.ts:172
-#: src/pages/policies/PolicyBindingForm.ts:188
+#: src/pages/applications/ApplicationForm.ts:111
+#: src/pages/events/RuleForm.ts:79
+#: src/pages/events/RuleForm.ts:95
+#: src/pages/flows/StageBindingForm.ts:94
+#: src/pages/flows/StageBindingForm.ts:111
+#: src/pages/groups/GroupForm.ts:82
+#: src/pages/groups/GroupForm.ts:132
+#: src/pages/outposts/OutpostForm.ts:80
+#: src/pages/outposts/OutpostForm.ts:102
+#: src/pages/outposts/OutpostForm.ts:113
+#: src/pages/outposts/ServiceConnectionDockerForm.ts:84
+#: src/pages/outposts/ServiceConnectionDockerForm.ts:100
+#: src/pages/policies/PolicyBindingForm.ts:157
+#: src/pages/policies/PolicyBindingForm.ts:173
+#: src/pages/policies/PolicyBindingForm.ts:189
 #: src/pages/policies/PolicyTestForm.ts:71
 #: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:88
 #: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:108
 #: src/pages/property-mappings/PropertyMappingTestForm.ts:61
-#: src/pages/providers/ldap/LDAPProviderForm.ts:72
-#: src/pages/providers/ldap/LDAPProviderForm.ts:86
+#: src/pages/providers/ldap/LDAPProviderForm.ts:70
+#: src/pages/providers/ldap/LDAPProviderForm.ts:84
 #: src/pages/providers/oauth2/OAuth2ProviderForm.ts:74
 #: src/pages/providers/oauth2/OAuth2ProviderForm.ts:185
 #: src/pages/providers/oauth2/OAuth2ProviderForm.ts:207
 #: src/pages/providers/proxy/ProxyProviderForm.ts:116
 #: src/pages/providers/proxy/ProxyProviderForm.ts:168
-#: src/pages/providers/saml/SAMLProviderForm.ts:71
-#: src/pages/providers/saml/SAMLProviderForm.ts:133
-#: src/pages/providers/saml/SAMLProviderForm.ts:149
-#: src/pages/providers/saml/SAMLProviderForm.ts:175
-#: src/pages/providers/saml/SAMLProviderForm.ts:191
+#: src/pages/providers/saml/SAMLProviderForm.ts:70
+#: src/pages/providers/saml/SAMLProviderForm.ts:132
+#: src/pages/providers/saml/SAMLProviderForm.ts:148
+#: src/pages/providers/saml/SAMLProviderForm.ts:174
+#: src/pages/providers/saml/SAMLProviderForm.ts:190
 #: src/pages/providers/saml/SAMLProviderImportForm.ts:55
-#: src/pages/sources/ldap/LDAPSourceForm.ts:164
-#: src/pages/sources/ldap/LDAPSourceForm.ts:190
-#: src/pages/sources/oauth/OAuthSourceForm.ts:200
-#: src/pages/sources/oauth/OAuthSourceForm.ts:228
-#: src/pages/sources/oauth/OAuthSourceForm.ts:249
-#: src/pages/sources/plex/PlexSourceForm.ts:198
-#: src/pages/sources/plex/PlexSourceForm.ts:219
-#: src/pages/sources/saml/SAMLSourceForm.ts:126
-#: src/pages/sources/saml/SAMLSourceForm.ts:240
-#: src/pages/sources/saml/SAMLSourceForm.ts:261
-#: src/pages/sources/saml/SAMLSourceForm.ts:282
+#: src/pages/sources/ldap/LDAPSourceForm.ts:162
+#: src/pages/sources/ldap/LDAPSourceForm.ts:188
+#: src/pages/sources/oauth/OAuthSourceForm.ts:219
+#: src/pages/sources/oauth/OAuthSourceForm.ts:247
+#: src/pages/sources/oauth/OAuthSourceForm.ts:268
+#: src/pages/sources/plex/PlexSourceForm.ts:201
+#: src/pages/sources/plex/PlexSourceForm.ts:222
+#: src/pages/sources/saml/SAMLSourceForm.ts:124
+#: src/pages/sources/saml/SAMLSourceForm.ts:238
+#: src/pages/sources/saml/SAMLSourceForm.ts:259
+#: src/pages/sources/saml/SAMLSourceForm.ts:280
 #: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts:90
 #: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts:96
 #: src/pages/stages/authenticator_validate/AuthenticatorValidateStageForm.ts:131
@@ -1814,8 +1814,8 @@ msgstr ""
 msgid "Loading..."
 msgstr ""
 
-#: src/pages/outposts/ServiceConnectionDockerForm.ts:62
-#: src/pages/outposts/ServiceConnectionKubernetesForm.ts:63
+#: src/pages/outposts/ServiceConnectionDockerForm.ts:60
+#: src/pages/outposts/ServiceConnectionKubernetesForm.ts:61
 #: src/pages/outposts/ServiceConnectionListPage.ts:55
 msgid "Local"
 msgstr ""
@@ -1824,7 +1824,7 @@ msgstr ""
 msgid "Log the currently pending user in."
 msgstr ""
 
-#: src/pages/sources/ldap/LDAPSourceForm.ts:88
+#: src/pages/sources/ldap/LDAPSourceForm.ts:86
 msgid "Login password is synced from LDAP into authentik automatically. Enable this option only to write password changes in authentik back to LDAP."
 msgstr ""
 
@@ -1836,7 +1836,7 @@ msgstr ""
 msgid "Logins"
 msgstr ""
 
-#: src/pages/admin-overview/AdminOverviewPage.ts:100
+#: src/pages/admin-overview/AdminOverviewPage.ts:106
 #: src/pages/applications/ApplicationViewPage.ts:128
 msgid "Logins over the last 24 hours"
 msgstr ""
@@ -1873,7 +1873,7 @@ msgstr ""
 msgid "Maximum age (in days)"
 msgstr ""
 
-#: src/pages/groups/GroupForm.ts:81
+#: src/pages/groups/GroupForm.ts:86
 #: src/pages/groups/GroupListPage.ts:47
 msgid "Members"
 msgstr ""
@@ -1907,7 +1907,7 @@ msgstr ""
 msgid "Minimum length"
 msgstr ""
 
-#: src/pages/events/TransportForm.ts:79
+#: src/pages/events/TransportForm.ts:84
 #: src/pages/events/TransportListPage.ts:47
 #: src/pages/stages/consent/ConsentStageForm.ts:68
 msgid "Mode"
@@ -1921,56 +1921,60 @@ msgstr ""
 msgid "Monitor"
 msgstr ""
 
-#: src/pages/applications/ApplicationForm.ts:86
+#: src/pages/LibraryPage.ts:93
+msgid "My Applications"
+msgstr ""
+
+#: src/pages/applications/ApplicationForm.ts:91
 #: src/pages/applications/ApplicationListPage.ts:58
-#: src/pages/crypto/CertificateKeyPairForm.ts:45
+#: src/pages/crypto/CertificateKeyPairForm.ts:50
 #: src/pages/crypto/CertificateKeyPairListPage.ts:51
 #: src/pages/events/EventInfo.ts:51
-#: src/pages/events/RuleForm.ts:59
+#: src/pages/events/RuleForm.ts:64
 #: src/pages/events/RuleListPage.ts:47
-#: src/pages/events/TransportForm.ts:73
+#: src/pages/events/TransportForm.ts:78
 #: src/pages/events/TransportListPage.ts:46
 #: src/pages/flows/BoundStagesList.ts:39
-#: src/pages/flows/FlowForm.ts:81
+#: src/pages/flows/FlowForm.ts:86
 #: src/pages/flows/FlowListPage.ts:47
-#: src/pages/groups/GroupForm.ts:53
+#: src/pages/groups/GroupForm.ts:58
 #: src/pages/groups/GroupListPage.ts:45
 #: src/pages/groups/MemberSelectModal.ts:45
-#: src/pages/outposts/OutpostForm.ts:47
+#: src/pages/outposts/OutpostForm.ts:52
 #: src/pages/outposts/OutpostListPage.ts:50
-#: src/pages/outposts/ServiceConnectionDockerForm.ts:53
-#: src/pages/outposts/ServiceConnectionKubernetesForm.ts:54
+#: src/pages/outposts/ServiceConnectionDockerForm.ts:51
+#: src/pages/outposts/ServiceConnectionKubernetesForm.ts:52
 #: src/pages/outposts/ServiceConnectionListPage.ts:53
 #: src/pages/policies/PolicyListPage.ts:56
-#: src/pages/policies/dummy/DummyPolicyForm.ts:56
+#: src/pages/policies/dummy/DummyPolicyForm.ts:54
 #: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:57
 #: src/pages/policies/expiry/ExpiryPolicyForm.ts:56
 #: src/pages/policies/expression/ExpressionPolicyForm.ts:57
 #: src/pages/policies/hibp/HaveIBeenPwnedPolicyForm.ts:57
 #: src/pages/policies/password/PasswordPolicyForm.ts:56
 #: src/pages/policies/reputation/ReputationPolicyForm.ts:56
-#: src/pages/property-mappings/PropertyMappingLDAPForm.ts:52
+#: src/pages/property-mappings/PropertyMappingLDAPForm.ts:50
 #: src/pages/property-mappings/PropertyMappingListPage.ts:54
-#: src/pages/property-mappings/PropertyMappingSAMLForm.ts:52
-#: src/pages/property-mappings/PropertyMappingScopeForm.ts:52
+#: src/pages/property-mappings/PropertyMappingSAMLForm.ts:50
+#: src/pages/property-mappings/PropertyMappingScopeForm.ts:50
 #: src/pages/providers/ProviderListPage.ts:53
-#: src/pages/providers/ldap/LDAPProviderForm.ts:54
+#: src/pages/providers/ldap/LDAPProviderForm.ts:52
 #: src/pages/providers/ldap/LDAPProviderViewPage.ts:64
 #: src/pages/providers/oauth2/OAuth2ProviderForm.ts:56
 #: src/pages/providers/oauth2/OAuth2ProviderViewPage.ts:73
 #: src/pages/providers/proxy/ProxyProviderForm.ts:98
 #: src/pages/providers/proxy/ProxyProviderViewPage.ts:64
-#: src/pages/providers/saml/SAMLProviderForm.ts:53
+#: src/pages/providers/saml/SAMLProviderForm.ts:52
 #: src/pages/providers/saml/SAMLProviderImportForm.ts:38
 #: src/pages/providers/saml/SAMLProviderViewPage.ts:66
 #: src/pages/sources/SourcesListPage.ts:52
-#: src/pages/sources/ldap/LDAPSourceForm.ts:54
+#: src/pages/sources/ldap/LDAPSourceForm.ts:52
 #: src/pages/sources/ldap/LDAPSourceViewPage.ts:64
-#: src/pages/sources/oauth/OAuthSourceForm.ts:100
+#: src/pages/sources/oauth/OAuthSourceForm.ts:108
 #: src/pages/sources/oauth/OAuthSourceViewPage.ts:64
-#: src/pages/sources/plex/PlexSourceForm.ts:90
+#: src/pages/sources/plex/PlexSourceForm.ts:93
 #: src/pages/sources/plex/PlexSourceViewPage.ts:63
-#: src/pages/sources/saml/SAMLSourceForm.ts:54
+#: src/pages/sources/saml/SAMLSourceForm.ts:52
 #: src/pages/sources/saml/SAMLSourceViewPage.ts:66
 #: src/pages/stages/StageListPage.ts:65
 #: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts:57
@@ -2001,11 +2005,11 @@ msgstr ""
 msgid "Name of the form field, also used to store the value."
 msgstr ""
 
-#: src/pages/sources/saml/SAMLSourceForm.ts:147
+#: src/pages/sources/saml/SAMLSourceForm.ts:145
 msgid "NameID Policy"
 msgstr ""
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:180
+#: src/pages/providers/saml/SAMLProviderForm.ts:179
 msgid "NameID Property Mapping"
 msgstr ""
 
@@ -2113,7 +2117,7 @@ msgstr ""
 msgid "Not you?"
 msgstr ""
 
-#: src/pages/events/RuleForm.ts:51
+#: src/pages/events/RuleForm.ts:56
 msgid "Notice"
 msgstr ""
 
@@ -2156,11 +2160,11 @@ msgstr ""
 msgid "Object"
 msgstr ""
 
-#: src/pages/property-mappings/PropertyMappingLDAPForm.ts:58
+#: src/pages/property-mappings/PropertyMappingLDAPForm.ts:56
 msgid "Object field"
 msgstr ""
 
-#: src/pages/sources/ldap/LDAPSourceForm.ts:229
+#: src/pages/sources/ldap/LDAPSourceForm.ts:227
 msgid "Object uniqueness field"
 msgstr ""
 
@@ -2178,7 +2182,7 @@ msgstr ""
 msgid "Only fail the policy, don't invalidate user's password."
 msgstr ""
 
-#: src/pages/events/TransportForm.ts:102
+#: src/pages/events/TransportForm.ts:107
 msgid "Only send notification once, for example when sending a webhook into a chat channel."
 msgstr ""
 
@@ -2194,11 +2198,11 @@ msgstr ""
 msgid "OpenID Configuration URL"
 msgstr ""
 
-#: src/pages/crypto/CertificateKeyPairForm.ts:63
+#: src/pages/crypto/CertificateKeyPairForm.ts:68
 msgid "Optional Private Key. If this is set, you can use this keypair for encryption."
 msgstr ""
 
-#: src/pages/sources/saml/SAMLSourceForm.ts:90
+#: src/pages/sources/saml/SAMLSourceForm.ts:88
 msgid "Optional URL if the IDP supports Single-Logout."
 msgstr ""
 
@@ -2222,20 +2226,20 @@ msgstr ""
 msgid "Optionally pre-fill the input value"
 msgstr ""
 
-#: src/pages/property-mappings/PropertyMappingSAMLForm.ts:71
+#: src/pages/property-mappings/PropertyMappingSAMLForm.ts:69
 msgid "Optionally set the 'FriendlyName' value of the Assertion attribute."
 msgstr ""
 
 #: src/pages/flows/BoundStagesList.ts:38
-#: src/pages/flows/StageBindingForm.ts:110
+#: src/pages/flows/StageBindingForm.ts:115
 #: src/pages/policies/BoundPoliciesList.ts:42
-#: src/pages/policies/PolicyBindingForm.ts:203
+#: src/pages/policies/PolicyBindingForm.ts:204
 #: src/pages/stages/prompt/PromptForm.ts:119
 #: src/pages/stages/prompt/PromptListPage.ts:49
 msgid "Order"
 msgstr ""
 
-#: src/pages/admin-overview/graphs/OutpostStatusCard.ts:71
+#: src/pages/admin-overview/charts/OutpostStatusChart.ts:71
 msgid "Outdated outposts"
 msgstr ""
 
@@ -2251,7 +2255,7 @@ msgstr ""
 msgid "Outpost Service-connection"
 msgstr ""
 
-#: src/pages/admin-overview/AdminOverviewPage.ts:71
+#: src/pages/admin-overview/AdminOverviewPage.ts:66
 msgid "Outpost status"
 msgstr ""
 
@@ -2279,16 +2283,16 @@ msgstr ""
 msgid "Overview"
 msgstr ""
 
-#: src/pages/crypto/CertificateKeyPairForm.ts:56
+#: src/pages/crypto/CertificateKeyPairForm.ts:61
 msgid "PEM-encoded Certificate data."
 msgstr ""
 
-#: src/pages/groups/GroupForm.ts:68
+#: src/pages/groups/GroupForm.ts:73
 #: src/pages/groups/GroupListPage.ts:46
 msgid "Parent"
 msgstr ""
 
-#: src/pages/policies/dummy/DummyPolicyForm.ts:81
+#: src/pages/policies/dummy/DummyPolicyForm.ts:79
 msgid "Pass policy?"
 msgstr ""
 
@@ -2310,7 +2314,7 @@ msgstr ""
 msgid "Password: Masked input, password is validated against sources. Policies still have to be applied to this Stage. If two of these are used in the same stage, they are ensured to be identical."
 msgstr ""
 
-#: src/pages/sources/saml/SAMLSourceForm.ts:152
+#: src/pages/sources/saml/SAMLSourceForm.ts:150
 msgid "Persistent"
 msgstr ""
 
@@ -2334,9 +2338,9 @@ msgstr ""
 msgid "Policies"
 msgstr ""
 
-#: src/pages/policies/PolicyBindingForm.ts:107
-#: src/pages/policies/PolicyBindingForm.ts:116
-#: src/pages/policies/PolicyBindingForm.ts:147
+#: src/pages/policies/PolicyBindingForm.ts:108
+#: src/pages/policies/PolicyBindingForm.ts:117
+#: src/pages/policies/PolicyBindingForm.ts:148
 #: src/pages/policies/PolicyListPage.ts:108
 msgid "Policy"
 msgstr ""
@@ -2360,10 +2364,10 @@ msgstr ""
 msgid "Policy binding"
 msgstr ""
 
-#: src/pages/applications/ApplicationForm.ts:141
+#: src/pages/applications/ApplicationForm.ts:146
 #: src/pages/applications/ApplicationViewPage.ts:81
-#: src/pages/flows/FlowForm.ts:101
-#: src/pages/flows/StageBindingForm.ts:136
+#: src/pages/flows/FlowForm.ts:106
+#: src/pages/flows/StageBindingForm.ts:141
 msgid "Policy engine mode"
 msgstr ""
 
@@ -2371,7 +2375,7 @@ msgstr ""
 msgid "Policy {0}"
 msgstr ""
 
-#: src/pages/policies/dummy/DummyPolicyForm.ts:74
+#: src/pages/policies/dummy/DummyPolicyForm.ts:72
 #: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:75
 #: src/pages/policies/expiry/ExpiryPolicyForm.ts:74
 #: src/pages/policies/expression/ExpressionPolicyForm.ts:75
@@ -2381,15 +2385,15 @@ msgstr ""
 msgid "Policy-specific settings"
 msgstr ""
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:102
+#: src/pages/providers/saml/SAMLProviderForm.ts:101
 msgid "Post"
 msgstr ""
 
-#: src/pages/sources/saml/SAMLSourceForm.ts:110
+#: src/pages/sources/saml/SAMLSourceForm.ts:108
 msgid "Post binding"
 msgstr ""
 
-#: src/pages/sources/saml/SAMLSourceForm.ts:107
+#: src/pages/sources/saml/SAMLSourceForm.ts:105
 msgid "Post binding (auto-submit)"
 msgstr ""
 
@@ -2397,11 +2401,11 @@ msgstr ""
 msgid "Powered by authentik"
 msgstr ""
 
-#: src/pages/sources/saml/SAMLSourceForm.ts:224
+#: src/pages/sources/saml/SAMLSourceForm.ts:222
 msgid "Pre-authentication flow"
 msgstr ""
 
-#: src/pages/crypto/CertificateKeyPairForm.ts:61
+#: src/pages/crypto/CertificateKeyPairForm.ts:66
 #: src/pages/stages/captcha/CaptchaStageForm.ts:73
 msgid "Private Key"
 msgstr ""
@@ -2414,7 +2418,7 @@ msgstr ""
 msgid "Private key, acquired from https://www.google.com/recaptcha/intro/v3.html."
 msgstr ""
 
-#: src/pages/sources/oauth/OAuthSourceForm.ts:80
+#: src/pages/sources/oauth/OAuthSourceForm.ts:81
 msgid "Profile URL"
 msgstr ""
 
@@ -2441,25 +2445,25 @@ msgstr ""
 msgid "Property Mappings"
 msgstr ""
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:155
+#: src/pages/providers/saml/SAMLProviderForm.ts:154
 msgid "Property mappings"
 msgstr ""
 
-#: src/pages/sources/ldap/LDAPSourceForm.ts:192
+#: src/pages/sources/ldap/LDAPSourceForm.ts:190
 msgid "Property mappings used to group creation."
 msgstr ""
 
-#: src/pages/sources/ldap/LDAPSourceForm.ts:166
+#: src/pages/sources/ldap/LDAPSourceForm.ts:164
 msgid "Property mappings used to user creation."
 msgstr ""
 
-#: src/pages/providers/ldap/LDAPProviderForm.ts:93
+#: src/pages/providers/ldap/LDAPProviderForm.ts:91
 #: src/pages/providers/oauth2/OAuth2ProviderForm.ts:81
 #: src/pages/providers/proxy/ProxyProviderForm.ts:123
-#: src/pages/providers/saml/SAMLProviderForm.ts:78
-#: src/pages/sources/oauth/OAuthSourceForm.ts:144
-#: src/pages/sources/plex/PlexSourceForm.ts:134
-#: src/pages/sources/saml/SAMLSourceForm.ts:76
+#: src/pages/providers/saml/SAMLProviderForm.ts:77
+#: src/pages/sources/oauth/OAuthSourceForm.ts:163
+#: src/pages/sources/plex/PlexSourceForm.ts:137
+#: src/pages/sources/saml/SAMLSourceForm.ts:74
 msgid "Protocol settings"
 msgstr ""
 
@@ -2469,9 +2473,10 @@ msgstr ""
 
 #: src/elements/oauth/UserCodeList.ts:29
 #: src/elements/oauth/UserRefreshList.ts:29
-#: src/pages/applications/ApplicationForm.ts:100
+#: src/pages/applications/ApplicationForm.ts:105
 #: src/pages/applications/ApplicationListPage.ts:60
 #: src/pages/applications/ApplicationViewPage.ts:68
+#: src/pages/providers/ProviderListPage.ts:92
 msgid "Provider"
 msgstr ""
 
@@ -2480,18 +2485,18 @@ msgstr ""
 msgid "Provider Type"
 msgstr ""
 
-#: src/pages/sources/oauth/OAuthSourceForm.ts:161
+#: src/pages/sources/oauth/OAuthSourceForm.ts:180
 msgid "Provider type"
 msgstr ""
 
 #: src/interfaces/AdminInterface.ts:44
-#: src/pages/outposts/OutpostForm.ts:83
+#: src/pages/outposts/OutpostForm.ts:88
 #: src/pages/outposts/OutpostListPage.ts:51
 #: src/pages/providers/ProviderListPage.ts:35
 msgid "Providers"
 msgstr ""
 
-#: src/pages/outposts/OutpostForm.ts:57
+#: src/pages/outposts/OutpostForm.ts:62
 msgid "Proxy"
 msgstr ""
 
@@ -2507,7 +2512,7 @@ msgstr ""
 msgid "Public key, acquired from https://www.google.com/recaptcha/intro/v3.html."
 msgstr ""
 
-#: src/pages/applications/ApplicationForm.ts:175
+#: src/pages/applications/ApplicationForm.ts:180
 msgid "Publisher"
 msgstr ""
 
@@ -2519,31 +2524,31 @@ msgstr ""
 msgid "RSA Key"
 msgstr ""
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:244
-#: src/pages/sources/saml/SAMLSourceForm.ts:200
+#: src/pages/providers/saml/SAMLProviderForm.ts:243
+#: src/pages/sources/saml/SAMLSourceForm.ts:198
 msgid "RSA-SHA1"
 msgstr ""
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:247
-#: src/pages/sources/saml/SAMLSourceForm.ts:203
+#: src/pages/providers/saml/SAMLProviderForm.ts:246
+#: src/pages/sources/saml/SAMLSourceForm.ts:201
 msgid "RSA-SHA256"
 msgstr ""
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:250
-#: src/pages/sources/saml/SAMLSourceForm.ts:206
+#: src/pages/providers/saml/SAMLProviderForm.ts:249
+#: src/pages/sources/saml/SAMLSourceForm.ts:204
 msgid "RSA-SHA384"
 msgstr ""
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:253
-#: src/pages/sources/saml/SAMLSourceForm.ts:209
+#: src/pages/providers/saml/SAMLProviderForm.ts:252
+#: src/pages/sources/saml/SAMLSourceForm.ts:207
 msgid "RSA-SHA512"
 msgstr ""
 
-#: src/pages/flows/StageBindingForm.ts:130
+#: src/pages/flows/StageBindingForm.ts:135
 msgid "Re-evaluate policies"
 msgstr ""
 
-#: src/pages/flows/FlowForm.ts:67
+#: src/pages/flows/FlowForm.ts:72
 msgid "Recovery"
 msgstr ""
 
@@ -2555,7 +2560,7 @@ msgstr ""
 msgid "Recovery keys"
 msgstr ""
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:99
+#: src/pages/providers/saml/SAMLProviderForm.ts:98
 msgid "Redirect"
 msgstr ""
 
@@ -2567,7 +2572,7 @@ msgstr ""
 msgid "Redirect URIs/Origins"
 msgstr ""
 
-#: src/pages/sources/saml/SAMLSourceForm.ts:104
+#: src/pages/sources/saml/SAMLSourceForm.ts:102
 msgid "Redirect binding"
 msgstr ""
 
@@ -2609,7 +2614,7 @@ msgstr ""
 msgid "Request has been denied."
 msgstr ""
 
-#: src/pages/sources/oauth/OAuthSourceForm.ts:87
+#: src/pages/sources/oauth/OAuthSourceForm.ts:88
 msgid "Request token URL"
 msgstr ""
 
@@ -2658,31 +2663,31 @@ msgstr ""
 msgid "Return to device picker"
 msgstr ""
 
-#: src/pages/property-mappings/PropertyMappingSAMLForm.ts:58
+#: src/pages/property-mappings/PropertyMappingSAMLForm.ts:56
 msgid "SAML Attribute Name"
 msgstr ""
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:225
-#: src/pages/sources/saml/SAMLSourceForm.ts:181
+#: src/pages/providers/saml/SAMLProviderForm.ts:224
+#: src/pages/sources/saml/SAMLSourceForm.ts:179
 msgid "SHA1"
 msgstr ""
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:228
-#: src/pages/sources/saml/SAMLSourceForm.ts:184
+#: src/pages/providers/saml/SAMLProviderForm.ts:227
+#: src/pages/sources/saml/SAMLSourceForm.ts:182
 msgid "SHA256"
 msgstr ""
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:231
-#: src/pages/sources/saml/SAMLSourceForm.ts:187
+#: src/pages/providers/saml/SAMLProviderForm.ts:230
+#: src/pages/sources/saml/SAMLSourceForm.ts:185
 msgid "SHA384"
 msgstr ""
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:234
-#: src/pages/sources/saml/SAMLSourceForm.ts:190
+#: src/pages/providers/saml/SAMLProviderForm.ts:233
+#: src/pages/sources/saml/SAMLSourceForm.ts:188
 msgid "SHA512"
 msgstr ""
 
-#: src/pages/sources/saml/SAMLSourceForm.ts:87
+#: src/pages/sources/saml/SAMLSourceForm.ts:85
 #: src/pages/sources/saml/SAMLSourceViewPage.ts:82
 msgid "SLO URL"
 msgstr ""
@@ -2703,7 +2708,7 @@ msgstr ""
 msgid "SMTP Username"
 msgstr ""
 
-#: src/pages/sources/saml/SAMLSourceForm.ts:80
+#: src/pages/sources/saml/SAMLSourceForm.ts:78
 #: src/pages/sources/saml/SAMLSourceViewPage.ts:74
 msgid "SSO URL"
 msgstr ""
@@ -2712,11 +2717,11 @@ msgstr ""
 msgid "Same identifier is used for all providers"
 msgstr ""
 
-#: src/pages/property-mappings/PropertyMappingScopeForm.ts:58
+#: src/pages/property-mappings/PropertyMappingScopeForm.ts:56
 msgid "Scope name"
 msgstr ""
 
-#: src/pages/property-mappings/PropertyMappingScopeForm.ts:62
+#: src/pages/property-mappings/PropertyMappingScopeForm.ts:60
 msgid "Scope which the client can specify to access these properties."
 msgstr ""
 
@@ -2735,13 +2740,13 @@ msgid "Secret:"
 msgstr ""
 
 #: src/pages/policies/expression/ExpressionPolicyForm.ts:87
-#: src/pages/property-mappings/PropertyMappingLDAPForm.ts:73
-#: src/pages/property-mappings/PropertyMappingSAMLForm.ts:83
-#: src/pages/property-mappings/PropertyMappingScopeForm.ts:80
+#: src/pages/property-mappings/PropertyMappingLDAPForm.ts:71
+#: src/pages/property-mappings/PropertyMappingSAMLForm.ts:81
+#: src/pages/property-mappings/PropertyMappingScopeForm.ts:78
 msgid "See documentation for a list of all variables."
 msgstr ""
 
-#: src/pages/applications/ApplicationForm.ts:108
+#: src/pages/applications/ApplicationForm.ts:113
 msgid "Select a provider that this application should use. Alternatively, create a new provider."
 msgstr ""
 
@@ -2765,11 +2770,11 @@ msgstr ""
 msgid "Select which scopes can be used by the client. The client stil has to specify the scope to access the data."
 msgstr ""
 
-#: src/pages/sources/plex/PlexSourceForm.ts:164
+#: src/pages/sources/plex/PlexSourceForm.ts:167
 msgid "Select which server a user has to be a member of to be allowed to authenticate."
 msgstr ""
 
-#: src/pages/events/RuleForm.ts:92
+#: src/pages/events/RuleForm.ts:97
 msgid "Select which transports should be used to notify the user. If none are selected, the notification will only be shown in the authentik UI."
 msgstr ""
 
@@ -2777,7 +2782,7 @@ msgstr ""
 msgid "Selected policies are executed when the stage is submitted to validate the data."
 msgstr ""
 
-#: src/pages/outposts/OutpostForm.ts:77
+#: src/pages/outposts/OutpostForm.ts:82
 msgid "Selecting a service-connection enables the management of the outpost by authentik."
 msgstr ""
 
@@ -2793,7 +2798,7 @@ msgstr ""
 msgid "Send notifications whenever a specific Event is created and matched by policies."
 msgstr ""
 
-#: src/pages/events/TransportForm.ts:99
+#: src/pages/events/TransportForm.ts:104
 msgid "Send once"
 msgstr ""
 
@@ -2805,7 +2810,7 @@ msgstr ""
 msgid "Separator: Static Separator Line"
 msgstr ""
 
-#: src/pages/sources/ldap/LDAPSourceForm.ts:104
+#: src/pages/sources/ldap/LDAPSourceForm.ts:102
 #: src/pages/sources/ldap/LDAPSourceViewPage.ts:72
 msgid "Server URI"
 msgstr ""
@@ -2818,11 +2823,11 @@ msgstr ""
 msgid "Service Connections"
 msgstr ""
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:94
+#: src/pages/providers/saml/SAMLProviderForm.ts:93
 msgid "Service Provider Binding"
 msgstr ""
 
-#: src/pages/outposts/OutpostForm.ts:62
+#: src/pages/outposts/OutpostForm.ts:67
 msgid "Service connection"
 msgstr ""
 
@@ -2830,11 +2835,11 @@ msgstr ""
 msgid "Session duration"
 msgstr ""
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:216
+#: src/pages/providers/saml/SAMLProviderForm.ts:215
 msgid "Session not valid on or after current time + this value (Format: hours=1;minutes=2;seconds=3)."
 msgstr ""
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:212
+#: src/pages/providers/saml/SAMLProviderForm.ts:211
 msgid "Session valid not on or after"
 msgstr ""
 
@@ -2846,15 +2851,15 @@ msgstr ""
 msgid "Set a custom HTTP-Basic Authentication header based on values from authentik."
 msgstr ""
 
-#: src/pages/groups/GroupForm.ts:139
-#: src/pages/outposts/OutpostForm.ts:121
-#: src/pages/outposts/ServiceConnectionKubernetesForm.ts:73
+#: src/pages/groups/GroupForm.ts:144
+#: src/pages/outposts/OutpostForm.ts:127
+#: src/pages/outposts/ServiceConnectionKubernetesForm.ts:71
 #: src/pages/policies/PolicyTestForm.ts:79
 #: src/pages/users/UserForm.ts:82
 msgid "Set custom attributes using YAML or JSON."
 msgstr ""
 
-#: src/pages/events/RuleForm.ts:96
+#: src/pages/events/RuleForm.ts:101
 #: src/pages/events/RuleListPage.ts:48
 msgid "Severity"
 msgstr ""
@@ -2867,7 +2872,7 @@ msgstr ""
 msgid "Show matched user"
 msgstr ""
 
-#: src/pages/flows/FlowForm.ts:91
+#: src/pages/flows/FlowForm.ts:96
 msgid "Shown as the Title in Flow pages."
 msgstr ""
 
@@ -2875,16 +2880,16 @@ msgstr ""
 msgid "Sign up."
 msgstr ""
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:239
-#: src/pages/sources/saml/SAMLSourceForm.ts:195
+#: src/pages/providers/saml/SAMLProviderForm.ts:238
+#: src/pages/sources/saml/SAMLSourceForm.ts:193
 msgid "Signature algorithm"
 msgstr ""
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:121
+#: src/pages/providers/saml/SAMLProviderForm.ts:120
 msgid "Signing Certificate"
 msgstr ""
 
-#: src/pages/sources/saml/SAMLSourceForm.ts:115
+#: src/pages/sources/saml/SAMLSourceForm.ts:113
 msgid "Signing keypair"
 msgstr ""
 
@@ -2900,13 +2905,13 @@ msgstr ""
 msgid "Skip path regex"
 msgstr ""
 
-#: src/pages/applications/ApplicationForm.ts:93
+#: src/pages/applications/ApplicationForm.ts:98
 #: src/pages/applications/ApplicationListPage.ts:59
-#: src/pages/flows/FlowForm.ts:94
-#: src/pages/sources/ldap/LDAPSourceForm.ts:60
-#: src/pages/sources/oauth/OAuthSourceForm.ts:106
-#: src/pages/sources/plex/PlexSourceForm.ts:96
-#: src/pages/sources/saml/SAMLSourceForm.ts:60
+#: src/pages/flows/FlowForm.ts:99
+#: src/pages/sources/ldap/LDAPSourceForm.ts:58
+#: src/pages/sources/oauth/OAuthSourceForm.ts:114
+#: src/pages/sources/plex/PlexSourceForm.ts:99
+#: src/pages/sources/saml/SAMLSourceForm.ts:58
 msgid "Slug"
 msgstr ""
 
@@ -2914,7 +2919,6 @@ msgstr ""
 msgid "Something went wrong! Please try again later."
 msgstr ""
 
-#: src/pages/providers/ProviderListPage.ts:92
 #: src/pages/sources/SourcesListPage.ts:88
 msgid "Source"
 msgstr ""
@@ -2932,7 +2936,7 @@ msgstr ""
 msgid "Sources of identities, which can either be synced into authentik's database, like LDAP, or can be used by users to authenticate and enroll themselves, like OAuth and social logins"
 msgstr ""
 
-#: src/pages/flows/StageBindingForm.ts:98
+#: src/pages/flows/StageBindingForm.ts:103
 msgid "Stage"
 msgstr ""
 
@@ -2940,7 +2944,7 @@ msgstr ""
 msgid "Stage Bindings"
 msgstr ""
 
-#: src/pages/flows/FlowForm.ts:70
+#: src/pages/flows/FlowForm.ts:75
 msgid "Stage Configuration"
 msgstr ""
 
@@ -3051,24 +3055,24 @@ msgstr ""
 msgid "Successfully copied TOTP Config."
 msgstr ""
 
-#: src/pages/applications/ApplicationForm.ts:55
+#: src/pages/applications/ApplicationForm.ts:60
 msgid "Successfully created application."
 msgstr ""
 
-#: src/pages/flows/StageBindingForm.ts:39
-#: src/pages/policies/PolicyBindingForm.ts:64
+#: src/pages/flows/StageBindingForm.ts:44
+#: src/pages/policies/PolicyBindingForm.ts:65
 msgid "Successfully created binding."
 msgstr ""
 
-#: src/pages/crypto/CertificateKeyPairForm.ts:38
+#: src/pages/crypto/CertificateKeyPairForm.ts:43
 msgid "Successfully created certificate-key pair."
 msgstr ""
 
-#: src/pages/flows/FlowForm.ts:48
+#: src/pages/flows/FlowForm.ts:53
 msgid "Successfully created flow."
 msgstr ""
 
-#: src/pages/groups/GroupForm.ts:46
+#: src/pages/groups/GroupForm.ts:51
 msgid "Successfully created group."
 msgstr ""
 
@@ -3076,17 +3080,17 @@ msgstr ""
 msgid "Successfully created invitation."
 msgstr ""
 
-#: src/pages/property-mappings/PropertyMappingLDAPForm.ts:45
-#: src/pages/property-mappings/PropertyMappingSAMLForm.ts:45
-#: src/pages/property-mappings/PropertyMappingScopeForm.ts:45
+#: src/pages/property-mappings/PropertyMappingLDAPForm.ts:43
+#: src/pages/property-mappings/PropertyMappingSAMLForm.ts:43
+#: src/pages/property-mappings/PropertyMappingScopeForm.ts:43
 msgid "Successfully created mapping."
 msgstr ""
 
-#: src/pages/outposts/OutpostForm.ts:40
+#: src/pages/outposts/OutpostForm.ts:45
 msgid "Successfully created outpost."
 msgstr ""
 
-#: src/pages/policies/dummy/DummyPolicyForm.ts:46
+#: src/pages/policies/dummy/DummyPolicyForm.ts:44
 #: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:47
 #: src/pages/policies/expiry/ExpiryPolicyForm.ts:46
 #: src/pages/policies/expression/ExpressionPolicyForm.ts:47
@@ -3100,26 +3104,26 @@ msgstr ""
 msgid "Successfully created prompt."
 msgstr ""
 
-#: src/pages/providers/ldap/LDAPProviderForm.ts:47
+#: src/pages/providers/ldap/LDAPProviderForm.ts:45
 #: src/pages/providers/oauth2/OAuth2ProviderForm.ts:49
 #: src/pages/providers/proxy/ProxyProviderForm.ts:51
-#: src/pages/providers/saml/SAMLProviderForm.ts:46
+#: src/pages/providers/saml/SAMLProviderForm.ts:45
 msgid "Successfully created provider."
 msgstr ""
 
-#: src/pages/events/RuleForm.ts:38
+#: src/pages/events/RuleForm.ts:43
 msgid "Successfully created rule."
 msgstr ""
 
-#: src/pages/outposts/ServiceConnectionDockerForm.ts:46
-#: src/pages/outposts/ServiceConnectionKubernetesForm.ts:47
+#: src/pages/outposts/ServiceConnectionDockerForm.ts:44
+#: src/pages/outposts/ServiceConnectionKubernetesForm.ts:45
 msgid "Successfully created service-connection."
 msgstr ""
 
-#: src/pages/sources/ldap/LDAPSourceForm.ts:47
-#: src/pages/sources/oauth/OAuthSourceForm.ts:51
-#: src/pages/sources/plex/PlexSourceForm.ts:63
-#: src/pages/sources/saml/SAMLSourceForm.ts:47
+#: src/pages/sources/ldap/LDAPSourceForm.ts:45
+#: src/pages/sources/oauth/OAuthSourceForm.ts:52
+#: src/pages/sources/plex/PlexSourceForm.ts:66
+#: src/pages/sources/saml/SAMLSourceForm.ts:45
 msgid "Successfully created source."
 msgstr ""
 
@@ -3147,7 +3151,7 @@ msgstr ""
 msgid "Successfully created token."
 msgstr ""
 
-#: src/pages/events/TransportForm.ts:39
+#: src/pages/events/TransportForm.ts:44
 msgid "Successfully created transport."
 msgstr ""
 
@@ -3181,16 +3185,16 @@ msgstr ""
 msgid "Successfully sent test-request."
 msgstr ""
 
-#: src/pages/applications/ApplicationForm.ts:52
+#: src/pages/applications/ApplicationForm.ts:57
 msgid "Successfully updated application."
 msgstr ""
 
-#: src/pages/flows/StageBindingForm.ts:36
-#: src/pages/policies/PolicyBindingForm.ts:61
+#: src/pages/flows/StageBindingForm.ts:41
+#: src/pages/policies/PolicyBindingForm.ts:62
 msgid "Successfully updated binding."
 msgstr ""
 
-#: src/pages/crypto/CertificateKeyPairForm.ts:35
+#: src/pages/crypto/CertificateKeyPairForm.ts:40
 msgid "Successfully updated certificate-key pair."
 msgstr ""
 
@@ -3202,11 +3206,11 @@ msgstr ""
 msgid "Successfully updated device."
 msgstr ""
 
-#: src/pages/flows/FlowForm.ts:45
+#: src/pages/flows/FlowForm.ts:50
 msgid "Successfully updated flow."
 msgstr ""
 
-#: src/pages/groups/GroupForm.ts:43
+#: src/pages/groups/GroupForm.ts:48
 msgid "Successfully updated group."
 msgstr ""
 
@@ -3214,17 +3218,17 @@ msgstr ""
 msgid "Successfully updated invitation."
 msgstr ""
 
-#: src/pages/property-mappings/PropertyMappingLDAPForm.ts:42
-#: src/pages/property-mappings/PropertyMappingSAMLForm.ts:42
-#: src/pages/property-mappings/PropertyMappingScopeForm.ts:42
+#: src/pages/property-mappings/PropertyMappingLDAPForm.ts:40
+#: src/pages/property-mappings/PropertyMappingSAMLForm.ts:40
+#: src/pages/property-mappings/PropertyMappingScopeForm.ts:40
 msgid "Successfully updated mapping."
 msgstr ""
 
-#: src/pages/outposts/OutpostForm.ts:37
+#: src/pages/outposts/OutpostForm.ts:42
 msgid "Successfully updated outpost."
 msgstr ""
 
-#: src/pages/policies/dummy/DummyPolicyForm.ts:43
+#: src/pages/policies/dummy/DummyPolicyForm.ts:41
 #: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:44
 #: src/pages/policies/expiry/ExpiryPolicyForm.ts:43
 #: src/pages/policies/expression/ExpressionPolicyForm.ts:44
@@ -3238,26 +3242,26 @@ msgstr ""
 msgid "Successfully updated prompt."
 msgstr ""
 
-#: src/pages/providers/ldap/LDAPProviderForm.ts:44
+#: src/pages/providers/ldap/LDAPProviderForm.ts:42
 #: src/pages/providers/oauth2/OAuth2ProviderForm.ts:46
 #: src/pages/providers/proxy/ProxyProviderForm.ts:48
-#: src/pages/providers/saml/SAMLProviderForm.ts:43
+#: src/pages/providers/saml/SAMLProviderForm.ts:42
 msgid "Successfully updated provider."
 msgstr ""
 
-#: src/pages/events/RuleForm.ts:35
+#: src/pages/events/RuleForm.ts:40
 msgid "Successfully updated rule."
 msgstr ""
 
-#: src/pages/outposts/ServiceConnectionDockerForm.ts:43
-#: src/pages/outposts/ServiceConnectionKubernetesForm.ts:44
+#: src/pages/outposts/ServiceConnectionDockerForm.ts:41
+#: src/pages/outposts/ServiceConnectionKubernetesForm.ts:42
 msgid "Successfully updated service-connection."
 msgstr ""
 
-#: src/pages/sources/ldap/LDAPSourceForm.ts:44
-#: src/pages/sources/oauth/OAuthSourceForm.ts:48
-#: src/pages/sources/plex/PlexSourceForm.ts:60
-#: src/pages/sources/saml/SAMLSourceForm.ts:44
+#: src/pages/sources/ldap/LDAPSourceForm.ts:42
+#: src/pages/sources/oauth/OAuthSourceForm.ts:49
+#: src/pages/sources/plex/PlexSourceForm.ts:63
+#: src/pages/sources/saml/SAMLSourceForm.ts:42
 msgid "Successfully updated source."
 msgstr ""
 
@@ -3285,7 +3289,7 @@ msgstr ""
 msgid "Successfully updated token."
 msgstr ""
 
-#: src/pages/events/TransportForm.ts:36
+#: src/pages/events/TransportForm.ts:41
 msgid "Successfully updated transport."
 msgstr ""
 
@@ -3305,6 +3309,14 @@ msgstr ""
 msgid "Superuser privileges?"
 msgstr ""
 
+#: src/pages/admin-overview/charts/GroupCountStatusChart.ts:55
+msgid "Superuser-groups"
+msgstr ""
+
+#: src/pages/admin-overview/charts/UserCountStatusChart.ts:55
+msgid "Superusers"
+msgstr ""
+
 #: src/pages/policies/password/PasswordPolicyForm.ts:123
 msgid "Symbol charset"
 msgstr ""
@@ -3313,7 +3325,7 @@ msgstr ""
 msgid "Sync"
 msgstr ""
 
-#: src/pages/sources/ldap/LDAPSourceForm.ts:94
+#: src/pages/sources/ldap/LDAPSourceForm.ts:92
 msgid "Sync groups"
 msgstr ""
 
@@ -3321,7 +3333,7 @@ msgstr ""
 msgid "Sync status"
 msgstr ""
 
-#: src/pages/sources/ldap/LDAPSourceForm.ts:77
+#: src/pages/sources/ldap/LDAPSourceForm.ts:75
 msgid "Sync users"
 msgstr ""
 
@@ -3334,11 +3346,11 @@ msgstr ""
 msgid "System Tasks"
 msgstr ""
 
-#: src/pages/outposts/ServiceConnectionDockerForm.ts:91
+#: src/pages/outposts/ServiceConnectionDockerForm.ts:89
 msgid "TLS Authentication Certificate"
 msgstr ""
 
-#: src/pages/outposts/ServiceConnectionDockerForm.ts:75
+#: src/pages/outposts/ServiceConnectionDockerForm.ts:73
 msgid "TLS Verification Certificate"
 msgstr ""
 
@@ -3346,7 +3358,7 @@ msgstr ""
 msgid "TOTP Authenticators"
 msgstr ""
 
-#: src/pages/flows/StageBindingForm.ts:78
+#: src/pages/flows/StageBindingForm.ts:83
 msgid "Target"
 msgstr ""
 
@@ -3390,7 +3402,7 @@ msgstr ""
 msgid "The external URL you'll access the outpost at."
 msgstr ""
 
-#: src/pages/policies/dummy/DummyPolicyForm.ts:90
+#: src/pages/policies/dummy/DummyPolicyForm.ts:88
 msgid "The policy takes a random time to execute. This controls the minimum time it will take."
 msgstr ""
 
@@ -3436,7 +3448,7 @@ msgstr ""
 msgid "Time in minutes the token sent is valid."
 msgstr ""
 
-#: src/pages/sources/saml/SAMLSourceForm.ts:173
+#: src/pages/sources/saml/SAMLSourceForm.ts:171
 msgid "Time offset when temporary users should be deleted. This only applies if your IDP uses the NameID Format 'transient', and the user doesn't log out manually. (Format: hours=1;minutes=2;seconds=3)."
 msgstr ""
 
@@ -3445,12 +3457,12 @@ msgid "Time-based One-Time Passwords"
 msgstr ""
 
 #: src/pages/policies/BoundPoliciesList.ts:43
-#: src/pages/policies/PolicyBindingForm.ts:209
+#: src/pages/policies/PolicyBindingForm.ts:210
 #: src/pages/stages/email/EmailStageForm.ts:101
 msgid "Timeout"
 msgstr ""
 
-#: src/pages/flows/FlowForm.ts:87
+#: src/pages/flows/FlowForm.ts:92
 msgid "Title"
 msgstr ""
 
@@ -3487,28 +3499,36 @@ msgstr ""
 msgid "Tokens are used throughout authentik for Email validation stages, Recovery keys and API access."
 msgstr ""
 
-#: src/pages/admin-overview/graphs/FlowStatusCard.ts:53
+#: src/pages/admin-overview/charts/FlowStatusChart.ts:53
 msgid "Total flows"
 msgstr ""
 
-#: src/pages/admin-overview/graphs/PolicyStatusCard.ts:58
+#: src/pages/admin-overview/charts/GroupCountStatusChart.ts:54
+msgid "Total groups"
+msgstr ""
+
+#: src/pages/admin-overview/charts/PolicyStatusChart.ts:58
 msgid "Total policies"
 msgstr ""
 
+#: src/pages/admin-overview/charts/UserCountStatusChart.ts:54
+msgid "Total users"
+msgstr ""
+
 #: src/flows/stages/authenticator_validate/AuthenticatorValidateStage.ts:80
 msgid "Traditional authenticator"
 msgstr ""
 
-#: src/pages/sources/saml/SAMLSourceForm.ts:164
+#: src/pages/sources/saml/SAMLSourceForm.ts:162
 msgid "Transient"
 msgstr ""
 
-#: src/pages/events/RuleForm.ts:78
+#: src/pages/events/RuleForm.ts:83
 msgid "Transports"
 msgstr ""
 
 #: src/pages/flows/BoundStagesList.ts:40
-#: src/pages/outposts/OutpostForm.ts:53
+#: src/pages/outposts/OutpostForm.ts:58
 #: src/pages/outposts/ServiceConnectionListPage.ts:54
 #: src/pages/policies/PolicyListPage.ts:57
 #: src/pages/property-mappings/PropertyMappingListPage.ts:55
@@ -3519,7 +3539,7 @@ msgstr ""
 msgid "Type"
 msgstr ""
 
-#: src/pages/applications/ApplicationForm.ts:155
+#: src/pages/applications/ApplicationForm.ts:160
 msgid "UI settings"
 msgstr ""
 
@@ -3527,35 +3547,35 @@ msgstr ""
 msgid "UID"
 msgstr ""
 
-#: src/pages/sources/oauth/OAuthSourceForm.ts:62
+#: src/pages/sources/oauth/OAuthSourceForm.ts:63
 msgid "URL settings"
 msgstr ""
 
-#: src/pages/sources/saml/SAMLSourceForm.ts:84
+#: src/pages/sources/saml/SAMLSourceForm.ts:82
 msgid "URL that the initial Login request is sent to."
 msgstr ""
 
-#: src/pages/sources/oauth/OAuthSourceForm.ts:70
+#: src/pages/sources/oauth/OAuthSourceForm.ts:71
 msgid "URL the user is redirect to to consent the authorization."
 msgstr ""
 
-#: src/pages/sources/oauth/OAuthSourceForm.ts:84
+#: src/pages/sources/oauth/OAuthSourceForm.ts:85
 msgid "URL used by authentik to get user information."
 msgstr ""
 
-#: src/pages/sources/oauth/OAuthSourceForm.ts:77
+#: src/pages/sources/oauth/OAuthSourceForm.ts:78
 msgid "URL used by authentik to retrieve tokens."
 msgstr ""
 
-#: src/pages/sources/oauth/OAuthSourceForm.ts:90
+#: src/pages/sources/oauth/OAuthSourceForm.ts:91
 msgid "URL used to request the initial token. This URL is only required for OAuth 1."
 msgstr ""
 
-#: src/pages/admin-overview/graphs/PolicyStatusCard.ts:60
+#: src/pages/admin-overview/charts/PolicyStatusChart.ts:60
 msgid "Unbound policies"
 msgstr ""
 
-#: src/pages/flows/FlowForm.ts:73
+#: src/pages/flows/FlowForm.ts:78
 msgid "Unenrollment"
 msgstr ""
 
@@ -3563,7 +3583,7 @@ msgstr ""
 msgid "Unhealthy"
 msgstr ""
 
-#: src/pages/admin-overview/graphs/OutpostStatusCard.ts:72
+#: src/pages/admin-overview/charts/OutpostStatusChart.ts:72
 msgid "Unhealthy outposts"
 msgstr ""
 
@@ -3571,7 +3591,7 @@ msgstr ""
 msgid "Unknown"
 msgstr ""
 
-#: src/pages/admin-overview/graphs/LDAPSyncStatusCard.ts:77
+#: src/pages/admin-overview/charts/LDAPSyncStatusChart.ts:77
 msgid "Unsynced sources"
 msgstr ""
 
@@ -3743,22 +3763,26 @@ msgstr ""
 msgid "Use global settings"
 msgstr ""
 
-#: src/pages/sources/oauth/OAuthSourceForm.ts:131
-#: src/pages/sources/plex/PlexSourceForm.ts:121
+#: src/pages/sources/oauth/OAuthSourceForm.ts:150
+#: src/pages/sources/plex/PlexSourceForm.ts:124
 msgid "Use the user's email address, but deny enrollment when the email address already exists."
 msgstr ""
 
-#: src/pages/sources/oauth/OAuthSourceForm.ts:137
-#: src/pages/sources/plex/PlexSourceForm.ts:127
+#: src/pages/sources/oauth/OAuthSourceForm.ts:156
+#: src/pages/sources/plex/PlexSourceForm.ts:130
 msgid "Use the user's username, but deny enrollment when the username already exists."
 msgstr ""
 
+#: src/pages/sources/oauth/OAuthSourceForm.ts:126
+msgid "Use this redirect URL:"
+msgstr ""
+
 #: src/elements/events/ObjectChangelog.ts:39
 #: src/elements/events/UserEvents.ts:36
 #: src/pages/events/EventInfo.ts:83
 #: src/pages/events/EventListPage.ts:44
-#: src/pages/policies/PolicyBindingForm.ts:132
-#: src/pages/policies/PolicyBindingForm.ts:176
+#: src/pages/policies/PolicyBindingForm.ts:133
+#: src/pages/policies/PolicyBindingForm.ts:177
 #: src/pages/policies/PolicyTestForm.ts:61
 #: src/pages/property-mappings/PropertyMappingTestForm.ts:51
 #: src/pages/tokens/TokenListPage.ts:45
@@ -3772,7 +3796,7 @@ msgstr ""
 msgid "User Info"
 msgstr ""
 
-#: src/pages/sources/ldap/LDAPSourceForm.ts:144
+#: src/pages/sources/ldap/LDAPSourceForm.ts:142
 msgid "User Property Mappings"
 msgstr ""
 
@@ -3793,16 +3817,16 @@ msgstr ""
 msgid "User fields"
 msgstr ""
 
-#: src/pages/sources/oauth/OAuthSourceForm.ts:120
-#: src/pages/sources/plex/PlexSourceForm.ts:110
+#: src/pages/sources/oauth/OAuthSourceForm.ts:139
+#: src/pages/sources/plex/PlexSourceForm.ts:113
 msgid "User matching mode"
 msgstr ""
 
-#: src/pages/sources/ldap/LDAPSourceForm.ts:208
+#: src/pages/sources/ldap/LDAPSourceForm.ts:206
 msgid "User object filter"
 msgstr ""
 
-#: src/pages/sources/ldap/LDAPSourceForm.ts:85
+#: src/pages/sources/ldap/LDAPSourceForm.ts:83
 msgid "User password writeback"
 msgstr ""
 
@@ -3845,16 +3869,16 @@ msgid "Username: Same as Text input, but checks for and prevents duplicate usern
 msgstr ""
 
 #: src/interfaces/AdminInterface.ts:100
-#: src/pages/admin-overview/AdminOverviewPage.ts:88
+#: src/pages/admin-overview/AdminOverviewPage.ts:71
 #: src/pages/users/UserListPage.ts:33
 msgid "Users"
 msgstr ""
 
-#: src/pages/groups/GroupForm.ts:65
+#: src/pages/groups/GroupForm.ts:70
 msgid "Users added to this group will be superusers."
 msgstr ""
 
-#: src/pages/providers/ldap/LDAPProviderForm.ts:88
+#: src/pages/providers/ldap/LDAPProviderForm.ts:86
 msgid "Users in the selected group can do search queries."
 msgstr ""
 
@@ -3886,7 +3910,7 @@ msgstr ""
 msgid "Validity days"
 msgstr ""
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:138
+#: src/pages/providers/saml/SAMLProviderForm.ts:137
 msgid "Verification Certificate"
 msgstr ""
 
@@ -3894,7 +3918,7 @@ msgstr ""
 msgid "Verify the user's email address by sending them a one-time-link. Can also be used for recovery to verify the user's authenticity."
 msgstr ""
 
-#: src/pages/admin-overview/AdminOverviewPage.ts:80
+#: src/pages/admin-overview/AdminOverviewPage.ts:90
 msgid "Version"
 msgstr ""
 
@@ -3910,27 +3934,23 @@ msgstr ""
 msgid "View deployment documentation"
 msgstr ""
 
-#: src/pages/flows/FlowForm.ts:98
+#: src/pages/flows/FlowForm.ts:103
 msgid "Visible in the URL."
 msgstr ""
 
-#: src/pages/policies/dummy/DummyPolicyForm.ts:93
+#: src/pages/policies/dummy/DummyPolicyForm.ts:91
 msgid "Wait (max)"
 msgstr ""
 
-#: src/pages/policies/dummy/DummyPolicyForm.ts:86
+#: src/pages/policies/dummy/DummyPolicyForm.ts:84
 msgid "Wait (min)"
 msgstr ""
 
-#: src/pages/events/RuleForm.ts:48
+#: src/pages/events/RuleForm.ts:53
 #: src/pages/system-tasks/SystemTaskListPage.ts:66
 msgid "Warning"
 msgstr ""
 
-#: src/pages/admin-overview/cards/ProviderStatusCard.ts:24
-msgid "Warning: At least one Provider has no application assigned."
-msgstr ""
-
 #: src/pages/policies/PolicyListPage.ts:71
 msgid "Warning: Policy is not assigned."
 msgstr ""
@@ -3947,15 +3967,15 @@ msgstr ""
 msgid "WebAuthn Devices"
 msgstr ""
 
-#: src/pages/events/TransportForm.ts:52
+#: src/pages/events/TransportForm.ts:57
 msgid "Webhook (Slack/Discord)"
 msgstr ""
 
-#: src/pages/events/TransportForm.ts:49
+#: src/pages/events/TransportForm.ts:54
 msgid "Webhook (generic)"
 msgstr ""
 
-#: src/pages/events/TransportForm.ts:91
+#: src/pages/events/TransportForm.ts:96
 msgid "Webhook URL"
 msgstr ""
 
@@ -3975,11 +3995,11 @@ msgstr ""
 msgid "When enabled, user fields are matched regardless of their casing."
 msgstr ""
 
-#: src/pages/providers/saml/SAMLProviderForm.ts:151
+#: src/pages/providers/saml/SAMLProviderForm.ts:150
 msgid "When selected, incoming assertion's Signatures will be validated against this certificate. To allow unsigned Requests, leave on default."
 msgstr ""
 
-#: src/pages/policies/dummy/DummyPolicyForm.ts:69
+#: src/pages/policies/dummy/DummyPolicyForm.ts:67
 #: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:70
 #: src/pages/policies/expiry/ExpiryPolicyForm.ts:69
 #: src/pages/policies/expression/ExpressionPolicyForm.ts:70
@@ -3993,11 +4013,11 @@ msgstr ""
 msgid "Whoops!"
 msgstr ""
 
-#: src/pages/sources/saml/SAMLSourceForm.ts:158
+#: src/pages/sources/saml/SAMLSourceForm.ts:156
 msgid "Windows"
 msgstr ""
 
-#: src/pages/admin-overview/AdminOverviewPage.ts:92
+#: src/pages/admin-overview/AdminOverviewPage.ts:98
 msgid "Workers"
 msgstr ""
 
@@ -4007,7 +4027,7 @@ msgid ""
 "is pending, a new user is created, and data is written to them."
 msgstr ""
 
-#: src/pages/sources/saml/SAMLSourceForm.ts:161
+#: src/pages/sources/saml/SAMLSourceForm.ts:159
 msgid "X509 Subject"
 msgstr ""
 
diff --git a/web/src/pages/applications/ApplicationForm.ts b/web/src/pages/applications/ApplicationForm.ts
index 74e117041..2e027a1bf 100644
--- a/web/src/pages/applications/ApplicationForm.ts
+++ b/web/src/pages/applications/ApplicationForm.ts
@@ -3,7 +3,6 @@ import { t } from "@lingui/macro";
 import { CSSResult, customElement, property } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../api/Config";
-import { Form } from "../../elements/forms/Form";
 import { until } from "lit-html/directives/until";
 import { ifDefined } from "lit-html/directives/if-defined";
 import "../../elements/buttons/Dropdown";
diff --git a/web/src/pages/applications/ApplicationViewPage.ts b/web/src/pages/applications/ApplicationViewPage.ts
index 200f2f8e7..44fd12555 100644
--- a/web/src/pages/applications/ApplicationViewPage.ts
+++ b/web/src/pages/applications/ApplicationViewPage.ts
@@ -102,7 +102,7 @@ export class ApplicationViewPage extends LitElement {
                                                     <span slot="header">
                                                         ${t`Update Application`}
                                                     </span>
-                                                    <ak-application-form slot="form" .application=${this.application}>
+                                                    <ak-application-form slot="form" .instancePk=${this.application.slug}>
                                                     </ak-application-form>
                                                     <button slot="trigger" class="pf-c-button pf-m-secondary">
                                                         ${t`Edit`}
diff --git a/web/src/pages/crypto/CertificateKeyPairForm.ts b/web/src/pages/crypto/CertificateKeyPairForm.ts
index e466c268d..d44a7ac79 100644
--- a/web/src/pages/crypto/CertificateKeyPairForm.ts
+++ b/web/src/pages/crypto/CertificateKeyPairForm.ts
@@ -1,9 +1,8 @@
 import { CertificateKeyPair, CryptoApi } from "authentik-api";
 import { t } from "@lingui/macro";
-import { customElement, property } from "lit-element";
+import { customElement } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../api/Config";
-import { Form } from "../../elements/forms/Form";
 import { ifDefined } from "lit-html/directives/if-defined";
 import "../../elements/forms/HorizontalFormElement";
 import "../../elements/CodeMirror";
diff --git a/web/src/pages/events/RuleForm.ts b/web/src/pages/events/RuleForm.ts
index 660dcbd2c..7e922ac0c 100644
--- a/web/src/pages/events/RuleForm.ts
+++ b/web/src/pages/events/RuleForm.ts
@@ -1,9 +1,8 @@
 import { CoreApi, EventsApi, NotificationRule, NotificationRuleSeverityEnum } from "authentik-api";
 import { t } from "@lingui/macro";
-import { customElement, property } from "lit-element";
+import { customElement } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../api/Config";
-import { Form } from "../../elements/forms/Form";
 import { ifDefined } from "lit-html/directives/if-defined";
 import "../../elements/forms/HorizontalFormElement";
 import { until } from "lit-html/directives/until";
diff --git a/web/src/pages/events/TransportForm.ts b/web/src/pages/events/TransportForm.ts
index d908e4646..5daaf7cd3 100644
--- a/web/src/pages/events/TransportForm.ts
+++ b/web/src/pages/events/TransportForm.ts
@@ -3,7 +3,6 @@ import { t } from "@lingui/macro";
 import { customElement, property } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../api/Config";
-import { Form } from "../../elements/forms/Form";
 import { ifDefined } from "lit-html/directives/if-defined";
 import "../../elements/forms/HorizontalFormElement";
 import { first } from "../../utils";
diff --git a/web/src/pages/flows/FlowForm.ts b/web/src/pages/flows/FlowForm.ts
index 39a427226..077c5063a 100644
--- a/web/src/pages/flows/FlowForm.ts
+++ b/web/src/pages/flows/FlowForm.ts
@@ -1,9 +1,8 @@
 import { Flow, FlowDesignationEnum, FlowPolicyEngineModeEnum, FlowsApi } from "authentik-api";
 import { t } from "@lingui/macro";
-import { customElement, property } from "lit-element";
+import { customElement } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../api/Config";
-import { Form } from "../../elements/forms/Form";
 import { ifDefined } from "lit-html/directives/if-defined";
 import "../../elements/forms/HorizontalFormElement";
 import { ModelForm } from "../../elements/forms/ModelForm";
diff --git a/web/src/pages/flows/StageBindingForm.ts b/web/src/pages/flows/StageBindingForm.ts
index c95407868..b206a11ff 100644
--- a/web/src/pages/flows/StageBindingForm.ts
+++ b/web/src/pages/flows/StageBindingForm.ts
@@ -3,7 +3,6 @@ import { t } from "@lingui/macro";
 import { customElement, property } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../api/Config";
-import { Form } from "../../elements/forms/Form";
 import { until } from "lit-html/directives/until";
 import { ifDefined } from "lit-html/directives/if-defined";
 import "../../elements/forms/HorizontalFormElement";
diff --git a/web/src/pages/groups/GroupForm.ts b/web/src/pages/groups/GroupForm.ts
index d20b77a3a..1a11548ff 100644
--- a/web/src/pages/groups/GroupForm.ts
+++ b/web/src/pages/groups/GroupForm.ts
@@ -1,9 +1,8 @@
 import { CoreApi, Group, User } from "authentik-api";
 import { t } from "@lingui/macro";
-import { customElement, property } from "lit-element";
+import { customElement } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../api/Config";
-import { Form } from "../../elements/forms/Form";
 import { until } from "lit-html/directives/until";
 import { ifDefined } from "lit-html/directives/if-defined";
 import "../../elements/forms/HorizontalFormElement";
diff --git a/web/src/pages/outposts/OutpostForm.ts b/web/src/pages/outposts/OutpostForm.ts
index 9bd78b0d1..cdafde68a 100644
--- a/web/src/pages/outposts/OutpostForm.ts
+++ b/web/src/pages/outposts/OutpostForm.ts
@@ -1,6 +1,6 @@
 import { Outpost, OutpostsApi, OutpostTypeEnum, ProvidersApi } from "authentik-api";
 import { t } from "@lingui/macro";
-import { customElement, property } from "lit-element";
+import { customElement } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../api/Config";
 import { until } from "lit-html/directives/until";
diff --git a/web/src/pages/property-mappings/PropertyMappingLDAPForm.ts b/web/src/pages/property-mappings/PropertyMappingLDAPForm.ts
index 755f1ea7a..66a865263 100644
--- a/web/src/pages/property-mappings/PropertyMappingLDAPForm.ts
+++ b/web/src/pages/property-mappings/PropertyMappingLDAPForm.ts
@@ -1,6 +1,6 @@
 import { LDAPPropertyMapping, PropertymappingsApi } from "authentik-api";
 import { t } from "@lingui/macro";
-import { customElement, property } from "lit-element";
+import { customElement } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../api/Config";
 import { ifDefined } from "lit-html/directives/if-defined";
diff --git a/web/src/pages/property-mappings/PropertyMappingSAMLForm.ts b/web/src/pages/property-mappings/PropertyMappingSAMLForm.ts
index d7aca81d3..2c87a523b 100644
--- a/web/src/pages/property-mappings/PropertyMappingSAMLForm.ts
+++ b/web/src/pages/property-mappings/PropertyMappingSAMLForm.ts
@@ -1,6 +1,6 @@
 import { SAMLPropertyMapping, PropertymappingsApi } from "authentik-api";
 import { t } from "@lingui/macro";
-import { customElement, property } from "lit-element";
+import { customElement } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../api/Config";
 import { ifDefined } from "lit-html/directives/if-defined";
diff --git a/web/src/pages/property-mappings/PropertyMappingScopeForm.ts b/web/src/pages/property-mappings/PropertyMappingScopeForm.ts
index 68cd24986..56c2d9262 100644
--- a/web/src/pages/property-mappings/PropertyMappingScopeForm.ts
+++ b/web/src/pages/property-mappings/PropertyMappingScopeForm.ts
@@ -1,6 +1,6 @@
 import { ScopeMapping, PropertymappingsApi } from "authentik-api";
 import { t } from "@lingui/macro";
-import { customElement, property } from "lit-element";
+import { customElement } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../api/Config";
 import { ModelForm } from "../../elements/forms/ModelForm";
diff --git a/web/src/pages/providers/ldap/LDAPProviderForm.ts b/web/src/pages/providers/ldap/LDAPProviderForm.ts
index 5f07bc379..d9dd0c3e2 100644
--- a/web/src/pages/providers/ldap/LDAPProviderForm.ts
+++ b/web/src/pages/providers/ldap/LDAPProviderForm.ts
@@ -1,6 +1,6 @@
 import { FlowDesignationEnum, FlowsApi, ProvidersApi, LDAPProvider, CoreApi } from "authentik-api";
 import { t } from "@lingui/macro";
-import { customElement, property } from "lit-element";
+import { customElement } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../../api/Config";
 import { ModelForm } from "../../../elements/forms/ModelForm";
diff --git a/web/src/pages/providers/saml/SAMLProviderForm.ts b/web/src/pages/providers/saml/SAMLProviderForm.ts
index e059a4071..3adedebea 100644
--- a/web/src/pages/providers/saml/SAMLProviderForm.ts
+++ b/web/src/pages/providers/saml/SAMLProviderForm.ts
@@ -1,6 +1,6 @@
 import { CryptoApi, FlowDesignationEnum, FlowsApi, SAMLProvider, ProvidersApi, PropertymappingsApi,  SAMLProviderSpBindingEnum, SAMLProviderDigestAlgorithmEnum, SAMLProviderSignatureAlgorithmEnum } from "authentik-api";
 import { t } from "@lingui/macro";
-import { customElement, property } from "lit-element";
+import { customElement } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../../api/Config";
 import { ModelForm } from "../../../elements/forms/ModelForm";
@@ -13,7 +13,7 @@ import "../../../elements/forms/FormGroup";
 export class SAMLProviderFormPage extends ModelForm<SAMLProvider, number> {
 
     loadInstance(pk: number): Promise<SAMLProvider> {
-        console.log("reading saml provider")
+        console.log("reading saml provider");
         return new ProvidersApi(DEFAULT_CONFIG).providersSamlRead({
             id: pk,
         });
diff --git a/web/src/pages/sources/plex/PlexSourceForm.ts b/web/src/pages/sources/plex/PlexSourceForm.ts
index a95fb5631..d8b68c293 100644
--- a/web/src/pages/sources/plex/PlexSourceForm.ts
+++ b/web/src/pages/sources/plex/PlexSourceForm.ts
@@ -3,7 +3,6 @@ import { t } from "@lingui/macro";
 import { customElement, property } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../../api/Config";
-import { Form } from "../../../elements/forms/Form";
 import "../../../elements/forms/FormGroup";
 import "../../../elements/forms/HorizontalFormElement";
 import { ifDefined } from "lit-html/directives/if-defined";
@@ -32,6 +31,12 @@ export class PlexSourceForm extends ModelForm<PlexSource, string> {
     @property({attribute: false})
     plexResources?: PlexResource[];
 
+    get defaultInstance(): PlexSource | undefined {
+        return {
+            clientId: randomString(40)
+        } as PlexSource;
+    }
+
     getSuccessMessage(): string {
         if (this.instance) {
             return t`Successfully updated source.`;
diff --git a/web/src/pages/sources/saml/SAMLSourceForm.ts b/web/src/pages/sources/saml/SAMLSourceForm.ts
index d45f9b246..a20695c4b 100644
--- a/web/src/pages/sources/saml/SAMLSourceForm.ts
+++ b/web/src/pages/sources/saml/SAMLSourceForm.ts
@@ -1,9 +1,8 @@
 import { SAMLSource, SourcesApi, SAMLSourceBindingTypeEnum, SAMLSourceNameIdPolicyEnum, CryptoApi, SAMLSourceDigestAlgorithmEnum, SAMLSourceSignatureAlgorithmEnum, FlowsApi, FlowDesignationEnum } from "authentik-api";
 import { t } from "@lingui/macro";
-import { customElement, property } from "lit-element";
+import { customElement } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../../api/Config";
-import { Form } from "../../../elements/forms/Form";
 import "../../../elements/forms/FormGroup";
 import "../../../elements/forms/HorizontalFormElement";
 import { ifDefined } from "lit-html/directives/if-defined";

From ce1c40002231b29ce3efd1c662506b04d99394bc Mon Sep 17 00:00:00 2001
From: Jens Langhammer <jens.langhammer@beryju.org>
Date: Tue, 11 May 2021 12:19:35 +0200
Subject: [PATCH 06/10] web/admin: migrate policy forms

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
---
 .../event_matcher/EventMatcherPolicyForm.ts   | 37 ++++++++---------
 .../pages/policies/expiry/ExpiryPolicyForm.ts | 31 ++++++--------
 .../expression/ExpressionPolicyForm.ts        | 29 ++++++-------
 .../policies/hibp/HaveIBeenPwnedPolicyForm.ts | 31 ++++++--------
 .../policies/password/PasswordPolicyForm.ts   | 41 ++++++++-----------
 .../reputation/ReputationPolicyForm.ts        | 33 +++++++--------
 6 files changed, 86 insertions(+), 116 deletions(-)

diff --git a/web/src/pages/policies/event_matcher/EventMatcherPolicyForm.ts b/web/src/pages/policies/event_matcher/EventMatcherPolicyForm.ts
index ccb86bda6..2c1279205 100644
--- a/web/src/pages/policies/event_matcher/EventMatcherPolicyForm.ts
+++ b/web/src/pages/policies/event_matcher/EventMatcherPolicyForm.ts
@@ -1,31 +1,26 @@
 import { AdminApi, EventMatcherPolicy, EventsApi, PoliciesApi } from "authentik-api";
 import { t } from "@lingui/macro";
-import { customElement, property } from "lit-element";
+import { customElement } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../../api/Config";
-import { Form } from "../../../elements/forms/Form";
 import { ifDefined } from "lit-html/directives/if-defined";
 import "../../../elements/forms/HorizontalFormElement";
 import "../../../elements/forms/FormGroup";
 import { until } from "lit-html/directives/until";
 import { first } from "../../../utils";
+import { ModelForm } from "../../../elements/forms/ModelForm";
 
 @customElement("ak-policy-event-matcher-form")
-export class EventMatcherPolicyForm extends Form<EventMatcherPolicy> {
+export class EventMatcherPolicyForm extends ModelForm<EventMatcherPolicy, string> {
 
-    set policyUUID(value: string) {
-        new PoliciesApi(DEFAULT_CONFIG).policiesEventMatcherRead({
-            policyUuid: value,
-        }).then(policy => {
-            this.policy = policy;
+    loadInstance(pk: string): Promise<EventMatcherPolicy> {
+        return new PoliciesApi(DEFAULT_CONFIG).policiesEventMatcherRead({
+            policyUuid: pk,
         });
     }
 
-    @property({attribute: false})
-    policy?: EventMatcherPolicy;
-
     getSuccessMessage(): string {
-        if (this.policy) {
+        if (this.instance) {
             return t`Successfully updated policy.`;
         } else {
             return t`Successfully created policy.`;
@@ -33,9 +28,9 @@ export class EventMatcherPolicyForm extends Form<EventMatcherPolicy> {
     }
 
     send = (data: EventMatcherPolicy): Promise<EventMatcherPolicy> => {
-        if (this.policy) {
+        if (this.instance) {
             return new PoliciesApi(DEFAULT_CONFIG).policiesEventMatcherUpdate({
-                policyUuid: this.policy.pk || "",
+                policyUuid: this.instance.pk || "",
                 data: data
             });
         } else {
@@ -54,11 +49,11 @@ export class EventMatcherPolicyForm extends Form<EventMatcherPolicy> {
                 label=${t`Name`}
                 ?required=${true}
                 name="name">
-                <input type="text" value="${ifDefined(this.policy?.name || "")}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.name || "")}" class="pf-c-form-control" required>
             </ak-form-element-horizontal>
             <ak-form-element-horizontal name="executionLogging">
                 <div class="pf-c-check">
-                    <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.policy?.executionLogging, false)}>
+                    <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.instance?.executionLogging, false)}>
                     <label class="pf-c-check__label">
                         ${t`Execution logging`}
                     </label>
@@ -76,10 +71,10 @@ export class EventMatcherPolicyForm extends Form<EventMatcherPolicy> {
                         label=${t`Action`}
                         name="action">
                         <select class="pf-c-form-control">
-                            <option value="" ?selected=${this.policy?.action === undefined}>---------</option>
+                            <option value="" ?selected=${this.instance?.action === undefined}>---------</option>
                             ${until(new EventsApi(DEFAULT_CONFIG).eventsEventsActions().then(actions => {
                                 return actions.map(action => {
-                                    return html`<option value=${action.component} ?selected=${this.policy?.action === action.component}>${action.name}</option>`;
+                                    return html`<option value=${action.component} ?selected=${this.instance?.action === action.component}>${action.name}</option>`;
                                 });
                             }), html`<option>${t`Loading...`}</option>`)}
                         </select>
@@ -88,17 +83,17 @@ export class EventMatcherPolicyForm extends Form<EventMatcherPolicy> {
                     <ak-form-element-horizontal
                         label=${t`Client IP`}
                         name="clientIp">
-                        <input type="text" value="${ifDefined(this.policy?.clientIp || "")}" class="pf-c-form-control">
+                        <input type="text" value="${ifDefined(this.instance?.clientIp || "")}" class="pf-c-form-control">
                         <p class="pf-c-form__helper-text">${t`Matches Event's Client IP (strict matching, for network matching use an Expression Policy.`}</p>
                     </ak-form-element-horizontal>
                     <ak-form-element-horizontal
                         label=${t`App`}
                         name="app">
                         <select class="pf-c-form-control">
-                            <option value="" ?selected=${this.policy?.app === undefined}>---------</option>
+                            <option value="" ?selected=${this.instance?.app === undefined}>---------</option>
                             ${until(new AdminApi(DEFAULT_CONFIG).adminAppsList().then(apps => {
                                 return apps.map(app => {
-                                    return html`<option value=${app.name} ?selected=${this.policy?.app === app.name}>${app.label}</option>`;
+                                    return html`<option value=${app.name} ?selected=${this.instance?.app === app.name}>${app.label}</option>`;
                                 });
                             }), html`<option>${t`Loading...`}</option>`)}
                         </select>
diff --git a/web/src/pages/policies/expiry/ExpiryPolicyForm.ts b/web/src/pages/policies/expiry/ExpiryPolicyForm.ts
index 4084b5d55..cfb404bb3 100644
--- a/web/src/pages/policies/expiry/ExpiryPolicyForm.ts
+++ b/web/src/pages/policies/expiry/ExpiryPolicyForm.ts
@@ -1,30 +1,25 @@
 import { PasswordExpiryPolicy, PoliciesApi } from "authentik-api";
 import { t } from "@lingui/macro";
-import { customElement, property } from "lit-element";
+import { customElement } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../../api/Config";
-import { Form } from "../../../elements/forms/Form";
 import { ifDefined } from "lit-html/directives/if-defined";
 import "../../../elements/forms/HorizontalFormElement";
 import "../../../elements/forms/FormGroup";
 import { first } from "../../../utils";
+import { ModelForm } from "../../../elements/forms/ModelForm";
 
 @customElement("ak-policy-password-expiry-form")
-export class PasswordExpiryPolicyForm extends Form<PasswordExpiryPolicy> {
+export class PasswordExpiryPolicyForm extends ModelForm<PasswordExpiryPolicy, string> {
 
-    set policyUUID(value: string) {
-        new PoliciesApi(DEFAULT_CONFIG).policiesPasswordExpiryRead({
-            policyUuid: value,
-        }).then(policy => {
-            this.policy = policy;
+    loadInstance(pk: string): Promise<PasswordExpiryPolicy> {
+        return new PoliciesApi(DEFAULT_CONFIG).policiesPasswordExpiryRead({
+            policyUuid: pk,
         });
     }
 
-    @property({attribute: false})
-    policy?: PasswordExpiryPolicy;
-
     getSuccessMessage(): string {
-        if (this.policy) {
+        if (this.instance) {
             return t`Successfully updated policy.`;
         } else {
             return t`Successfully created policy.`;
@@ -32,9 +27,9 @@ export class PasswordExpiryPolicyForm extends Form<PasswordExpiryPolicy> {
     }
 
     send = (data: PasswordExpiryPolicy): Promise<PasswordExpiryPolicy> => {
-        if (this.policy) {
+        if (this.instance) {
             return new PoliciesApi(DEFAULT_CONFIG).policiesPasswordExpiryUpdate({
-                policyUuid: this.policy.pk || "",
+                policyUuid: this.instance.pk || "",
                 data: data
             });
         } else {
@@ -53,11 +48,11 @@ export class PasswordExpiryPolicyForm extends Form<PasswordExpiryPolicy> {
                 label=${t`Name`}
                 ?required=${true}
                 name="name">
-                <input type="text" value="${ifDefined(this.policy?.name || "")}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.name || "")}" class="pf-c-form-control" required>
             </ak-form-element-horizontal>
             <ak-form-element-horizontal name="executionLogging">
                 <div class="pf-c-check">
-                    <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.policy?.executionLogging, false)}>
+                    <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.instance?.executionLogging, false)}>
                     <label class="pf-c-check__label">
                         ${t`Execution logging`}
                     </label>
@@ -75,11 +70,11 @@ export class PasswordExpiryPolicyForm extends Form<PasswordExpiryPolicy> {
                         label=${t`Maximum age (in days)`}
                         ?required=${true}
                         name="days">
-                        <input type="number" value="${ifDefined(this.policy?.days || "")}" class="pf-c-form-control" required>
+                        <input type="number" value="${ifDefined(this.instance?.days || "")}" class="pf-c-form-control" required>
                     </ak-form-element-horizontal>
                     <ak-form-element-horizontal name="denyOnly">
                         <div class="pf-c-check">
-                            <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.policy?.denyOnly, false)}>
+                            <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.instance?.denyOnly, false)}>
                             <label class="pf-c-check__label">
                                 ${t`Only fail the policy, don't invalidate user's password.`}
                             </label>
diff --git a/web/src/pages/policies/expression/ExpressionPolicyForm.ts b/web/src/pages/policies/expression/ExpressionPolicyForm.ts
index dcc047bdc..bb44eb97d 100644
--- a/web/src/pages/policies/expression/ExpressionPolicyForm.ts
+++ b/web/src/pages/policies/expression/ExpressionPolicyForm.ts
@@ -1,31 +1,26 @@
 import { ExpressionPolicy, PoliciesApi } from "authentik-api";
 import { t } from "@lingui/macro";
-import { customElement, property } from "lit-element";
+import { customElement } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../../api/Config";
-import { Form } from "../../../elements/forms/Form";
 import { ifDefined } from "lit-html/directives/if-defined";
 import "../../../elements/forms/HorizontalFormElement";
 import "../../../elements/forms/FormGroup";
 import "../../../elements/CodeMirror";
 import { first } from "../../../utils";
+import { ModelForm } from "../../../elements/forms/ModelForm";
 
 @customElement("ak-policy-expression-form")
-export class ExpressionPolicyForm extends Form<ExpressionPolicy> {
+export class ExpressionPolicyForm extends ModelForm<ExpressionPolicy, string> {
 
-    set policyUUID(value: string) {
-        new PoliciesApi(DEFAULT_CONFIG).policiesExpressionRead({
-            policyUuid: value,
-        }).then(policy => {
-            this.policy = policy;
+    loadInstance(pk: string): Promise<ExpressionPolicy> {
+        return new PoliciesApi(DEFAULT_CONFIG).policiesExpressionRead({
+            policyUuid: pk,
         });
     }
 
-    @property({attribute: false})
-    policy?: ExpressionPolicy;
-
     getSuccessMessage(): string {
-        if (this.policy) {
+        if (this.instance) {
             return t`Successfully updated policy.`;
         } else {
             return t`Successfully created policy.`;
@@ -33,9 +28,9 @@ export class ExpressionPolicyForm extends Form<ExpressionPolicy> {
     }
 
     send = (data: ExpressionPolicy): Promise<ExpressionPolicy> => {
-        if (this.policy) {
+        if (this.instance) {
             return new PoliciesApi(DEFAULT_CONFIG).policiesExpressionUpdate({
-                policyUuid: this.policy.pk || "",
+                policyUuid: this.instance.pk || "",
                 data: data
             });
         } else {
@@ -54,11 +49,11 @@ export class ExpressionPolicyForm extends Form<ExpressionPolicy> {
                 label=${t`Name`}
                 ?required=${true}
                 name="name">
-                <input type="text" value="${ifDefined(this.policy?.name || "")}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.name || "")}" class="pf-c-form-control" required>
             </ak-form-element-horizontal>
             <ak-form-element-horizontal name="executionLogging">
                 <div class="pf-c-check">
-                    <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.policy?.executionLogging, false)}>
+                    <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.instance?.executionLogging, false)}>
                     <label class="pf-c-check__label">
                         ${t`Execution logging`}
                     </label>
@@ -76,7 +71,7 @@ export class ExpressionPolicyForm extends Form<ExpressionPolicy> {
                         label=${t`Expression`}
                         ?required=${true}
                         name="expression">
-                        <ak-codemirror mode="python" value="${ifDefined(this.policy?.expression)}">
+                        <ak-codemirror mode="python" value="${ifDefined(this.instance?.expression)}">
                         </ak-codemirror>
                         <p class="pf-c-form__helper-text">
                             ${t`Expression using Python.`}
diff --git a/web/src/pages/policies/hibp/HaveIBeenPwnedPolicyForm.ts b/web/src/pages/policies/hibp/HaveIBeenPwnedPolicyForm.ts
index 79d06ae9f..813ee70dc 100644
--- a/web/src/pages/policies/hibp/HaveIBeenPwnedPolicyForm.ts
+++ b/web/src/pages/policies/hibp/HaveIBeenPwnedPolicyForm.ts
@@ -1,30 +1,25 @@
 import { HaveIBeenPwendPolicy, PoliciesApi } from "authentik-api";
 import { t } from "@lingui/macro";
-import { customElement, property } from "lit-element";
+import { customElement } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../../api/Config";
-import { Form } from "../../../elements/forms/Form";
 import { ifDefined } from "lit-html/directives/if-defined";
 import "../../../elements/forms/HorizontalFormElement";
 import "../../../elements/forms/FormGroup";
 import { first } from "../../../utils";
+import { ModelForm } from "../../../elements/forms/ModelForm";
 
 @customElement("ak-policy-hibp-form")
-export class HaveIBeenPwnedPolicyForm extends Form<HaveIBeenPwendPolicy> {
+export class HaveIBeenPwnedPolicyForm extends ModelForm<HaveIBeenPwendPolicy, string> {
 
-    set policyUUID(value: string) {
-        new PoliciesApi(DEFAULT_CONFIG).policiesHaveibeenpwnedRead({
-            policyUuid: value,
-        }).then(policy => {
-            this.policy = policy;
+    loadInstance(pk: string): Promise<HaveIBeenPwendPolicy> {
+        return new PoliciesApi(DEFAULT_CONFIG).policiesHaveibeenpwnedRead({
+            policyUuid: pk,
         });
     }
 
-    @property({attribute: false})
-    policy?: HaveIBeenPwendPolicy;
-
     getSuccessMessage(): string {
-        if (this.policy) {
+        if (this.instance) {
             return t`Successfully updated policy.`;
         } else {
             return t`Successfully created policy.`;
@@ -32,9 +27,9 @@ export class HaveIBeenPwnedPolicyForm extends Form<HaveIBeenPwendPolicy> {
     }
 
     send = (data: HaveIBeenPwendPolicy): Promise<HaveIBeenPwendPolicy> => {
-        if (this.policy) {
+        if (this.instance) {
             return new PoliciesApi(DEFAULT_CONFIG).policiesHaveibeenpwnedUpdate({
-                policyUuid: this.policy.pk || "",
+                policyUuid: this.instance.pk || "",
                 data: data
             });
         } else {
@@ -54,11 +49,11 @@ export class HaveIBeenPwnedPolicyForm extends Form<HaveIBeenPwendPolicy> {
                 label=${t`Name`}
                 ?required=${true}
                 name="name">
-                <input type="text" value="${ifDefined(this.policy?.name || "")}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.name || "")}" class="pf-c-form-control" required>
             </ak-form-element-horizontal>
             <ak-form-element-horizontal name="executionLogging">
                 <div class="pf-c-check">
-                    <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.policy?.executionLogging, false)}>
+                    <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.instance?.executionLogging, false)}>
                     <label class="pf-c-check__label">
                         ${t`Execution logging`}
                     </label>
@@ -76,14 +71,14 @@ export class HaveIBeenPwnedPolicyForm extends Form<HaveIBeenPwendPolicy> {
                         label=${t`Password field`}
                         ?required=${true}
                         name="passwordField">
-                        <input type="text" value="${ifDefined(this.policy?.passwordField || "password")}" class="pf-c-form-control" required>
+                        <input type="text" value="${ifDefined(this.instance?.passwordField || "password")}" class="pf-c-form-control" required>
                         <p class="pf-c-form__helper-text">${t`Field key to check, field keys defined in Prompt stages are available.`}</p>
                     </ak-form-element-horizontal>
                     <ak-form-element-horizontal
                         label=${t`Allowed count`}
                         ?required=${true}
                         name="allowedCount">
-                        <input type="number" value="${first(this.policy?.allowedCount, 0)}" class="pf-c-form-control" required>
+                        <input type="number" value="${first(this.instance?.allowedCount, 0)}" class="pf-c-form-control" required>
                         <p class="pf-c-form__helper-text">${t`Allow up to N occurrences in the HIBP database.`}</p>
                     </ak-form-element-horizontal>
                 </div>
diff --git a/web/src/pages/policies/password/PasswordPolicyForm.ts b/web/src/pages/policies/password/PasswordPolicyForm.ts
index cc663ecde..15ace51c0 100644
--- a/web/src/pages/policies/password/PasswordPolicyForm.ts
+++ b/web/src/pages/policies/password/PasswordPolicyForm.ts
@@ -1,30 +1,25 @@
 import { PasswordPolicy, PoliciesApi } from "authentik-api";
 import { t } from "@lingui/macro";
-import { customElement, property } from "lit-element";
+import { customElement } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../../api/Config";
-import { Form } from "../../../elements/forms/Form";
 import { ifDefined } from "lit-html/directives/if-defined";
 import "../../../elements/forms/HorizontalFormElement";
 import "../../../elements/forms/FormGroup";
 import { first } from "../../../utils";
+import { ModelForm } from "../../../elements/forms/ModelForm";
 
 @customElement("ak-policy-password-form")
-export class PasswordPolicyForm extends Form<PasswordPolicy> {
+export class PasswordPolicyForm extends ModelForm<PasswordPolicy, string> {
 
-    set policyUUID(value: string) {
-        new PoliciesApi(DEFAULT_CONFIG).policiesPasswordRead({
-            policyUuid: value,
-        }).then(policy => {
-            this.policy = policy;
+    loadInstance(pk: string): Promise<PasswordPolicy> {
+        return new PoliciesApi(DEFAULT_CONFIG).policiesPasswordRead({
+            policyUuid: pk,
         });
     }
 
-    @property({attribute: false})
-    policy?: PasswordPolicy;
-
     getSuccessMessage(): string {
-        if (this.policy) {
+        if (this.instance) {
             return t`Successfully updated policy.`;
         } else {
             return t`Successfully created policy.`;
@@ -32,9 +27,9 @@ export class PasswordPolicyForm extends Form<PasswordPolicy> {
     }
 
     send = (data: PasswordPolicy): Promise<PasswordPolicy> => {
-        if (this.policy) {
+        if (this.instance) {
             return new PoliciesApi(DEFAULT_CONFIG).policiesPasswordUpdate({
-                policyUuid: this.policy.pk || "",
+                policyUuid: this.instance.pk || "",
                 data: data
             });
         } else {
@@ -53,11 +48,11 @@ export class PasswordPolicyForm extends Form<PasswordPolicy> {
                 label=${t`Name`}
                 ?required=${true}
                 name="name">
-                <input type="text" value="${ifDefined(this.policy?.name || "")}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.name || "")}" class="pf-c-form-control" required>
             </ak-form-element-horizontal>
             <ak-form-element-horizontal name="executionLogging">
                 <div class="pf-c-check">
-                    <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.policy?.executionLogging, false)}>
+                    <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.instance?.executionLogging, false)}>
                     <label class="pf-c-check__label">
                         ${t`Execution logging`}
                     </label>
@@ -75,7 +70,7 @@ export class PasswordPolicyForm extends Form<PasswordPolicy> {
                         label=${t`Password field`}
                         ?required=${true}
                         name="passwordField">
-                        <input type="text" value="${ifDefined(this.policy?.passwordField || "password")}" class="pf-c-form-control" required>
+                        <input type="text" value="${ifDefined(this.instance?.passwordField || "password")}" class="pf-c-form-control" required>
                         <p class="pf-c-form__helper-text">${t`Field key to check, field keys defined in Prompt stages are available.`}</p>
                     </ak-form-element-horizontal>
 
@@ -83,31 +78,31 @@ export class PasswordPolicyForm extends Form<PasswordPolicy> {
                         label=${t`Minimum length`}
                         ?required=${true}
                         name="lengthMin">
-                        <input type="number" value="${first(this.policy?.lengthMin, 10)}" class="pf-c-form-control" required>
+                        <input type="number" value="${first(this.instance?.lengthMin, 10)}" class="pf-c-form-control" required>
                     </ak-form-element-horizontal>
                     <ak-form-element-horizontal
                         label=${t`Minimum amount of Uppercase Characters`}
                         ?required=${true}
                         name="amountUppercase">
-                        <input type="number" value="${first(this.policy?.amountUppercase, 2)}" class="pf-c-form-control" required>
+                        <input type="number" value="${first(this.instance?.amountUppercase, 2)}" class="pf-c-form-control" required>
                     </ak-form-element-horizontal>
                     <ak-form-element-horizontal
                         label=${t`Minimum amount of Lowercase Characters`}
                         ?required=${true}
                         name="amountLowercase">
-                        <input type="number" value="${first(this.policy?.amountLowercase, 2)}" class="pf-c-form-control" required>
+                        <input type="number" value="${first(this.instance?.amountLowercase, 2)}" class="pf-c-form-control" required>
                     </ak-form-element-horizontal>
                     <ak-form-element-horizontal
                         label=${t`Minimum amount of Symbols Characters`}
                         ?required=${true}
                         name="amountSymbols">
-                        <input type="number" value="${first(this.policy?.amountSymbols, 2)}" class="pf-c-form-control" required>
+                        <input type="number" value="${first(this.instance?.amountSymbols, 2)}" class="pf-c-form-control" required>
                     </ak-form-element-horizontal>
                     <ak-form-element-horizontal
                         label=${t`Error message`}
                         ?required=${true}
                         name="errorMessage">
-                        <input type="text" value="${ifDefined(this.policy?.errorMessage)}" class="pf-c-form-control" required>
+                        <input type="text" value="${ifDefined(this.instance?.errorMessage)}" class="pf-c-form-control" required>
                     </ak-form-element-horizontal>
                 </div>
             </ak-form-group>
@@ -120,7 +115,7 @@ export class PasswordPolicyForm extends Form<PasswordPolicy> {
                         label=${t`Symbol charset`}
                         ?required=${true}
                         name="symbolCharset">
-                        <input type="text" value="${ifDefined(this.policy?.symbolCharset || "!\\\"#$%&'()*+,-./:;<=>?@[]^_`{|}~ ")}" class="pf-c-form-control" required>
+                        <input type="text" value="${ifDefined(this.instance?.symbolCharset || "!\\\"#$%&'()*+,-./:;<=>?@[]^_`{|}~ ")}" class="pf-c-form-control" required>
                         <p class="pf-c-form__helper-text">${t`Characters which are considered as symbols.`}</p>
                     </ak-form-element-horizontal>
                 </div>
diff --git a/web/src/pages/policies/reputation/ReputationPolicyForm.ts b/web/src/pages/policies/reputation/ReputationPolicyForm.ts
index 4d14be0f9..1b606ba09 100644
--- a/web/src/pages/policies/reputation/ReputationPolicyForm.ts
+++ b/web/src/pages/policies/reputation/ReputationPolicyForm.ts
@@ -1,30 +1,25 @@
 import { ReputationPolicy, PoliciesApi } from "authentik-api";
 import { t } from "@lingui/macro";
-import { customElement, property } from "lit-element";
+import { customElement } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../../api/Config";
-import { Form } from "../../../elements/forms/Form";
 import { ifDefined } from "lit-html/directives/if-defined";
 import "../../../elements/forms/HorizontalFormElement";
 import "../../../elements/forms/FormGroup";
 import { first } from "../../../utils";
+import { ModelForm } from "../../../elements/forms/ModelForm";
 
 @customElement("ak-policy-reputation-form")
-export class ReputationPolicyForm extends Form<ReputationPolicy> {
+export class ReputationPolicyForm extends ModelForm<ReputationPolicy, string> {
 
-    set policyUUID(value: string) {
-        new PoliciesApi(DEFAULT_CONFIG).policiesReputationRead({
-            policyUuid: value,
-        }).then(policy => {
-            this.policy = policy;
+    loadInstance(pk: string): Promise<ReputationPolicy> {
+        return new PoliciesApi(DEFAULT_CONFIG).policiesReputationRead({
+            policyUuid: pk,
         });
     }
 
-    @property({attribute: false})
-    policy?: ReputationPolicy;
-
     getSuccessMessage(): string {
-        if (this.policy) {
+        if (this.instance) {
             return t`Successfully updated policy.`;
         } else {
             return t`Successfully created policy.`;
@@ -32,9 +27,9 @@ export class ReputationPolicyForm extends Form<ReputationPolicy> {
     }
 
     send = (data: ReputationPolicy): Promise<ReputationPolicy> => {
-        if (this.policy) {
+        if (this.instance) {
             return new PoliciesApi(DEFAULT_CONFIG).policiesReputationUpdate({
-                policyUuid: this.policy.pk || "",
+                policyUuid: this.instance.pk || "",
                 data: data
             });
         } else {
@@ -53,11 +48,11 @@ export class ReputationPolicyForm extends Form<ReputationPolicy> {
                 label=${t`Name`}
                 ?required=${true}
                 name="name">
-                <input type="text" value="${ifDefined(this.policy?.name || "")}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.name || "")}" class="pf-c-form-control" required>
             </ak-form-element-horizontal>
             <ak-form-element-horizontal name="executionLogging">
                 <div class="pf-c-check">
-                    <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.policy?.executionLogging, false)}>
+                    <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.instance?.executionLogging, false)}>
                     <label class="pf-c-check__label">
                         ${t`Execution logging`}
                     </label>
@@ -73,7 +68,7 @@ export class ReputationPolicyForm extends Form<ReputationPolicy> {
                 <div slot="body" class="pf-c-form">
                     <ak-form-element-horizontal name="checkIp">
                         <div class="pf-c-check">
-                            <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.policy?.checkIp, false)}>
+                            <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.instance?.checkIp, false)}>
                             <label class="pf-c-check__label">
                                 ${t`Check IP`}
                             </label>
@@ -81,7 +76,7 @@ export class ReputationPolicyForm extends Form<ReputationPolicy> {
                     </ak-form-element-horizontal>
                     <ak-form-element-horizontal name="checkUsername">
                         <div class="pf-c-check">
-                            <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.policy?.checkUsername, false)}>
+                            <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.instance?.checkUsername, false)}>
                             <label class="pf-c-check__label">
                                 ${t`Check Username`}
                             </label>
@@ -91,7 +86,7 @@ export class ReputationPolicyForm extends Form<ReputationPolicy> {
                         label=${t`Threshold`}
                         ?required=${true}
                         name="threshold">
-                        <input type="number" value="${ifDefined(this.policy?.threshold || -5)}" class="pf-c-form-control" required>
+                        <input type="number" value="${ifDefined(this.instance?.threshold || -5)}" class="pf-c-form-control" required>
                     </ak-form-element-horizontal>
                 </div>
             </ak-form-group>

From 59f339bedad9e7e410765d411bb48a1f034a2f91 Mon Sep 17 00:00:00 2001
From: Jens Langhammer <jens.langhammer@beryju.org>
Date: Tue, 11 May 2021 12:33:55 +0200
Subject: [PATCH 07/10] web/admin: migrate stage forms to ModelForm

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
---
 web/src/pages/flows/BoundStagesList.ts        |  2 +-
 web/src/pages/stages/StageListPage.ts         |  2 +-
 .../AuthenticatorStaticStageForm.ts           | 33 ++++++------
 .../AuthenticatorTOTPStageForm.ts             | 35 ++++++-------
 .../AuthenticatorValidateStageForm.ts         | 35 ++++++-------
 .../AuthenticateWebAuthnStageForm.ts          | 25 ++++------
 .../pages/stages/captcha/CaptchaStageForm.ts  | 31 +++++-------
 .../pages/stages/consent/ConsentStageForm.ts  | 31 ++++++------
 web/src/pages/stages/deny/DenyStageForm.ts    | 25 ++++------
 web/src/pages/stages/dummy/DummyStageForm.ts  | 25 ++++------
 web/src/pages/stages/email/EmailStageForm.ts  | 50 +++++++++----------
 .../identification/IdentificationStageForm.ts | 39 +++++++--------
 .../stages/invitation/InvitationStageForm.ts  | 27 ++++------
 .../stages/password/PasswordStageForm.ts      | 35 ++++++-------
 .../pages/stages/prompt/PromptStageForm.ts    | 29 +++++------
 .../stages/user_delete/UserDeleteStageForm.ts | 25 ++++------
 .../stages/user_login/UserLoginStageForm.ts   | 27 ++++------
 .../stages/user_logout/UserLogoutStageForm.ts | 25 ++++------
 .../stages/user_write/UserWriteStageForm.ts   | 25 ++++------
 19 files changed, 224 insertions(+), 302 deletions(-)

diff --git a/web/src/pages/flows/BoundStagesList.ts b/web/src/pages/flows/BoundStagesList.ts
index f1a1d9615..cc602929a 100644
--- a/web/src/pages/flows/BoundStagesList.ts
+++ b/web/src/pages/flows/BoundStagesList.ts
@@ -58,7 +58,7 @@ export class BoundStagesList extends Table<FlowStageBinding> {
                 <ak-proxy-form
                     slot="form"
                     .args=${{
-                        "stageUUID": item.stage
+                        "instancePk": item.stage
                     }}
                     type=${ifDefined(item.stageObj?.component)}>
                 </ak-proxy-form>
diff --git a/web/src/pages/stages/StageListPage.ts b/web/src/pages/stages/StageListPage.ts
index 4b82fcb4e..17f62e267 100644
--- a/web/src/pages/stages/StageListPage.ts
+++ b/web/src/pages/stages/StageListPage.ts
@@ -90,7 +90,7 @@ export class StageListPage extends TablePage<Stage> {
                 <ak-proxy-form
                     slot="form"
                     .args=${{
-                        "stageUUID": item.pk
+                        "instancePk": item.pk
                     }}
                     type=${ifDefined(item.component)}>
                 </ak-proxy-form>
diff --git a/web/src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts b/web/src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts
index b160d5056..243583d59 100644
--- a/web/src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts
+++ b/web/src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts
@@ -1,31 +1,26 @@
 import { FlowDesignationEnum, FlowsApi, AuthenticatorStaticStage, StagesApi } from "authentik-api";
 import { t } from "@lingui/macro";
-import { customElement, property } from "lit-element";
+import { customElement } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../../api/Config";
-import { Form } from "../../../elements/forms/Form";
 import { ifDefined } from "lit-html/directives/if-defined";
 import "../../../elements/forms/HorizontalFormElement";
 import "../../../elements/forms/FormGroup";
 import { until } from "lit-html/directives/until";
 import { first } from "../../../utils";
+import { ModelForm } from "../../../elements/forms/ModelForm";
 
 @customElement("ak-stage-authenticator-static-form")
-export class AuthenticatorStaticStageForm extends Form<AuthenticatorStaticStage> {
+export class AuthenticatorStaticStageForm extends ModelForm<AuthenticatorStaticStage, string> {
 
-    set stageUUID(value: string) {
-        new StagesApi(DEFAULT_CONFIG).stagesAuthenticatorStaticRead({
-            stageUuid: value,
-        }).then(stage => {
-            this.stage = stage;
+    loadInstance(pk: string): Promise<AuthenticatorStaticStage> {
+        return new StagesApi(DEFAULT_CONFIG).stagesAuthenticatorStaticRead({
+            stageUuid: pk,
         });
     }
 
-    @property({attribute: false})
-    stage?: AuthenticatorStaticStage;
-
     getSuccessMessage(): string {
-        if (this.stage) {
+        if (this.instance) {
             return t`Successfully updated stage.`;
         } else {
             return t`Successfully created stage.`;
@@ -33,9 +28,9 @@ export class AuthenticatorStaticStageForm extends Form<AuthenticatorStaticStage>
     }
 
     send = (data: AuthenticatorStaticStage): Promise<AuthenticatorStaticStage> => {
-        if (this.stage) {
+        if (this.instance) {
             return new StagesApi(DEFAULT_CONFIG).stagesAuthenticatorStaticUpdate({
-                stageUuid: this.stage.pk || "",
+                stageUuid: this.instance.pk || "",
                 data: data
             });
         } else {
@@ -54,7 +49,7 @@ export class AuthenticatorStaticStageForm extends Form<AuthenticatorStaticStage>
                 label=${t`Name`}
                 ?required=${true}
                 name="name">
-                <input type="text" value="${ifDefined(this.stage?.name || "")}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.name || "")}" class="pf-c-form-control" required>
             </ak-form-element-horizontal>
             <ak-form-group .expanded=${true}>
                 <span slot="header">
@@ -65,20 +60,20 @@ export class AuthenticatorStaticStageForm extends Form<AuthenticatorStaticStage>
                         label=${t`Token count`}
                         ?required=${true}
                         name="tokenCount">
-                        <input type="text" value="${first(this.stage?.tokenCount, 6)}" class="pf-c-form-control" required>
+                        <input type="text" value="${first(this.instance?.tokenCount, 6)}" class="pf-c-form-control" required>
                     </ak-form-element-horizontal>
                     <ak-form-element-horizontal
                         label=${t`Configuration flow`}
                         name="configureFlow">
                         <select class="pf-c-form-control">
-                            <option value="" ?selected=${this.stage?.configureFlow === undefined}>---------</option>
+                            <option value="" ?selected=${this.instance?.configureFlow === undefined}>---------</option>
                             ${until(new FlowsApi(DEFAULT_CONFIG).flowsInstancesList({
                                 ordering: "pk",
                                 designation: FlowDesignationEnum.StageConfiguration,
                             }).then(flows => {
                                 return flows.results.map(flow => {
-                                    let selected = this.stage?.configureFlow === flow.pk;
-                                    if (!this.stage?.pk && !this.stage?.configureFlow && flow.slug === "default-otp-time-configure") {
+                                    let selected = this.instance?.configureFlow === flow.pk;
+                                    if (!this.instance?.pk && !this.instance?.configureFlow && flow.slug === "default-otp-time-configure") {
                                         selected = true;
                                     }
                                     return html`<option value=${ifDefined(flow.pk)} ?selected=${selected}>${flow.name} (${flow.slug})</option>`;
diff --git a/web/src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts b/web/src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts
index 51b14400f..b92164768 100644
--- a/web/src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts
+++ b/web/src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts
@@ -1,30 +1,25 @@
 import { FlowDesignationEnum, FlowsApi, AuthenticatorTOTPStage, StagesApi } from "authentik-api";
 import { t } from "@lingui/macro";
-import { customElement, property } from "lit-element";
+import { customElement } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../../api/Config";
-import { Form } from "../../../elements/forms/Form";
 import { ifDefined } from "lit-html/directives/if-defined";
 import "../../../elements/forms/HorizontalFormElement";
 import "../../../elements/forms/FormGroup";
 import { until } from "lit-html/directives/until";
+import { ModelForm } from "../../../elements/forms/ModelForm";
 
 @customElement("ak-stage-authenticator-totp-form")
-export class AuthenticatorTOTPStageForm extends Form<AuthenticatorTOTPStage> {
+export class AuthenticatorTOTPStageForm extends ModelForm<AuthenticatorTOTPStage, string> {
 
-    set stageUUID(value: string) {
-        new StagesApi(DEFAULT_CONFIG).stagesAuthenticatorTotpRead({
-            stageUuid: value,
-        }).then(stage => {
-            this.stage = stage;
+    loadInstance(pk: string): Promise<AuthenticatorTOTPStage> {
+        return new StagesApi(DEFAULT_CONFIG).stagesAuthenticatorTotpRead({
+            stageUuid: pk,
         });
     }
 
-    @property({attribute: false})
-    stage?: AuthenticatorTOTPStage;
-
     getSuccessMessage(): string {
-        if (this.stage) {
+        if (this.instance) {
             return t`Successfully updated stage.`;
         } else {
             return t`Successfully created stage.`;
@@ -32,9 +27,9 @@ export class AuthenticatorTOTPStageForm extends Form<AuthenticatorTOTPStage> {
     }
 
     send = (data: AuthenticatorTOTPStage): Promise<AuthenticatorTOTPStage> => {
-        if (this.stage) {
+        if (this.instance) {
             return new StagesApi(DEFAULT_CONFIG).stagesAuthenticatorTotpUpdate({
-                stageUuid: this.stage.pk || "",
+                stageUuid: this.instance.pk || "",
                 data: data
             });
         } else {
@@ -53,7 +48,7 @@ export class AuthenticatorTOTPStageForm extends Form<AuthenticatorTOTPStage> {
                 label=${t`Name`}
                 ?required=${true}
                 name="name">
-                <input type="text" value="${ifDefined(this.stage?.name || "")}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.name || "")}" class="pf-c-form-control" required>
             </ak-form-element-horizontal>
             <ak-form-group .expanded=${true}>
                 <span slot="header">
@@ -65,10 +60,10 @@ export class AuthenticatorTOTPStageForm extends Form<AuthenticatorTOTPStage> {
                         ?required=${true}
                         name="digits">
                         <select name="users" class="pf-c-form-control">
-                            <option value="6" ?selected=${this.stage?.digits === 6}>
+                            <option value="6" ?selected=${this.instance?.digits === 6}>
                                 ${t`6 digits, widely compatible`}
                             </option>
-                            <option value="8" ?selected=${this.stage?.digits === 8}>
+                            <option value="8" ?selected=${this.instance?.digits === 8}>
                                 ${t`8 digits, not compatible with apps like Google Authenticator`}
                             </option>
                         </select>
@@ -77,14 +72,14 @@ export class AuthenticatorTOTPStageForm extends Form<AuthenticatorTOTPStage> {
                         label=${t`Configuration flow`}
                         name="configureFlow">
                         <select class="pf-c-form-control">
-                            <option value="" ?selected=${this.stage?.configureFlow === undefined}>---------</option>
+                            <option value="" ?selected=${this.instance?.configureFlow === undefined}>---------</option>
                             ${until(new FlowsApi(DEFAULT_CONFIG).flowsInstancesList({
                                 ordering: "pk",
                                 designation: FlowDesignationEnum.StageConfiguration,
                             }).then(flows => {
                                 return flows.results.map(flow => {
-                                    let selected = this.stage?.configureFlow === flow.pk;
-                                    if (!this.stage?.pk && !this.stage?.configureFlow && flow.slug === "default-otp-time-configure") {
+                                    let selected = this.instance?.configureFlow === flow.pk;
+                                    if (!this.instance?.pk && !this.instance?.configureFlow && flow.slug === "default-otp-time-configure") {
                                         selected = true;
                                     }
                                     return html`<option value=${ifDefined(flow.pk)} ?selected=${selected}>${flow.name} (${flow.slug})</option>`;
diff --git a/web/src/pages/stages/authenticator_validate/AuthenticatorValidateStageForm.ts b/web/src/pages/stages/authenticator_validate/AuthenticatorValidateStageForm.ts
index 189f52a77..5d38d8276 100644
--- a/web/src/pages/stages/authenticator_validate/AuthenticatorValidateStageForm.ts
+++ b/web/src/pages/stages/authenticator_validate/AuthenticatorValidateStageForm.ts
@@ -3,32 +3,29 @@ import { t } from "@lingui/macro";
 import { customElement, property } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../../api/Config";
-import { Form } from "../../../elements/forms/Form";
 import { ifDefined } from "lit-html/directives/if-defined";
 import "../../../elements/forms/HorizontalFormElement";
 import "../../../elements/forms/FormGroup";
 import { until } from "lit-html/directives/until";
+import { ModelForm } from "../../../elements/forms/ModelForm";
 
 @customElement("ak-stage-authenticator-validate-form")
-export class AuthenticatorValidateStageForm extends Form<AuthenticatorValidateStage> {
+export class AuthenticatorValidateStageForm extends ModelForm<AuthenticatorValidateStage, string> {
 
-    set stageUUID(value: string) {
-        new StagesApi(DEFAULT_CONFIG).stagesAuthenticatorValidateRead({
-            stageUuid: value,
+    loadInstance(pk: string): Promise<AuthenticatorValidateStage> {
+        return new StagesApi(DEFAULT_CONFIG).stagesAuthenticatorValidateRead({
+            stageUuid: pk,
         }).then(stage => {
-            this.stage = stage;
             this.showConfigureFlow = stage.notConfiguredAction === AuthenticatorValidateStageNotConfiguredActionEnum.Configure;
+            return stage;
         });
     }
 
-    @property({attribute: false})
-    stage?: AuthenticatorValidateStage;
-
     @property({ type: Boolean })
     showConfigureFlow = false;
 
     getSuccessMessage(): string {
-        if (this.stage) {
+        if (this.instance) {
             return t`Successfully updated stage.`;
         } else {
             return t`Successfully created stage.`;
@@ -36,9 +33,9 @@ export class AuthenticatorValidateStageForm extends Form<AuthenticatorValidateSt
     }
 
     send = (data: AuthenticatorValidateStage): Promise<AuthenticatorValidateStage> => {
-        if (this.stage) {
+        if (this.instance) {
             return new StagesApi(DEFAULT_CONFIG).stagesAuthenticatorValidateUpdate({
-                stageUuid: this.stage.pk || "",
+                stageUuid: this.instance.pk || "",
                 data: data
             });
         } else {
@@ -49,7 +46,7 @@ export class AuthenticatorValidateStageForm extends Form<AuthenticatorValidateSt
     };
 
     isDeviceClassSelected(field: AuthenticatorValidateStageDeviceClassesEnum): boolean {
-        return (this.stage?.deviceClasses || []).filter(isField => {
+        return (this.instance?.deviceClasses || []).filter(isField => {
             return field === isField;
         }).length > 0;
     }
@@ -63,7 +60,7 @@ export class AuthenticatorValidateStageForm extends Form<AuthenticatorValidateSt
                 label=${t`Name`}
                 ?required=${true}
                 name="name">
-                <input type="text" value="${ifDefined(this.stage?.name || "")}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.name || "")}" class="pf-c-form-control" required>
             </ak-form-element-horizontal>
             <ak-form-group .expanded=${true}>
                 <span slot="header">
@@ -82,13 +79,13 @@ export class AuthenticatorValidateStageForm extends Form<AuthenticatorValidateSt
                                 this.showConfigureFlow = false;
                             }
                         }}>
-                            <option value=${AuthenticatorValidateStageNotConfiguredActionEnum.Configure} ?selected=${this.stage?.notConfiguredAction === AuthenticatorValidateStageNotConfiguredActionEnum.Configure}>
+                            <option value=${AuthenticatorValidateStageNotConfiguredActionEnum.Configure} ?selected=${this.instance?.notConfiguredAction === AuthenticatorValidateStageNotConfiguredActionEnum.Configure}>
                                 ${t`Force the user to configure an authenticator`}
                             </option>
-                            <option value=${AuthenticatorValidateStageNotConfiguredActionEnum.Deny} ?selected=${this.stage?.notConfiguredAction === AuthenticatorValidateStageNotConfiguredActionEnum.Deny}>
+                            <option value=${AuthenticatorValidateStageNotConfiguredActionEnum.Deny} ?selected=${this.instance?.notConfiguredAction === AuthenticatorValidateStageNotConfiguredActionEnum.Deny}>
                                 ${t`Deny the user access`}
                             </option>
-                            <option value=${AuthenticatorValidateStageNotConfiguredActionEnum.Skip} ?selected=${this.stage?.notConfiguredAction === AuthenticatorValidateStageNotConfiguredActionEnum.Skip}>
+                            <option value=${AuthenticatorValidateStageNotConfiguredActionEnum.Skip} ?selected=${this.instance?.notConfiguredAction === AuthenticatorValidateStageNotConfiguredActionEnum.Skip}>
                                 ${t`Continue`}
                             </option>
                         </select>
@@ -117,12 +114,12 @@ export class AuthenticatorValidateStageForm extends Form<AuthenticatorValidateSt
                         ?required=${true}
                         name="configureFlow">
                         <select class="pf-c-form-control">
-                            <option value="" ?selected=${this.stage?.configurationStage === undefined}>---------</option>
+                            <option value="" ?selected=${this.instance?.configurationStage === undefined}>---------</option>
                             ${until(new StagesApi(DEFAULT_CONFIG).stagesAllList({
                                 ordering: "pk",
                             }).then(stages => {
                                 return stages.results.map(stage => {
-                                    const selected = this.stage?.configurationStage === stage.pk;
+                                    const selected = this.instance?.configurationStage === stage.pk;
                                     return html`<option value=${ifDefined(stage.pk)} ?selected=${selected}>${stage.name} (${stage.verboseName})</option>`;
                                 });
                             }), html`<option>${t`Loading...`}</option>`)}
diff --git a/web/src/pages/stages/authenticator_webauthn/AuthenticateWebAuthnStageForm.ts b/web/src/pages/stages/authenticator_webauthn/AuthenticateWebAuthnStageForm.ts
index 06a561d4e..0b449b019 100644
--- a/web/src/pages/stages/authenticator_webauthn/AuthenticateWebAuthnStageForm.ts
+++ b/web/src/pages/stages/authenticator_webauthn/AuthenticateWebAuthnStageForm.ts
@@ -1,28 +1,23 @@
 import { AuthenticateWebAuthnStage, StagesApi } from "authentik-api";
 import { t } from "@lingui/macro";
-import { customElement, property } from "lit-element";
+import { customElement } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../../api/Config";
-import { Form } from "../../../elements/forms/Form";
 import { ifDefined } from "lit-html/directives/if-defined";
 import "../../../elements/forms/HorizontalFormElement";
+import { ModelForm } from "../../../elements/forms/ModelForm";
 
 @customElement("ak-stage-authenticator-webauthn-form")
-export class AuthenticateWebAuthnStageForm extends Form<AuthenticateWebAuthnStage> {
+export class AuthenticateWebAuthnStageForm extends ModelForm<AuthenticateWebAuthnStage, string> {
 
-    set stageUUID(value: string) {
-        new StagesApi(DEFAULT_CONFIG).stagesAuthenticatorWebauthnRead({
-            stageUuid: value,
-        }).then(stage => {
-            this.stage = stage;
+    loadInstance(pk: string): Promise<AuthenticateWebAuthnStage> {
+        return new StagesApi(DEFAULT_CONFIG).stagesAuthenticatorWebauthnRead({
+            stageUuid: pk,
         });
     }
 
-    @property({attribute: false})
-    stage?: AuthenticateWebAuthnStage;
-
     getSuccessMessage(): string {
-        if (this.stage) {
+        if (this.instance) {
             return t`Successfully updated stage.`;
         } else {
             return t`Successfully created stage.`;
@@ -30,9 +25,9 @@ export class AuthenticateWebAuthnStageForm extends Form<AuthenticateWebAuthnStag
     }
 
     send = (data: AuthenticateWebAuthnStage): Promise<AuthenticateWebAuthnStage> => {
-        if (this.stage) {
+        if (this.instance) {
             return new StagesApi(DEFAULT_CONFIG).stagesAuthenticatorWebauthnUpdate({
-                stageUuid: this.stage.pk || "",
+                stageUuid: this.instance.pk || "",
                 data: data
             });
         } else {
@@ -51,7 +46,7 @@ export class AuthenticateWebAuthnStageForm extends Form<AuthenticateWebAuthnStag
                 label=${t`Name`}
                 ?required=${true}
                 name="name">
-                <input type="text" value="${ifDefined(this.stage?.name || "")}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.name || "")}" class="pf-c-form-control" required>
             </ak-form-element-horizontal>
         </form>`;
     }
diff --git a/web/src/pages/stages/captcha/CaptchaStageForm.ts b/web/src/pages/stages/captcha/CaptchaStageForm.ts
index 970fd1f70..8d84252c2 100644
--- a/web/src/pages/stages/captcha/CaptchaStageForm.ts
+++ b/web/src/pages/stages/captcha/CaptchaStageForm.ts
@@ -1,29 +1,24 @@
 import { CaptchaStage, StagesApi } from "authentik-api";
 import { t } from "@lingui/macro";
-import { customElement, property } from "lit-element";
+import { customElement } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../../api/Config";
-import { Form } from "../../../elements/forms/Form";
 import { ifDefined } from "lit-html/directives/if-defined";
 import "../../../elements/forms/HorizontalFormElement";
 import "../../../elements/forms/FormGroup";
+import { ModelForm } from "../../../elements/forms/ModelForm";
 
 @customElement("ak-stage-captcha-form")
-export class CaptchaStageForm extends Form<CaptchaStage> {
+export class CaptchaStageForm extends ModelForm<CaptchaStage, string> {
 
-    set stageUUID(value: string) {
-        new StagesApi(DEFAULT_CONFIG).stagesCaptchaRead({
-            stageUuid: value,
-        }).then(stage => {
-            this.stage = stage;
+    loadInstance(pk: string): Promise<CaptchaStage> {
+        return new StagesApi(DEFAULT_CONFIG).stagesCaptchaRead({
+            stageUuid: pk,
         });
     }
 
-    @property({attribute: false})
-    stage?: CaptchaStage;
-
     getSuccessMessage(): string {
-        if (this.stage) {
+        if (this.instance) {
             return t`Successfully updated stage.`;
         } else {
             return t`Successfully created stage.`;
@@ -31,9 +26,9 @@ export class CaptchaStageForm extends Form<CaptchaStage> {
     }
 
     send = (data: CaptchaStage): Promise<CaptchaStage> => {
-        if (this.stage) {
+        if (this.instance) {
             return new StagesApi(DEFAULT_CONFIG).stagesCaptchaPartialUpdate({
-                stageUuid: this.stage.pk || "",
+                stageUuid: this.instance.pk || "",
                 data: data
             });
         } else {
@@ -52,7 +47,7 @@ export class CaptchaStageForm extends Form<CaptchaStage> {
                 label=${t`Name`}
                 ?required=${true}
                 name="name">
-                <input type="text" value="${ifDefined(this.stage?.name || "")}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.name || "")}" class="pf-c-form-control" required>
             </ak-form-element-horizontal>
             <ak-form-group .expanded=${true}>
                 <span slot="header">
@@ -63,15 +58,15 @@ export class CaptchaStageForm extends Form<CaptchaStage> {
                         label=${t`Public Key`}
                         ?required=${true}
                         name="publicKey">
-                        <input type="text" value="${ifDefined(this.stage?.publicKey || "")}" class="pf-c-form-control" required>
+                        <input type="text" value="${ifDefined(this.instance?.publicKey || "")}" class="pf-c-form-control" required>
                         <p class="pf-c-form__helper-text">${t`Public key, acquired from https://www.google.com/recaptcha/intro/v3.html.`}</p>
                     </ak-form-element-horizontal>
                     <ak-form-element-horizontal
                         label=${t`Private Key`}
                         ?required=${true}
-                        ?writeOnly=${this.stage !== undefined}
+                        ?writeOnly=${this.instance !== undefined}
                         name="privateKey">
-                        <input type="text" value="${ifDefined(this.stage?.privateKey || "")}" class="pf-c-form-control" required>
+                        <input type="text" value="${ifDefined(this.instance?.privateKey || "")}" class="pf-c-form-control" required>
                         <p class="pf-c-form__helper-text">${t`Private key, acquired from https://www.google.com/recaptcha/intro/v3.html.`}</p>
                     </ak-form-element-horizontal>
                 </div>
diff --git a/web/src/pages/stages/consent/ConsentStageForm.ts b/web/src/pages/stages/consent/ConsentStageForm.ts
index c33810525..c1776f77b 100644
--- a/web/src/pages/stages/consent/ConsentStageForm.ts
+++ b/web/src/pages/stages/consent/ConsentStageForm.ts
@@ -3,31 +3,28 @@ import { t } from "@lingui/macro";
 import { customElement, property } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../../api/Config";
-import { Form } from "../../../elements/forms/Form";
 import { ifDefined } from "lit-html/directives/if-defined";
 import "../../../elements/forms/HorizontalFormElement";
 import "../../../elements/forms/FormGroup";
+import { ModelForm } from "../../../elements/forms/ModelForm";
 
 @customElement("ak-stage-consent-form")
-export class ConsentStageForm extends Form<ConsentStage> {
+export class ConsentStageForm extends ModelForm<ConsentStage, string> {
 
-    set stageUUID(value: string) {
-        new StagesApi(DEFAULT_CONFIG).stagesConsentRead({
-            stageUuid: value,
+    loadInstance(pk: string): Promise<ConsentStage> {
+        return new StagesApi(DEFAULT_CONFIG).stagesConsentRead({
+            stageUuid: pk,
         }).then(stage => {
-            this.stage = stage;
             this.showExpiresIn = stage.name === ConsentStageModeEnum.Expiring;
+            return stage;
         });
     }
 
-    @property({attribute: false})
-    stage?: ConsentStage;
-
     @property({type: Boolean})
     showExpiresIn = false;
 
     getSuccessMessage(): string {
-        if (this.stage) {
+        if (this.instance) {
             return t`Successfully updated stage.`;
         } else {
             return t`Successfully created stage.`;
@@ -35,9 +32,9 @@ export class ConsentStageForm extends Form<ConsentStage> {
     }
 
     send = (data: ConsentStage): Promise<ConsentStage> => {
-        if (this.stage) {
+        if (this.instance) {
             return new StagesApi(DEFAULT_CONFIG).stagesConsentUpdate({
-                stageUuid: this.stage.pk || "",
+                stageUuid: this.instance.pk || "",
                 data: data
             });
         } else {
@@ -56,7 +53,7 @@ export class ConsentStageForm extends Form<ConsentStage> {
                 label=${t`Name`}
                 ?required=${true}
                 name="name">
-                <input type="text" value="${ifDefined(this.stage?.name || "")}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.name || "")}" class="pf-c-form-control" required>
             </ak-form-element-horizontal>
             <ak-form-group .expanded=${true}>
                 <span slot="header">
@@ -75,13 +72,13 @@ export class ConsentStageForm extends Form<ConsentStage> {
                                 this.showExpiresIn = false;
                             }
                         }}>
-                            <option value=${ConsentStageModeEnum.AlwaysRequire} ?selected=${this.stage?.mode === ConsentStageModeEnum.AlwaysRequire}>
+                            <option value=${ConsentStageModeEnum.AlwaysRequire} ?selected=${this.instance?.mode === ConsentStageModeEnum.AlwaysRequire}>
                                 ${t`Always require consent`}
                             </option>
-                            <option value=${ConsentStageModeEnum.Permanent} ?selected=${this.stage?.mode === ConsentStageModeEnum.Permanent}>
+                            <option value=${ConsentStageModeEnum.Permanent} ?selected=${this.instance?.mode === ConsentStageModeEnum.Permanent}>
                                 ${t`Consent given last indefinitely`}
                             </option>
-                            <option value=${ConsentStageModeEnum.Expiring} ?selected=${this.stage?.mode === ConsentStageModeEnum.Expiring}>
+                            <option value=${ConsentStageModeEnum.Expiring} ?selected=${this.instance?.mode === ConsentStageModeEnum.Expiring}>
                                 ${t`Consent expires.`}
                             </option>
                         </select>
@@ -91,7 +88,7 @@ export class ConsentStageForm extends Form<ConsentStage> {
                         label=${t`Consent expires in`}
                         ?required=${true}
                         name="consentExpireIn">
-                        <input type="text" value="${ifDefined(this.stage?.consentExpireIn || "weeks=4")}" class="pf-c-form-control" required>
+                        <input type="text" value="${ifDefined(this.instance?.consentExpireIn || "weeks=4")}" class="pf-c-form-control" required>
                         <p class="pf-c-form__helper-text">${t`Offset after which consent expires. (Format: hours=1;minutes=2;seconds=3).`}</p>
                     </ak-form-element-horizontal>
                 </div>
diff --git a/web/src/pages/stages/deny/DenyStageForm.ts b/web/src/pages/stages/deny/DenyStageForm.ts
index 0f585a576..9b261a25c 100644
--- a/web/src/pages/stages/deny/DenyStageForm.ts
+++ b/web/src/pages/stages/deny/DenyStageForm.ts
@@ -1,28 +1,23 @@
 import { DenyStage, StagesApi } from "authentik-api";
 import { t } from "@lingui/macro";
-import { customElement, property } from "lit-element";
+import { customElement } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../../api/Config";
-import { Form } from "../../../elements/forms/Form";
 import { ifDefined } from "lit-html/directives/if-defined";
 import "../../../elements/forms/HorizontalFormElement";
+import { ModelForm } from "../../../elements/forms/ModelForm";
 
 @customElement("ak-stage-deny-form")
-export class DenyStageForm extends Form<DenyStage> {
+export class DenyStageForm extends ModelForm<DenyStage, string> {
 
-    set stageUUID(value: string) {
-        new StagesApi(DEFAULT_CONFIG).stagesDenyRead({
-            stageUuid: value,
-        }).then(stage => {
-            this.stage = stage;
+    loadInstance(pk: string): Promise<DenyStage> {
+        return new StagesApi(DEFAULT_CONFIG).stagesDenyRead({
+            stageUuid: pk,
         });
     }
 
-    @property({attribute: false})
-    stage?: DenyStage;
-
     getSuccessMessage(): string {
-        if (this.stage) {
+        if (this.instance) {
             return t`Successfully updated stage.`;
         } else {
             return t`Successfully created stage.`;
@@ -30,9 +25,9 @@ export class DenyStageForm extends Form<DenyStage> {
     }
 
     send = (data: DenyStage): Promise<DenyStage> => {
-        if (this.stage) {
+        if (this.instance) {
             return new StagesApi(DEFAULT_CONFIG).stagesDenyUpdate({
-                stageUuid: this.stage.pk || "",
+                stageUuid: this.instance.pk || "",
                 data: data
             });
         } else {
@@ -51,7 +46,7 @@ export class DenyStageForm extends Form<DenyStage> {
                 label=${t`Name`}
                 ?required=${true}
                 name="name">
-                <input type="text" value="${ifDefined(this.stage?.name || "")}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.name || "")}" class="pf-c-form-control" required>
             </ak-form-element-horizontal>
         </form>`;
     }
diff --git a/web/src/pages/stages/dummy/DummyStageForm.ts b/web/src/pages/stages/dummy/DummyStageForm.ts
index bd0f6f22c..b753efec5 100644
--- a/web/src/pages/stages/dummy/DummyStageForm.ts
+++ b/web/src/pages/stages/dummy/DummyStageForm.ts
@@ -1,28 +1,23 @@
 import { DummyStage, StagesApi } from "authentik-api";
 import { t } from "@lingui/macro";
-import { customElement, property } from "lit-element";
+import { customElement } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../../api/Config";
-import { Form } from "../../../elements/forms/Form";
 import { ifDefined } from "lit-html/directives/if-defined";
 import "../../../elements/forms/HorizontalFormElement";
+import { ModelForm } from "../../../elements/forms/ModelForm";
 
 @customElement("ak-stage-dummy-form")
-export class DummyStageForm extends Form<DummyStage> {
+export class DummyStageForm extends ModelForm<DummyStage, string> {
 
-    set stageUUID(value: string) {
-        new StagesApi(DEFAULT_CONFIG).stagesDummyRead({
-            stageUuid: value,
-        }).then(stage => {
-            this.stage = stage;
+    loadInstance(pk: string): Promise<DummyStage> {
+        return new StagesApi(DEFAULT_CONFIG).stagesDummyRead({
+            stageUuid: pk,
         });
     }
 
-    @property({attribute: false})
-    stage?: DummyStage;
-
     getSuccessMessage(): string {
-        if (this.stage) {
+        if (this.instance) {
             return t`Successfully updated stage.`;
         } else {
             return t`Successfully created stage.`;
@@ -30,9 +25,9 @@ export class DummyStageForm extends Form<DummyStage> {
     }
 
     send = (data: DummyStage): Promise<DummyStage> => {
-        if (this.stage) {
+        if (this.instance) {
             return new StagesApi(DEFAULT_CONFIG).stagesDummyUpdate({
-                stageUuid: this.stage.pk || "",
+                stageUuid: this.instance.pk || "",
                 data: data
             });
         } else {
@@ -51,7 +46,7 @@ export class DummyStageForm extends Form<DummyStage> {
                 label=${t`Name`}
                 ?required=${true}
                 name="name">
-                <input type="text" value="${ifDefined(this.stage?.name || "")}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.name || "")}" class="pf-c-form-control" required>
             </ak-form-element-horizontal>
         </form>`;
     }
diff --git a/web/src/pages/stages/email/EmailStageForm.ts b/web/src/pages/stages/email/EmailStageForm.ts
index 176e533c3..d7d82a424 100644
--- a/web/src/pages/stages/email/EmailStageForm.ts
+++ b/web/src/pages/stages/email/EmailStageForm.ts
@@ -3,32 +3,30 @@ import { t } from "@lingui/macro";
 import { customElement, property } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../../api/Config";
-import { Form } from "../../../elements/forms/Form";
 import { ifDefined } from "lit-html/directives/if-defined";
 import "../../../elements/forms/HorizontalFormElement";
 import "../../../elements/forms/FormGroup";
 import { first } from "../../../utils";
 import { until } from "lit-html/directives/until";
+import { ModelForm } from "../../../elements/forms/ModelForm";
 
 @customElement("ak-stage-email-form")
-export class EmailStageForm extends Form<EmailStage> {
+export class EmailStageForm extends ModelForm<EmailStage, string> {
 
-    set stageUUID(value: string) {
-        new StagesApi(DEFAULT_CONFIG).stagesEmailRead({
-            stageUuid: value,
+    loadInstance(pk: string): Promise<EmailStage> {
+        return new StagesApi(DEFAULT_CONFIG).stagesEmailRead({
+            stageUuid: pk,
         }).then(stage => {
-            this.stage = stage;
+            this.showConnectionSettings = !stage.useGlobalSettings;
+            return stage;
         });
     }
 
-    @property({attribute: false})
-    stage?: EmailStage;
-
     @property({type: Boolean})
     showConnectionSettings = false;
 
     getSuccessMessage(): string {
-        if (this.stage) {
+        if (this.instance) {
             return t`Successfully updated stage.`;
         } else {
             return t`Successfully created stage.`;
@@ -36,9 +34,9 @@ export class EmailStageForm extends Form<EmailStage> {
     }
 
     send = (data: EmailStage): Promise<EmailStage> => {
-        if (this.stage) {
+        if (this.instance) {
             return new StagesApi(DEFAULT_CONFIG).stagesEmailPartialUpdate({
-                stageUuid: this.stage.pk || "",
+                stageUuid: this.instance.pk || "",
                 data: data
             });
         } else {
@@ -61,28 +59,28 @@ export class EmailStageForm extends Form<EmailStage> {
                         label=${t`SMTP Host`}
                         ?required=${true}
                         name="host">
-                        <input type="text" value="${ifDefined(this.stage?.host || "")}" class="pf-c-form-control" required>
+                        <input type="text" value="${ifDefined(this.instance?.host || "")}" class="pf-c-form-control" required>
                     </ak-form-element-horizontal>
                     <ak-form-element-horizontal
                         label=${t`SMTP Port`}
                         ?required=${true}
                         name="port">
-                        <input type="number" value="${first(this.stage?.port, 25)}" class="pf-c-form-control" required>
+                        <input type="number" value="${first(this.instance?.port, 25)}" class="pf-c-form-control" required>
                     </ak-form-element-horizontal>
                     <ak-form-element-horizontal
                         label=${t`SMTP Username`}
                         name="username">
-                        <input type="text" value="${ifDefined(this.stage?.username || "")}" class="pf-c-form-control">
+                        <input type="text" value="${ifDefined(this.instance?.username || "")}" class="pf-c-form-control">
                     </ak-form-element-horizontal>
                     <ak-form-element-horizontal
                         label=${t`SMTP Password`}
-                        ?writeOnly=${this.stage !== undefined}
+                        ?writeOnly=${this.instance !== undefined}
                         name="password">
-                        <input type="text" value="${ifDefined(this.stage?.password || "")}" class="pf-c-form-control">
+                        <input type="text" value="${ifDefined(this.instance?.password || "")}" class="pf-c-form-control">
                     </ak-form-element-horizontal>
                     <ak-form-element-horizontal name="useTls">
                         <div class="pf-c-check">
-                            <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.stage?.useTls, true)}>
+                            <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.instance?.useTls, true)}>
                             <label class="pf-c-check__label">
                                 ${t`Use TLS`}
                             </label>
@@ -90,7 +88,7 @@ export class EmailStageForm extends Form<EmailStage> {
                     </ak-form-element-horizontal>
                     <ak-form-element-horizontal name="useSsl">
                         <div class="pf-c-check">
-                            <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.stage?.useSsl, false)}>
+                            <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.instance?.useSsl, false)}>
                             <label class="pf-c-check__label">
                                 ${t`Use SSL`}
                             </label>
@@ -100,13 +98,13 @@ export class EmailStageForm extends Form<EmailStage> {
                         label=${t`Timeout`}
                         ?required=${true}
                         name="timeout">
-                        <input type="number" value="${first(this.stage?.timeout, 30)}" class="pf-c-form-control" required>
+                        <input type="number" value="${first(this.instance?.timeout, 30)}" class="pf-c-form-control" required>
                     </ak-form-element-horizontal>
                     <ak-form-element-horizontal
                         label=${t`From address`}
                         ?required=${true}
                         name="fromAddress">
-                        <input type="text" value="${ifDefined(this.stage?.fromAddress || "system@authentik.local")}" class="pf-c-form-control" required>
+                        <input type="text" value="${ifDefined(this.instance?.fromAddress || "system@authentik.local")}" class="pf-c-form-control" required>
                     </ak-form-element-horizontal>
                 </div>
             </ak-form-group>`;
@@ -121,7 +119,7 @@ export class EmailStageForm extends Form<EmailStage> {
                 label=${t`Name`}
                 ?required=${true}
                 name="name">
-                <input type="text" value="${ifDefined(this.stage?.name || "")}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.name || "")}" class="pf-c-form-control" required>
             </ak-form-element-horizontal>
             <ak-form-group .expanded=${true}>
                 <span slot="header">
@@ -130,7 +128,7 @@ export class EmailStageForm extends Form<EmailStage> {
                 <div slot="body" class="pf-c-form">
                     <ak-form-element-horizontal name="useGlobalSettings">
                         <div class="pf-c-check">
-                            <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.stage?.useGlobalSettings, true)} @change=${(ev: Event) => {
+                            <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.instance?.useGlobalSettings, true)} @change=${(ev: Event) => {
                                 const target = ev.target as HTMLInputElement;
                                 this.showConnectionSettings = !target.checked;
                             }}>
@@ -144,14 +142,14 @@ export class EmailStageForm extends Form<EmailStage> {
                         label=${t`Token expiry`}
                         ?required=${true}
                         name="tokenExpiry">
-                        <input type="number" value="${first(this.stage?.tokenExpiry, 30)}" class="pf-c-form-control" required>
+                        <input type="number" value="${first(this.instance?.tokenExpiry, 30)}" class="pf-c-form-control" required>
                         <p class="pf-c-form__helper-text">${t`Time in minutes the token sent is valid.`}</p>
                     </ak-form-element-horizontal>
                     <ak-form-element-horizontal
                         label=${t`Subject`}
                         ?required=${true}
                         name="subject">
-                        <input type="text" value="${first(this.stage?.subject, "authentik")}" class="pf-c-form-control" required>
+                        <input type="text" value="${first(this.instance?.subject, "authentik")}" class="pf-c-form-control" required>
                     </ak-form-element-horizontal>
                     <ak-form-element-horizontal
                         label=${t`Template`}
@@ -160,7 +158,7 @@ export class EmailStageForm extends Form<EmailStage> {
                         <select name="users" class="pf-c-form-control">
                             ${until(new StagesApi(DEFAULT_CONFIG).stagesEmailTemplates().then(templates => {
                                 return templates.map(template => {
-                                    const selected = this.stage?.template === template.name;
+                                    const selected = this.instance?.template === template.name;
                                     return html`<option value=${ifDefined(template.name)} ?selected=${selected}>
                                         ${template.description}
                                     </option>`;
diff --git a/web/src/pages/stages/identification/IdentificationStageForm.ts b/web/src/pages/stages/identification/IdentificationStageForm.ts
index 993a05ab5..5ced5259c 100644
--- a/web/src/pages/stages/identification/IdentificationStageForm.ts
+++ b/web/src/pages/stages/identification/IdentificationStageForm.ts
@@ -1,31 +1,26 @@
 import { FlowDesignationEnum, FlowsApi, IdentificationStage, IdentificationStageUserFieldsEnum, StagesApi } from "authentik-api";
 import { t } from "@lingui/macro";
-import { customElement, property } from "lit-element";
+import { customElement } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../../api/Config";
-import { Form } from "../../../elements/forms/Form";
 import { ifDefined } from "lit-html/directives/if-defined";
 import "../../../elements/forms/HorizontalFormElement";
 import "../../../elements/forms/FormGroup";
 import { until } from "lit-html/directives/until";
 import { first } from "../../../utils";
+import { ModelForm } from "../../../elements/forms/ModelForm";
 
 @customElement("ak-stage-identification-form")
-export class IdentificationStageForm extends Form<IdentificationStage> {
+export class IdentificationStageForm extends ModelForm<IdentificationStage, string> {
 
-    set stageUUID(value: string) {
-        new StagesApi(DEFAULT_CONFIG).stagesIdentificationRead({
-            stageUuid: value,
-        }).then(stage => {
-            this.stage = stage;
+    loadInstance(pk: string): Promise<IdentificationStage> {
+        return new StagesApi(DEFAULT_CONFIG).stagesIdentificationRead({
+            stageUuid: pk,
         });
     }
 
-    @property({attribute: false})
-    stage?: IdentificationStage;
-
     getSuccessMessage(): string {
-        if (this.stage) {
+        if (this.instance) {
             return t`Successfully updated stage.`;
         } else {
             return t`Successfully created stage.`;
@@ -33,9 +28,9 @@ export class IdentificationStageForm extends Form<IdentificationStage> {
     }
 
     send = (data: IdentificationStage): Promise<IdentificationStage> => {
-        if (this.stage) {
+        if (this.instance) {
             return new StagesApi(DEFAULT_CONFIG).stagesIdentificationUpdate({
-                stageUuid: this.stage.pk || "",
+                stageUuid: this.instance.pk || "",
                 data: data
             });
         } else {
@@ -46,7 +41,7 @@ export class IdentificationStageForm extends Form<IdentificationStage> {
     };
 
     isUserFieldSelected(field: IdentificationStageUserFieldsEnum): boolean {
-        return (this.stage?.userFields || []).filter(isField => {
+        return (this.instance?.userFields || []).filter(isField => {
             return field === isField;
         }).length > 0;
     }
@@ -60,7 +55,7 @@ export class IdentificationStageForm extends Form<IdentificationStage> {
                 label=${t`Name`}
                 ?required=${true}
                 name="name">
-                <input type="text" value="${ifDefined(this.stage?.name || "")}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.name || "")}" class="pf-c-form-control" required>
             </ak-form-element-horizontal>
             <ak-form-group .expanded=${true}>
                 <span slot="header">
@@ -83,7 +78,7 @@ export class IdentificationStageForm extends Form<IdentificationStage> {
                     </ak-form-element-horizontal>
                     <ak-form-element-horizontal name="caseInsensitiveMatching">
                         <div class="pf-c-check">
-                            <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.stage?.caseInsensitiveMatching, true)}>
+                            <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.instance?.caseInsensitiveMatching, true)}>
                             <label class="pf-c-check__label">
                                 ${t`Case insensitive matching`}
                             </label>
@@ -92,7 +87,7 @@ export class IdentificationStageForm extends Form<IdentificationStage> {
                     </ak-form-element-horizontal>
                     <ak-form-element-horizontal name="showMatchedUser">
                         <div class="pf-c-check">
-                            <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.stage?.showMatchedUser, true)}>
+                            <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.instance?.showMatchedUser, true)}>
                             <label class="pf-c-check__label">
                                 ${t`Show matched user`}
                             </label>
@@ -103,13 +98,13 @@ export class IdentificationStageForm extends Form<IdentificationStage> {
                         label=${t`Enrollment flow`}
                         name="enrollmentFlow">
                         <select class="pf-c-form-control">
-                            <option value="" ?selected=${this.stage?.enrollmentFlow === undefined}>---------</option>
+                            <option value="" ?selected=${this.instance?.enrollmentFlow === undefined}>---------</option>
                             ${until(new FlowsApi(DEFAULT_CONFIG).flowsInstancesList({
                                 ordering: "pk",
                                 designation: FlowDesignationEnum.Enrollment,
                             }).then(flows => {
                                 return flows.results.map(flow => {
-                                    const selected = this.stage?.enrollmentFlow === flow.pk;
+                                    const selected = this.instance?.enrollmentFlow === flow.pk;
                                     return html`<option value=${ifDefined(flow.pk)} ?selected=${selected}>${flow.name} (${flow.slug})</option>`;
                                 });
                             }), html`<option>${t`Loading...`}</option>`)}
@@ -120,13 +115,13 @@ export class IdentificationStageForm extends Form<IdentificationStage> {
                         label=${t`Recovery flow`}
                         name="recoveryFlow">
                         <select class="pf-c-form-control">
-                            <option value="" ?selected=${this.stage?.recoveryFlow === undefined}>---------</option>
+                            <option value="" ?selected=${this.instance?.recoveryFlow === undefined}>---------</option>
                             ${until(new FlowsApi(DEFAULT_CONFIG).flowsInstancesList({
                                 ordering: "pk",
                                 designation: FlowDesignationEnum.Recovery,
                             }).then(flows => {
                                 return flows.results.map(flow => {
-                                    const selected = this.stage?.recoveryFlow === flow.pk;
+                                    const selected = this.instance?.recoveryFlow === flow.pk;
                                     return html`<option value=${ifDefined(flow.pk)} ?selected=${selected}>${flow.name} (${flow.slug})</option>`;
                                 });
                             }), html`<option>${t`Loading...`}</option>`)}
diff --git a/web/src/pages/stages/invitation/InvitationStageForm.ts b/web/src/pages/stages/invitation/InvitationStageForm.ts
index b9917ac78..659758134 100644
--- a/web/src/pages/stages/invitation/InvitationStageForm.ts
+++ b/web/src/pages/stages/invitation/InvitationStageForm.ts
@@ -1,30 +1,25 @@
 import { InvitationStage, StagesApi } from "authentik-api";
 import { t } from "@lingui/macro";
-import { customElement, property } from "lit-element";
+import { customElement } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../../api/Config";
-import { Form } from "../../../elements/forms/Form";
 import { ifDefined } from "lit-html/directives/if-defined";
 import "../../../elements/forms/HorizontalFormElement";
 import "../../../elements/forms/FormGroup";
 import { first } from "../../../utils";
+import { ModelForm } from "../../../elements/forms/ModelForm";
 
 @customElement("ak-stage-invitation-form")
-export class InvitationStageForm extends Form<InvitationStage> {
+export class InvitationStageForm extends ModelForm<InvitationStage, string> {
 
-    set stageUUID(value: string) {
-        new StagesApi(DEFAULT_CONFIG).stagesInvitationStagesRead({
-            stageUuid: value,
-        }).then(stage => {
-            this.stage = stage;
+    loadInstance(pk: string): Promise<InvitationStage> {
+        return new StagesApi(DEFAULT_CONFIG).stagesInvitationStagesRead({
+            stageUuid: pk,
         });
     }
 
-    @property({attribute: false})
-    stage?: InvitationStage;
-
     getSuccessMessage(): string {
-        if (this.stage) {
+        if (this.instance) {
             return t`Successfully updated stage.`;
         } else {
             return t`Successfully created stage.`;
@@ -32,9 +27,9 @@ export class InvitationStageForm extends Form<InvitationStage> {
     }
 
     send = (data: InvitationStage): Promise<InvitationStage> => {
-        if (this.stage) {
+        if (this.instance) {
             return new StagesApi(DEFAULT_CONFIG).stagesInvitationStagesUpdate({
-                stageUuid: this.stage.pk || "",
+                stageUuid: this.instance.pk || "",
                 data: data
             });
         } else {
@@ -53,7 +48,7 @@ export class InvitationStageForm extends Form<InvitationStage> {
                 label=${t`Name`}
                 ?required=${true}
                 name="name">
-                <input type="text" value="${ifDefined(this.stage?.name || "")}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.name || "")}" class="pf-c-form-control" required>
             </ak-form-element-horizontal>
             <ak-form-group .expanded=${true}>
                 <span slot="header">
@@ -62,7 +57,7 @@ export class InvitationStageForm extends Form<InvitationStage> {
                 <div slot="body" class="pf-c-form">
                     <ak-form-element-horizontal name="continueFlowWithoutInvitation">
                         <div class="pf-c-check">
-                            <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.stage?.continueFlowWithoutInvitation, true)}>
+                            <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.instance?.continueFlowWithoutInvitation, true)}>
                             <label class="pf-c-check__label">
                                 ${t`Continue flow without invitation`}
                             </label>
diff --git a/web/src/pages/stages/password/PasswordStageForm.ts b/web/src/pages/stages/password/PasswordStageForm.ts
index 149effb44..4b8981eba 100644
--- a/web/src/pages/stages/password/PasswordStageForm.ts
+++ b/web/src/pages/stages/password/PasswordStageForm.ts
@@ -1,31 +1,26 @@
 import { FlowDesignationEnum, FlowsApi, PasswordStage, PasswordStageBackendsEnum, StagesApi } from "authentik-api";
 import { t } from "@lingui/macro";
-import { customElement, property } from "lit-element";
+import { customElement } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../../api/Config";
-import { Form } from "../../../elements/forms/Form";
 import { ifDefined } from "lit-html/directives/if-defined";
 import "../../../elements/forms/HorizontalFormElement";
 import "../../../elements/forms/FormGroup";
 import { until } from "lit-html/directives/until";
 import { first } from "../../../utils";
+import { ModelForm } from "../../../elements/forms/ModelForm";
 
 @customElement("ak-stage-password-form")
-export class PasswordStageForm extends Form<PasswordStage> {
+export class PasswordStageForm extends ModelForm<PasswordStage, string> {
 
-    set stageUUID(value: string) {
-        new StagesApi(DEFAULT_CONFIG).stagesPasswordRead({
-            stageUuid: value,
-        }).then(stage => {
-            this.stage = stage;
+    loadInstance(pk: string): Promise<PasswordStage> {
+        return new StagesApi(DEFAULT_CONFIG).stagesPasswordRead({
+            stageUuid: pk,
         });
     }
 
-    @property({attribute: false})
-    stage?: PasswordStage;
-
     getSuccessMessage(): string {
-        if (this.stage) {
+        if (this.instance) {
             return t`Successfully updated stage.`;
         } else {
             return t`Successfully created stage.`;
@@ -33,9 +28,9 @@ export class PasswordStageForm extends Form<PasswordStage> {
     }
 
     send = (data: PasswordStage): Promise<PasswordStage> => {
-        if (this.stage) {
+        if (this.instance) {
             return new StagesApi(DEFAULT_CONFIG).stagesPasswordUpdate({
-                stageUuid: this.stage.pk || "",
+                stageUuid: this.instance.pk || "",
                 data: data
             });
         } else {
@@ -46,7 +41,7 @@ export class PasswordStageForm extends Form<PasswordStage> {
     };
 
     isBackendSelected(field: PasswordStageBackendsEnum): boolean {
-        return (this.stage?.backends || []).filter(isField => {
+        return (this.instance?.backends || []).filter(isField => {
             return field === isField;
         }).length > 0;
     }
@@ -60,7 +55,7 @@ export class PasswordStageForm extends Form<PasswordStage> {
                 label=${t`Name`}
                 ?required=${true}
                 name="name">
-                <input type="text" value="${ifDefined(this.stage?.name || "")}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.name || "")}" class="pf-c-form-control" required>
             </ak-form-element-horizontal>
             <ak-form-group .expanded=${true}>
                 <span slot="header">
@@ -87,14 +82,14 @@ export class PasswordStageForm extends Form<PasswordStage> {
                         ?required=${true}
                         name="configureFlow">
                         <select class="pf-c-form-control">
-                            <option value="" ?selected=${this.stage?.configureFlow === undefined}>---------</option>
+                            <option value="" ?selected=${this.instance?.configureFlow === undefined}>---------</option>
                             ${until(new FlowsApi(DEFAULT_CONFIG).flowsInstancesList({
                                 ordering: "pk",
                                 designation: FlowDesignationEnum.StageConfiguration,
                             }).then(flows => {
                                 return flows.results.map(flow => {
-                                    let selected = this.stage?.configureFlow === flow.pk;
-                                    if (!this.stage?.pk && !this.stage?.configureFlow && flow.slug === "default-password-change") {
+                                    let selected = this.instance?.configureFlow === flow.pk;
+                                    if (!this.instance?.pk && !this.instance?.configureFlow && flow.slug === "default-password-change") {
                                         selected = true;
                                     }
                                     return html`<option value=${ifDefined(flow.pk)} ?selected=${selected}>${flow.name} (${flow.slug})</option>`;
@@ -107,7 +102,7 @@ export class PasswordStageForm extends Form<PasswordStage> {
                         label=${t`Failed attempts before cancel`}
                         ?required=${true}
                         name="failedAttemptsBeforeCancel">
-                        <input type="number" value="${first(this.stage?.failedAttemptsBeforeCancel, 5)}" class="pf-c-form-control" required>
+                        <input type="number" value="${first(this.instance?.failedAttemptsBeforeCancel, 5)}" class="pf-c-form-control" required>
                         <p class="pf-c-form__helper-text">${t`How many attempts a user has before the flow is canceled. To lock the user out, use a reputation policy and a user_write stage.`}</p>
                     </ak-form-element-horizontal>
                 </div>
diff --git a/web/src/pages/stages/prompt/PromptStageForm.ts b/web/src/pages/stages/prompt/PromptStageForm.ts
index c18963165..89711f639 100644
--- a/web/src/pages/stages/prompt/PromptStageForm.ts
+++ b/web/src/pages/stages/prompt/PromptStageForm.ts
@@ -1,32 +1,27 @@
 import { PoliciesApi, PromptStage, StagesApi } from "authentik-api";
 import { t } from "@lingui/macro";
-import { customElement, property } from "lit-element";
+import { customElement } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../../api/Config";
-import { Form } from "../../../elements/forms/Form";
 import { ifDefined } from "lit-html/directives/if-defined";
 import "../../../elements/forms/HorizontalFormElement";
 import "../../../elements/forms/FormGroup";
 import "../../../elements/forms/ModalForm";
 import "./PromptForm";
 import { until } from "lit-html/directives/until";
+import { ModelForm } from "../../../elements/forms/ModelForm";
 
 @customElement("ak-stage-prompt-form")
-export class PromptStageForm extends Form<PromptStage> {
+export class PromptStageForm extends ModelForm<PromptStage, string> {
 
-    set stageUUID(value: string) {
-        new StagesApi(DEFAULT_CONFIG).stagesPromptStagesRead({
-            stageUuid: value,
-        }).then(stage => {
-            this.stage = stage;
+    loadInstance(pk: string): Promise<PromptStage> {
+        return new StagesApi(DEFAULT_CONFIG).stagesPromptStagesRead({
+            stageUuid: pk,
         });
     }
 
-    @property({attribute: false})
-    stage?: PromptStage;
-
     getSuccessMessage(): string {
-        if (this.stage) {
+        if (this.instance) {
             return t`Successfully updated stage.`;
         } else {
             return t`Successfully created stage.`;
@@ -34,9 +29,9 @@ export class PromptStageForm extends Form<PromptStage> {
     }
 
     send = (data: PromptStage): Promise<PromptStage> => {
-        if (this.stage) {
+        if (this.instance) {
             return new StagesApi(DEFAULT_CONFIG).stagesPromptStagesUpdate({
-                stageUuid: this.stage.pk || "",
+                stageUuid: this.instance.pk || "",
                 data: data
             });
         } else {
@@ -55,7 +50,7 @@ export class PromptStageForm extends Form<PromptStage> {
                 label=${t`Name`}
                 ?required=${true}
                 name="name">
-                <input type="text" value="${ifDefined(this.stage?.name || "")}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.name || "")}" class="pf-c-form-control" required>
             </ak-form-element-horizontal>
             <ak-form-group .expanded=${true}>
                 <span slot="header">
@@ -71,7 +66,7 @@ export class PromptStageForm extends Form<PromptStage> {
                                 ordering: "field_name"
                             }).then(prompts => {
                                 return prompts.results.map(prompt => {
-                                    const selected = Array.from(this.stage?.fields || []).some(su => {
+                                    const selected = Array.from(this.instance?.fields || []).some(su => {
                                         return su == prompt.pk;
                                     });
                                     return html`<option value=${ifDefined(prompt.pk)} ?selected=${selected}>
@@ -103,7 +98,7 @@ export class PromptStageForm extends Form<PromptStage> {
                                 ordering: "name"
                             }).then(policies => {
                                 return policies.results.map(policy => {
-                                    const selected = Array.from(this.stage?.validationPolicies || []).some(su => {
+                                    const selected = Array.from(this.instance?.validationPolicies || []).some(su => {
                                         return su == policy.pk;
                                     });
                                     return html`<option value=${ifDefined(policy.pk)} ?selected=${selected}>
diff --git a/web/src/pages/stages/user_delete/UserDeleteStageForm.ts b/web/src/pages/stages/user_delete/UserDeleteStageForm.ts
index 15aaa2f27..2e03e7aca 100644
--- a/web/src/pages/stages/user_delete/UserDeleteStageForm.ts
+++ b/web/src/pages/stages/user_delete/UserDeleteStageForm.ts
@@ -1,28 +1,23 @@
 import { UserDeleteStage, StagesApi } from "authentik-api";
 import { t } from "@lingui/macro";
-import { customElement, property } from "lit-element";
+import { customElement } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../../api/Config";
-import { Form } from "../../../elements/forms/Form";
 import { ifDefined } from "lit-html/directives/if-defined";
 import "../../../elements/forms/HorizontalFormElement";
+import { ModelForm } from "../../../elements/forms/ModelForm";
 
 @customElement("ak-stage-user-delete-form")
-export class UserDeleteStageForm extends Form<UserDeleteStage> {
+export class UserDeleteStageForm extends ModelForm<UserDeleteStage, string> {
 
-    set stageUUID(value: string) {
-        new StagesApi(DEFAULT_CONFIG).stagesUserDeleteRead({
-            stageUuid: value,
-        }).then(stage => {
-            this.stage = stage;
+    loadInstance(pk: string): Promise<UserDeleteStage> {
+        return new StagesApi(DEFAULT_CONFIG).stagesUserDeleteRead({
+            stageUuid: pk,
         });
     }
 
-    @property({attribute: false})
-    stage?: UserDeleteStage;
-
     getSuccessMessage(): string {
-        if (this.stage) {
+        if (this.instance) {
             return t`Successfully updated stage.`;
         } else {
             return t`Successfully created stage.`;
@@ -30,9 +25,9 @@ export class UserDeleteStageForm extends Form<UserDeleteStage> {
     }
 
     send = (data: UserDeleteStage): Promise<UserDeleteStage> => {
-        if (this.stage) {
+        if (this.instance) {
             return new StagesApi(DEFAULT_CONFIG).stagesUserDeleteUpdate({
-                stageUuid: this.stage.pk || "",
+                stageUuid: this.instance.pk || "",
                 data: data
             });
         } else {
@@ -52,7 +47,7 @@ export class UserDeleteStageForm extends Form<UserDeleteStage> {
                 label=${t`Name`}
                 ?required=${true}
                 name="name">
-                <input type="text" value="${ifDefined(this.stage?.name || "")}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.name || "")}" class="pf-c-form-control" required>
             </ak-form-element-horizontal>
         </form>`;
     }
diff --git a/web/src/pages/stages/user_login/UserLoginStageForm.ts b/web/src/pages/stages/user_login/UserLoginStageForm.ts
index 4d59c18a2..aacf23666 100644
--- a/web/src/pages/stages/user_login/UserLoginStageForm.ts
+++ b/web/src/pages/stages/user_login/UserLoginStageForm.ts
@@ -1,29 +1,24 @@
 import { UserLoginStage, StagesApi } from "authentik-api";
 import { t } from "@lingui/macro";
-import { customElement, property } from "lit-element";
+import { customElement } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../../api/Config";
-import { Form } from "../../../elements/forms/Form";
 import "../../../elements/forms/HorizontalFormElement";
 import "../../../elements/forms/FormGroup";
 import { first } from "../../../utils";
+import { ModelForm } from "../../../elements/forms/ModelForm";
 
 @customElement("ak-stage-user-login-form")
-export class UserLoginStageForm extends Form<UserLoginStage> {
+export class UserLoginStageForm extends ModelForm<UserLoginStage, string> {
 
-    set stageUUID(value: string) {
-        new StagesApi(DEFAULT_CONFIG).stagesUserLoginRead({
-            stageUuid: value,
-        }).then(stage => {
-            this.stage = stage;
+    loadInstance(pk: string): Promise<UserLoginStage> {
+        return new StagesApi(DEFAULT_CONFIG).stagesUserLoginRead({
+            stageUuid: pk,
         });
     }
 
-    @property({attribute: false})
-    stage?: UserLoginStage;
-
     getSuccessMessage(): string {
-        if (this.stage) {
+        if (this.instance) {
             return t`Successfully updated stage.`;
         } else {
             return t`Successfully created stage.`;
@@ -31,9 +26,9 @@ export class UserLoginStageForm extends Form<UserLoginStage> {
     }
 
     send = (data: UserLoginStage): Promise<UserLoginStage> => {
-        if (this.stage) {
+        if (this.instance) {
             return new StagesApi(DEFAULT_CONFIG).stagesUserLoginUpdate({
-                stageUuid: this.stage.pk || "",
+                stageUuid: this.instance.pk || "",
                 data: data
             });
         } else {
@@ -52,7 +47,7 @@ export class UserLoginStageForm extends Form<UserLoginStage> {
                 label=${t`Name`}
                 ?required=${true}
                 name="name">
-                <input type="text" value="${first(this.stage?.name, "")}" class="pf-c-form-control" required>
+                <input type="text" value="${first(this.instance?.name, "")}" class="pf-c-form-control" required>
             </ak-form-element-horizontal>
             <ak-form-group .expanded=${true}>
                 <span slot="header">
@@ -63,7 +58,7 @@ export class UserLoginStageForm extends Form<UserLoginStage> {
                         label=${t`Session duration`}
                         ?required=${true}
                         name="sessionDuration">
-                        <input type="text" value="${first(this.stage?.sessionDuration, "seconds=0")}" class="pf-c-form-control" required>
+                        <input type="text" value="${first(this.instance?.sessionDuration, "seconds=0")}" class="pf-c-form-control" required>
                         <p class="pf-c-form__helper-text">${t`Determines how long a session lasts. Default of 0 seconds means that the sessions lasts until the browser is closed.`}</p>
                         <p class="pf-c-form__helper-text">${t`(Format: hours=-1;minutes=-2;seconds=-3).`}</p>
                     </ak-form-element-horizontal>
diff --git a/web/src/pages/stages/user_logout/UserLogoutStageForm.ts b/web/src/pages/stages/user_logout/UserLogoutStageForm.ts
index 9e5579191..2bf3da413 100644
--- a/web/src/pages/stages/user_logout/UserLogoutStageForm.ts
+++ b/web/src/pages/stages/user_logout/UserLogoutStageForm.ts
@@ -1,28 +1,23 @@
 import { UserLogoutStage, StagesApi } from "authentik-api";
 import { t } from "@lingui/macro";
-import { customElement, property } from "lit-element";
+import { customElement } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../../api/Config";
-import { Form } from "../../../elements/forms/Form";
 import { ifDefined } from "lit-html/directives/if-defined";
 import "../../../elements/forms/HorizontalFormElement";
+import { ModelForm } from "../../../elements/forms/ModelForm";
 
 @customElement("ak-stage-user-logout-form")
-export class UserLogoutStageForm extends Form<UserLogoutStage> {
+export class UserLogoutStageForm extends ModelForm<UserLogoutStage, string> {
 
-    set stageUUID(value: string) {
-        new StagesApi(DEFAULT_CONFIG).stagesUserLogoutRead({
-            stageUuid: value,
-        }).then(stage => {
-            this.stage = stage;
+    loadInstance(pk: string): Promise<UserLogoutStage> {
+        return new StagesApi(DEFAULT_CONFIG).stagesUserLogoutRead({
+            stageUuid: pk,
         });
     }
 
-    @property({attribute: false})
-    stage?: UserLogoutStage;
-
     getSuccessMessage(): string {
-        if (this.stage) {
+        if (this.instance) {
             return t`Successfully updated stage.`;
         } else {
             return t`Successfully created stage.`;
@@ -30,9 +25,9 @@ export class UserLogoutStageForm extends Form<UserLogoutStage> {
     }
 
     send = (data: UserLogoutStage): Promise<UserLogoutStage> => {
-        if (this.stage) {
+        if (this.instance) {
             return new StagesApi(DEFAULT_CONFIG).stagesUserLogoutUpdate({
-                stageUuid: this.stage.pk || "",
+                stageUuid: this.instance.pk || "",
                 data: data
             });
         } else {
@@ -51,7 +46,7 @@ export class UserLogoutStageForm extends Form<UserLogoutStage> {
                 label=${t`Name`}
                 ?required=${true}
                 name="name">
-                <input type="text" value="${ifDefined(this.stage?.name || "")}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.name || "")}" class="pf-c-form-control" required>
             </ak-form-element-horizontal>
         </form>`;
     }
diff --git a/web/src/pages/stages/user_write/UserWriteStageForm.ts b/web/src/pages/stages/user_write/UserWriteStageForm.ts
index 7aee974ec..cb8c7b31d 100644
--- a/web/src/pages/stages/user_write/UserWriteStageForm.ts
+++ b/web/src/pages/stages/user_write/UserWriteStageForm.ts
@@ -1,28 +1,23 @@
 import { UserWriteStage, StagesApi } from "authentik-api";
 import { t } from "@lingui/macro";
-import { customElement, property } from "lit-element";
+import { customElement } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../../api/Config";
-import { Form } from "../../../elements/forms/Form";
 import { ifDefined } from "lit-html/directives/if-defined";
 import "../../../elements/forms/HorizontalFormElement";
+import { ModelForm } from "../../../elements/forms/ModelForm";
 
 @customElement("ak-stage-user-write-form")
-export class UserWriteStageForm extends Form<UserWriteStage> {
+export class UserWriteStageForm extends ModelForm<UserWriteStage, string> {
 
-    set stageUUID(value: string) {
-        new StagesApi(DEFAULT_CONFIG).stagesUserWriteRead({
-            stageUuid: value,
-        }).then(stage => {
-            this.stage = stage;
+    loadInstance(pk: string): Promise<UserWriteStage> {
+        return new StagesApi(DEFAULT_CONFIG).stagesUserWriteRead({
+            stageUuid: pk,
         });
     }
 
-    @property({attribute: false})
-    stage?: UserWriteStage;
-
     getSuccessMessage(): string {
-        if (this.stage) {
+        if (this.instance) {
             return t`Successfully updated stage.`;
         } else {
             return t`Successfully created stage.`;
@@ -30,9 +25,9 @@ export class UserWriteStageForm extends Form<UserWriteStage> {
     }
 
     send = (data: UserWriteStage): Promise<UserWriteStage> => {
-        if (this.stage) {
+        if (this.instance) {
             return new StagesApi(DEFAULT_CONFIG).stagesUserWriteUpdate({
-                stageUuid: this.stage.pk || "",
+                stageUuid: this.instance.pk || "",
                 data: data
             });
         } else {
@@ -52,7 +47,7 @@ export class UserWriteStageForm extends Form<UserWriteStage> {
                 label=${t`Name`}
                 ?required=${true}
                 name="name">
-                <input type="text" value="${ifDefined(this.stage?.name || "")}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.name || "")}" class="pf-c-form-control" required>
             </ak-form-element-horizontal>
         </form>`;
     }

From 6f8d129dea1a0b221978d5b0b35c816f71927fb8 Mon Sep 17 00:00:00 2001
From: Jens Langhammer <jens.langhammer@beryju.org>
Date: Tue, 11 May 2021 12:44:50 +0200
Subject: [PATCH 08/10] web/admin: migrate remaining forms

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
---
 web/src/locales/en.po                         | 514 +++++++++---------
 web/src/locales/pseudo-LOCALE.po              | 514 +++++++++---------
 web/src/pages/policies/BoundPoliciesList.ts   |   2 +-
 .../pages/stages/invitation/InvitationForm.ts |  23 +-
 web/src/pages/stages/prompt/PromptForm.ts     |  51 +-
 web/src/pages/stages/prompt/PromptListPage.ts |   2 +-
 .../user-settings/tokens/UserTokenForm.ts     |  23 +-
 .../user-settings/tokens/UserTokenList.ts     |   2 +-
 web/src/pages/users/UserForm.ts               |  29 +-
 web/src/pages/users/UserListPage.ts           |   2 +-
 web/src/pages/users/UserViewPage.ts           |   2 +-
 11 files changed, 588 insertions(+), 576 deletions(-)

diff --git a/web/src/locales/en.po b/web/src/locales/en.po
index 148947ed9..b6b9bc704 100644
--- a/web/src/locales/en.po
+++ b/web/src/locales/en.po
@@ -16,7 +16,7 @@ msgstr ""
 #: src/pages/providers/oauth2/OAuth2ProviderForm.ts:141
 #: src/pages/providers/oauth2/OAuth2ProviderForm.ts:149
 #: src/pages/providers/saml/SAMLProviderForm.ts:201
-#: src/pages/stages/user_login/UserLoginStageForm.ts:71
+#: src/pages/stages/user_login/UserLoginStageForm.ts:69
 msgid "(Format: hours=-1;minutes=-2;seconds=-3)."
 msgstr "(Format: hours=-1;minutes=-2;seconds=-3)."
 
@@ -24,11 +24,11 @@ msgstr "(Format: hours=-1;minutes=-2;seconds=-3)."
 msgid "-"
 msgstr "-"
 
-#: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts:72
+#: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts:70
 msgid "6 digits, widely compatible"
 msgstr "6 digits, widely compatible"
 
-#: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts:75
+#: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts:73
 msgid "8 digits, not compatible with apps like Google Authenticator"
 msgstr "8 digits, not compatible with apps like Google Authenticator"
 
@@ -86,7 +86,7 @@ msgstr "Access token URL"
 #: src/elements/events/ObjectChangelog.ts:38
 #: src/elements/events/UserEvents.ts:35
 #: src/pages/events/EventListPage.ts:43
-#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:79
+#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:77
 msgid "Action"
 msgstr "Action"
 
@@ -123,7 +123,7 @@ msgstr "Additional user DN, prepended to the Base DN."
 msgid "Advanced protocol settings"
 msgstr "Advanced protocol settings"
 
-#: src/pages/policies/password/PasswordPolicyForm.ts:119
+#: src/pages/policies/password/PasswordPolicyForm.ts:117
 #: src/pages/sources/ldap/LDAPSourceForm.ts:138
 msgid "Advanced settings"
 msgstr "Advanced settings"
@@ -148,7 +148,7 @@ msgstr "Allow IDP-initiated logins"
 msgid "Allow friends to authenticate via Plex, even if you don't share any servers"
 msgstr "Allow friends to authenticate via Plex, even if you don't share any servers"
 
-#: src/pages/policies/hibp/HaveIBeenPwnedPolicyForm.ts:90
+#: src/pages/policies/hibp/HaveIBeenPwnedPolicyForm.ts:88
 msgid "Allow up to N occurrences in the HIBP database."
 msgstr "Allow up to N occurrences in the HIBP database."
 
@@ -156,7 +156,7 @@ msgstr "Allow up to N occurrences in the HIBP database."
 msgid "Allow users to use Applications based on properties, enforce Password Criteria and selectively apply Stages."
 msgstr "Allow users to use Applications based on properties, enforce Password Criteria and selectively apply Stages."
 
-#: src/pages/policies/hibp/HaveIBeenPwnedPolicyForm.ts:86
+#: src/pages/policies/hibp/HaveIBeenPwnedPolicyForm.ts:84
 msgid "Allowed count"
 msgstr "Allowed count"
 
@@ -168,7 +168,7 @@ msgstr "Allowed servers"
 msgid "Allows authentication flows initiated by the IdP. This can be a security risk, as no validation of the request ID is done."
 msgstr "Allows authentication flows initiated by the IdP. This can be a security risk, as no validation of the request ID is done."
 
-#: src/pages/policies/reputation/ReputationPolicyForm.ts:53
+#: src/pages/policies/reputation/ReputationPolicyForm.ts:51
 msgid "Allows/denys requests based on the users and/or the IPs reputation."
 msgstr "Allows/denys requests based on the users and/or the IPs reputation."
 
@@ -181,7 +181,7 @@ msgid "Always require consent"
 msgstr "Always require consent"
 
 #: src/pages/events/EventInfo.ts:59
-#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:99
+#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:97
 msgid "App"
 msgstr "App"
 
@@ -259,8 +259,8 @@ msgid "Attribute name used for SAML Assertions. Can be a URN OID, a schema refer
 msgstr "Attribute name used for SAML Assertions. Can be a URN OID, a schema reference, or a any other string. If this property mapping is used for NameID Property, this field is discarded."
 
 #: src/pages/groups/GroupForm.ts:139
-#: src/pages/stages/invitation/InvitationForm.ts:52
-#: src/pages/users/UserForm.ts:77
+#: src/pages/stages/invitation/InvitationForm.ts:57
+#: src/pages/users/UserForm.ts:82
 msgid "Attributes"
 msgstr "Attributes"
 
@@ -316,7 +316,7 @@ msgstr "Authorize URL"
 msgid "Authorized application:"
 msgstr "Authorized application:"
 
-#: src/pages/stages/password/PasswordStageForm.ts:74
+#: src/pages/stages/password/PasswordStageForm.ts:72
 msgid "Backends"
 msgstr "Backends"
 
@@ -431,7 +431,7 @@ msgstr "Can be in the format of 'unix://' when connecting to a local docker daem
 msgid "Cancel"
 msgstr "Cancel"
 
-#: src/pages/stages/identification/IdentificationStageForm.ts:91
+#: src/pages/stages/identification/IdentificationStageForm.ts:89
 msgid "Case insensitive matching"
 msgstr "Case insensitive matching"
 
@@ -490,15 +490,15 @@ msgstr "Change your password"
 msgid "Changelog"
 msgstr "Changelog"
 
-#: src/pages/policies/password/PasswordPolicyForm.ts:127
+#: src/pages/policies/password/PasswordPolicyForm.ts:125
 msgid "Characters which are considered as symbols."
 msgstr "Characters which are considered as symbols."
 
-#: src/pages/policies/reputation/ReputationPolicyForm.ts:81
+#: src/pages/policies/reputation/ReputationPolicyForm.ts:79
 msgid "Check IP"
 msgstr "Check IP"
 
-#: src/pages/policies/reputation/ReputationPolicyForm.ts:89
+#: src/pages/policies/reputation/ReputationPolicyForm.ts:87
 msgid "Check Username"
 msgstr "Check Username"
 
@@ -506,11 +506,11 @@ msgstr "Check Username"
 msgid "Check your Emails for a password reset link."
 msgstr "Check your Emails for a password reset link."
 
-#: src/pages/stages/prompt/PromptForm.ts:60
+#: src/pages/stages/prompt/PromptForm.ts:65
 msgid "Checkbox"
 msgstr "Checkbox"
 
-#: src/pages/policies/hibp/HaveIBeenPwnedPolicyForm.ts:53
+#: src/pages/policies/hibp/HaveIBeenPwnedPolicyForm.ts:51
 msgid ""
 "Checks a value from the policy request against the Have I been Pwned API, and denys the request based upon that.\n"
 "Note that only a part of the hash of the password is sent, the full comparison is done clientside."
@@ -518,11 +518,11 @@ msgstr ""
 "Checks a value from the policy request against the Have I been Pwned API, and denys the request based upon that.\n"
 "Note that only a part of the hash of the password is sent, the full comparison is done clientside."
 
-#: src/pages/policies/expiry/ExpiryPolicyForm.ts:53
+#: src/pages/policies/expiry/ExpiryPolicyForm.ts:51
 msgid "Checks if the request's user's password has been changed in the last x days, and denys based on settings."
 msgstr "Checks if the request's user's password has been changed in the last x days, and denys based on settings."
 
-#: src/pages/policies/password/PasswordPolicyForm.ts:53
+#: src/pages/policies/password/PasswordPolicyForm.ts:51
 msgid "Checks the value from the policy request against several rules, mostly used to ensure password strength."
 msgstr "Checks the value from the policy request against several rules, mostly used to ensure password strength."
 
@@ -543,7 +543,7 @@ msgstr "Client ID"
 #: src/elements/events/ObjectChangelog.ts:41
 #: src/elements/events/UserEvents.ts:38
 #: src/pages/events/EventListPage.ts:46
-#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:93
+#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:91
 msgid "Client IP"
 msgstr "Client IP"
 
@@ -581,10 +581,10 @@ msgstr "Confidential clients are capable of maintaining the confidentiality of t
 msgid "Configuration"
 msgstr "Configuration"
 
-#: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts:74
-#: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts:80
+#: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts:72
+#: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts:78
 #: src/pages/stages/authenticator_validate/AuthenticatorValidateStageForm.ts:118
-#: src/pages/stages/password/PasswordStageForm.ts:89
+#: src/pages/stages/password/PasswordStageForm.ts:87
 msgid "Configuration flow"
 msgstr "Configuration flow"
 
@@ -633,7 +633,7 @@ msgid "Connection error, reconnecting..."
 msgstr "Connection error, reconnecting..."
 
 #: src/pages/sources/ldap/LDAPSourceForm.ts:98
-#: src/pages/stages/email/EmailStageForm.ts:58
+#: src/pages/stages/email/EmailStageForm.ts:59
 msgid "Connection settings"
 msgstr "Connection settings"
 
@@ -689,7 +689,7 @@ msgstr "Context"
 msgid "Continue"
 msgstr "Continue"
 
-#: src/pages/stages/invitation/InvitationStageForm.ts:70
+#: src/pages/stages/invitation/InvitationStageForm.ts:68
 msgid "Continue flow without invitation"
 msgstr "Continue flow without invitation"
 
@@ -745,8 +745,8 @@ msgstr "Copy Key"
 #: src/pages/stages/invitation/InvitationListPage.ts:85
 #: src/pages/stages/prompt/PromptListPage.ts:96
 #: src/pages/stages/prompt/PromptListPage.ts:104
-#: src/pages/stages/prompt/PromptStageForm.ts:90
-#: src/pages/stages/prompt/PromptStageForm.ts:98
+#: src/pages/stages/prompt/PromptStageForm.ts:88
+#: src/pages/stages/prompt/PromptStageForm.ts:96
 #: src/pages/user-settings/tokens/UserTokenList.ts:50
 #: src/pages/user-settings/tokens/UserTokenList.ts:58
 #: src/pages/users/UserListPage.ts:155
@@ -803,7 +803,7 @@ msgid "Create Policy"
 msgstr "Create Policy"
 
 #: src/pages/stages/prompt/PromptListPage.ts:99
-#: src/pages/stages/prompt/PromptStageForm.ts:93
+#: src/pages/stages/prompt/PromptStageForm.ts:91
 msgid "Create Prompt"
 msgstr "Create Prompt"
 
@@ -863,11 +863,11 @@ msgstr "Customisation"
 msgid "DSA-SHA1"
 msgstr "DSA-SHA1"
 
-#: src/pages/stages/prompt/PromptForm.ts:63
+#: src/pages/stages/prompt/PromptForm.ts:68
 msgid "Date"
 msgstr "Date"
 
-#: src/pages/stages/prompt/PromptForm.ts:66
+#: src/pages/stages/prompt/PromptForm.ts:71
 msgid "Date Time"
 msgstr "Date Time"
 
@@ -927,7 +927,7 @@ msgstr "Delete account"
 msgid "Delete temporary users after"
 msgstr "Delete temporary users after"
 
-#: src/pages/stages/user_delete/UserDeleteStageForm.ts:51
+#: src/pages/stages/user_delete/UserDeleteStageForm.ts:49
 msgid ""
 "Delete the currently pending user. CAUTION, this stage does not ask for\n"
 "confirmation. Use a consent stage to ensure the user is aware of their actions."
@@ -946,7 +946,7 @@ msgstr "Deny the user access"
 #: src/pages/applications/ApplicationForm.ts:175
 #: src/pages/property-mappings/PropertyMappingScopeForm.ts:63
 #: src/pages/system-tasks/SystemTaskListPage.ts:55
-#: src/pages/user-settings/tokens/UserTokenForm.ts:50
+#: src/pages/user-settings/tokens/UserTokenForm.ts:55
 msgid "Description"
 msgstr "Description"
 
@@ -954,7 +954,7 @@ msgstr "Description"
 msgid "Description shown to the user when consenting. If left empty, the user won't be informed."
 msgstr "Description shown to the user when consenting. If left empty, the user won't be informed."
 
-#: src/pages/users/UserForm.ts:74
+#: src/pages/users/UserForm.ts:79
 msgid "Designates whether this user should be treated as active. Unselect this instead of deleting accounts."
 msgstr "Designates whether this user should be treated as active. Unselect this instead of deleting accounts."
 
@@ -967,7 +967,7 @@ msgstr "Designation"
 msgid "Determines how authentik sends the response back to the Service Provider."
 msgstr "Determines how authentik sends the response back to the Service Provider."
 
-#: src/pages/stages/user_login/UserLoginStageForm.ts:70
+#: src/pages/stages/user_login/UserLoginStageForm.ts:68
 msgid "Determines how long a session lasts. Default of 0 seconds means that the sessions lasts until the browser is closed."
 msgstr "Determines how long a session lasts. Default of 0 seconds means that the sessions lasts until the browser is closed."
 
@@ -984,7 +984,7 @@ msgstr "Device name"
 msgid "Digest algorithm"
 msgstr "Digest algorithm"
 
-#: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts:67
+#: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts:65
 msgid "Digits"
 msgstr "Digits"
 
@@ -1018,7 +1018,7 @@ msgstr "Docker URL"
 msgid "Download"
 msgstr "Download"
 
-#: src/pages/stages/dummy/DummyStageForm.ts:51
+#: src/pages/stages/dummy/DummyStageForm.ts:49
 msgid "Dummy stage used for testing. Shows a simple continue button and always passes."
 msgstr "Dummy stage used for testing. Shows a simple continue button and always passes."
 
@@ -1083,9 +1083,9 @@ msgstr "Either no applications are defined, or you don't have access to any."
 
 #: src/flows/stages/identification/IdentificationStage.ts:146
 #: src/pages/events/TransportForm.ts:51
-#: src/pages/stages/identification/IdentificationStageForm.ts:81
+#: src/pages/stages/identification/IdentificationStageForm.ts:79
 #: src/pages/user-settings/UserDetailsPage.ts:71
-#: src/pages/users/UserForm.ts:61
+#: src/pages/users/UserForm.ts:66
 #: src/pages/users/UserViewPage.ts:100
 msgid "Email"
 msgstr "Email"
@@ -1098,7 +1098,7 @@ msgstr "Email address"
 msgid "Email or username"
 msgstr "Email or username"
 
-#: src/pages/stages/prompt/PromptForm.ts:51
+#: src/pages/stages/prompt/PromptForm.ts:56
 msgid "Email: Text field with Email type."
 msgstr "Email: Text field with Email type."
 
@@ -1143,7 +1143,7 @@ msgstr "Enrollment"
 #: src/pages/sources/oauth/OAuthSourceForm.ts:252
 #: src/pages/sources/plex/PlexSourceForm.ts:206
 #: src/pages/sources/saml/SAMLSourceForm.ts:264
-#: src/pages/stages/identification/IdentificationStageForm.ts:106
+#: src/pages/stages/identification/IdentificationStageForm.ts:104
 msgid "Enrollment flow"
 msgstr "Enrollment flow"
 
@@ -1155,7 +1155,7 @@ msgstr "Error"
 msgid "Error creating credential: {err}"
 msgstr "Error creating credential: {err}"
 
-#: src/pages/policies/password/PasswordPolicyForm.ts:110
+#: src/pages/policies/password/PasswordPolicyForm.ts:108
 msgid "Error message"
 msgstr "Error message"
 
@@ -1217,24 +1217,24 @@ msgstr "Execute"
 msgid "Execute flow"
 msgstr "Execute flow"
 
-#: src/pages/policies/expression/ExpressionPolicyForm.ts:54
+#: src/pages/policies/expression/ExpressionPolicyForm.ts:52
 msgid "Executes the python snippet to determine whether to allow or deny a request."
 msgstr "Executes the python snippet to determine whether to allow or deny a request."
 
 #: src/pages/policies/dummy/DummyPolicyForm.ts:63
-#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:66
-#: src/pages/policies/expiry/ExpiryPolicyForm.ts:65
-#: src/pages/policies/expression/ExpressionPolicyForm.ts:66
-#: src/pages/policies/hibp/HaveIBeenPwnedPolicyForm.ts:66
-#: src/pages/policies/password/PasswordPolicyForm.ts:65
-#: src/pages/policies/reputation/ReputationPolicyForm.ts:65
+#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:64
+#: src/pages/policies/expiry/ExpiryPolicyForm.ts:63
+#: src/pages/policies/expression/ExpressionPolicyForm.ts:64
+#: src/pages/policies/hibp/HaveIBeenPwnedPolicyForm.ts:64
+#: src/pages/policies/password/PasswordPolicyForm.ts:63
+#: src/pages/policies/reputation/ReputationPolicyForm.ts:63
 msgid "Execution logging"
 msgstr "Execution logging"
 
 #: src/elements/oauth/UserCodeList.ts:30
 #: src/elements/oauth/UserRefreshList.ts:30
 #: src/elements/user/UserConsentList.ts:30
-#: src/pages/stages/invitation/InvitationForm.ts:46
+#: src/pages/stages/invitation/InvitationForm.ts:51
 msgid "Expires"
 msgstr "Expires"
 
@@ -1265,14 +1265,14 @@ msgid "Export"
 msgstr "Export"
 
 #: src/pages/events/EventInfo.ts:133
-#: src/pages/policies/expression/ExpressionPolicyForm.ts:79
+#: src/pages/policies/expression/ExpressionPolicyForm.ts:77
 #: src/pages/property-mappings/PropertyMappingLDAPForm.ts:63
 #: src/pages/property-mappings/PropertyMappingSAMLForm.ts:73
 #: src/pages/property-mappings/PropertyMappingScopeForm.ts:70
 msgid "Expression"
 msgstr "Expression"
 
-#: src/pages/policies/expression/ExpressionPolicyForm.ts:85
+#: src/pages/policies/expression/ExpressionPolicyForm.ts:83
 #: src/pages/property-mappings/PropertyMappingLDAPForm.ts:69
 #: src/pages/property-mappings/PropertyMappingSAMLForm.ts:79
 #: src/pages/property-mappings/PropertyMappingScopeForm.ts:76
@@ -1291,7 +1291,7 @@ msgstr "External Host"
 msgid "External host"
 msgstr "External host"
 
-#: src/pages/stages/password/PasswordStageForm.ts:111
+#: src/pages/stages/password/PasswordStageForm.ts:109
 msgid "Failed attempts before cancel"
 msgstr "Failed attempts before cancel"
 
@@ -1311,12 +1311,12 @@ msgstr "Failed to update {0}: {1}"
 msgid "Field"
 msgstr "Field"
 
-#: src/pages/stages/prompt/PromptForm.ts:83
+#: src/pages/stages/prompt/PromptForm.ts:88
 msgid "Field Key"
 msgstr "Field Key"
 
-#: src/pages/policies/hibp/HaveIBeenPwnedPolicyForm.ts:83
-#: src/pages/policies/password/PasswordPolicyForm.ts:82
+#: src/pages/policies/hibp/HaveIBeenPwnedPolicyForm.ts:81
+#: src/pages/policies/password/PasswordPolicyForm.ts:80
 msgid "Field key to check, field keys defined in Prompt stages are available."
 msgstr "Field key to check, field keys defined in Prompt stages are available."
 
@@ -1332,11 +1332,11 @@ msgstr "Field which contains a unique Identifier."
 msgid "Field which contains members of a group."
 msgstr "Field which contains members of a group."
 
-#: src/pages/stages/prompt/PromptStageForm.ts:69
+#: src/pages/stages/prompt/PromptStageForm.ts:67
 msgid "Fields"
 msgstr "Fields"
 
-#: src/pages/stages/identification/IdentificationStageForm.ts:84
+#: src/pages/stages/identification/IdentificationStageForm.ts:82
 msgid "Fields a user can identify themselves with. If no fields are selected, the user will only be able to use sources."
 msgstr "Fields a user can identify themselves with. If no fields are selected, the user will only be able to use sources."
 
@@ -1371,12 +1371,12 @@ msgstr "Flow to use when enrolling new users."
 msgid "Flow used before authentication."
 msgstr "Flow used before authentication."
 
-#: src/pages/stages/password/PasswordStageForm.ts:108
+#: src/pages/stages/password/PasswordStageForm.ts:106
 msgid "Flow used by an authenticated user to configure their password. If empty, user will not be able to configure change their password."
 msgstr "Flow used by an authenticated user to configure their password. If empty, user will not be able to configure change their password."
 
-#: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts:93
-#: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts:98
+#: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts:91
+#: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts:96
 msgid "Flow used by an authenticated user to configure this Stage. If empty, user will not be able to configure this stage."
 msgstr "Flow used by an authenticated user to configure this Stage. If empty, user will not be able to configure this stage."
 
@@ -1423,7 +1423,7 @@ msgstr "Form didn't return a promise for submitting"
 msgid "Friendly Name"
 msgstr "Friendly Name"
 
-#: src/pages/stages/email/EmailStageForm.ts:107
+#: src/pages/stages/email/EmailStageForm.ts:108
 msgid "From address"
 msgstr "From address"
 
@@ -1506,7 +1506,7 @@ msgstr "Healthy outposts"
 msgid "Healthy sources"
 msgstr "Healthy sources"
 
-#: src/pages/stages/prompt/PromptForm.ts:72
+#: src/pages/stages/prompt/PromptForm.ts:77
 msgid "Hidden: Hidden field, can be used to insert data into form."
 msgstr "Hidden: Hidden field, can be used to insert data into form."
 
@@ -1527,14 +1527,14 @@ msgstr "Hide service-accounts"
 #: src/pages/sources/ldap/LDAPSourceForm.ts:191
 #: src/pages/sources/plex/PlexSourceForm.ts:168
 #: src/pages/stages/authenticator_validate/AuthenticatorValidateStageForm.ts:114
-#: src/pages/stages/identification/IdentificationStageForm.ts:85
-#: src/pages/stages/password/PasswordStageForm.ts:86
-#: src/pages/stages/prompt/PromptStageForm.ts:87
-#: src/pages/stages/prompt/PromptStageForm.ts:121
+#: src/pages/stages/identification/IdentificationStageForm.ts:83
+#: src/pages/stages/password/PasswordStageForm.ts:84
+#: src/pages/stages/prompt/PromptStageForm.ts:85
+#: src/pages/stages/prompt/PromptStageForm.ts:119
 msgid "Hold control/command to select multiple items."
 msgstr "Hold control/command to select multiple items."
 
-#: src/pages/stages/password/PasswordStageForm.ts:115
+#: src/pages/stages/password/PasswordStageForm.ts:113
 msgid "How many attempts a user has before the flow is canceled. To lock the user out, use a reputation policy and a user_write stage."
 msgstr "How many attempts a user has before the flow is canceled. To lock the user out, use a reputation policy and a user_write stage."
 
@@ -1549,7 +1549,7 @@ msgstr "Icon"
 #: src/pages/flows/FlowListPage.ts:46
 #: src/pages/system-tasks/SystemTaskListPage.ts:54
 #: src/pages/tokens/TokenListPage.ts:44
-#: src/pages/user-settings/tokens/UserTokenForm.ts:44
+#: src/pages/user-settings/tokens/UserTokenForm.ts:49
 #: src/pages/user-settings/tokens/UserTokenList.ts:39
 msgid "Identifier"
 msgstr "Identifier"
@@ -1567,7 +1567,7 @@ msgstr "If enabled, use the local connection. Required Docker socket/Kubernetes
 msgid "If left empty, authentik will try to extract the launch URL based on the selected provider."
 msgstr "If left empty, authentik will try to extract the launch URL based on the selected provider."
 
-#: src/pages/stages/invitation/InvitationStageForm.ts:73
+#: src/pages/stages/invitation/InvitationStageForm.ts:71
 msgid "If this flag is set, this Stage will jump to the next Stage when no Invitation is given. By default this Stage will cancel the Flow when no invitation is given."
 msgstr "If this flag is set, this Stage will jump to the next Stage when no Invitation is given. By default this Stage will cancel the Flow when no invitation is given."
 
@@ -1629,7 +1629,7 @@ msgstr "Invalidation"
 msgid "Invitations"
 msgstr "Invitations"
 
-#: src/pages/users/UserForm.ts:71
+#: src/pages/users/UserForm.ts:76
 msgid "Is active"
 msgstr "Is active"
 
@@ -1676,12 +1676,12 @@ msgstr "LDAP DN under which bind requests and search requests can be made."
 msgid "LDAP Sync status"
 msgstr "LDAP Sync status"
 
-#: src/pages/stages/prompt/PromptForm.ts:90
+#: src/pages/stages/prompt/PromptForm.ts:95
 #: src/pages/stages/prompt/PromptListPage.ts:47
 msgid "Label"
 msgstr "Label"
 
-#: src/pages/stages/prompt/PromptForm.ts:94
+#: src/pages/stages/prompt/PromptForm.ts:99
 msgid "Label shown next to/above the prompt."
 msgstr "Label shown next to/above the prompt."
 
@@ -1712,7 +1712,7 @@ msgstr "Launch"
 msgid "Launch URL"
 msgstr "Launch URL"
 
-#: src/pages/stages/identification/IdentificationStageForm.ts:60
+#: src/pages/stages/identification/IdentificationStageForm.ts:58
 msgid "Let the user identify themselves with their username or Email address."
 msgstr "Let the user identify themselves with their username or Email address."
 
@@ -1779,8 +1779,8 @@ msgstr "Loading"
 #: src/pages/policies/PolicyBindingForm.ts:173
 #: src/pages/policies/PolicyBindingForm.ts:189
 #: src/pages/policies/PolicyTestForm.ts:71
-#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:88
-#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:108
+#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:86
+#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:106
 #: src/pages/property-mappings/PropertyMappingTestForm.ts:61
 #: src/pages/providers/ldap/LDAPProviderForm.ts:70
 #: src/pages/providers/ldap/LDAPProviderForm.ts:84
@@ -1806,15 +1806,15 @@ msgstr "Loading"
 #: src/pages/sources/saml/SAMLSourceForm.ts:238
 #: src/pages/sources/saml/SAMLSourceForm.ts:259
 #: src/pages/sources/saml/SAMLSourceForm.ts:280
-#: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts:90
-#: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts:96
+#: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts:88
+#: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts:94
 #: src/pages/stages/authenticator_validate/AuthenticatorValidateStageForm.ts:131
-#: src/pages/stages/email/EmailStageForm.ts:170
-#: src/pages/stages/identification/IdentificationStageForm.ts:119
-#: src/pages/stages/identification/IdentificationStageForm.ts:137
-#: src/pages/stages/password/PasswordStageForm.ts:106
-#: src/pages/stages/prompt/PromptStageForm.ts:85
-#: src/pages/stages/prompt/PromptStageForm.ts:118
+#: src/pages/stages/email/EmailStageForm.ts:171
+#: src/pages/stages/identification/IdentificationStageForm.ts:117
+#: src/pages/stages/identification/IdentificationStageForm.ts:135
+#: src/pages/stages/password/PasswordStageForm.ts:104
+#: src/pages/stages/prompt/PromptStageForm.ts:83
+#: src/pages/stages/prompt/PromptStageForm.ts:116
 msgid "Loading..."
 msgstr "Loading..."
 
@@ -1824,7 +1824,7 @@ msgstr "Loading..."
 msgid "Local"
 msgstr "Local"
 
-#: src/pages/stages/user_login/UserLoginStageForm.ts:52
+#: src/pages/stages/user_login/UserLoginStageForm.ts:50
 msgid "Log the currently pending user in."
 msgstr "Log the currently pending user in."
 
@@ -1857,23 +1857,23 @@ msgstr "Logs"
 msgid "Long-running operations which authentik executes in the background."
 msgstr "Long-running operations which authentik executes in the background."
 
-#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:90
+#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:88
 msgid "Match created events with this action type. When left empty, all action types will be matched."
 msgstr "Match created events with this action type. When left empty, all action types will be matched."
 
-#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:110
+#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:108
 msgid "Match events created by selected application. When left empty, all applications are matched."
 msgstr "Match events created by selected application. When left empty, all applications are matched."
 
-#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:96
+#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:94
 msgid "Matches Event's Client IP (strict matching, for network matching use an Expression Policy."
 msgstr "Matches Event's Client IP (strict matching, for network matching use an Expression Policy."
 
-#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:54
+#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:52
 msgid "Matches an event against a set of criteria. If any of the configured values match, the policy passes."
 msgstr "Matches an event against a set of criteria. If any of the configured values match, the policy passes."
 
-#: src/pages/policies/expiry/ExpiryPolicyForm.ts:78
+#: src/pages/policies/expiry/ExpiryPolicyForm.ts:76
 msgid "Maximum age (in days)"
 msgstr "Maximum age (in days)"
 
@@ -1895,19 +1895,19 @@ msgstr "Messages"
 msgid "Metadata"
 msgstr "Metadata"
 
-#: src/pages/policies/password/PasswordPolicyForm.ts:98
+#: src/pages/policies/password/PasswordPolicyForm.ts:96
 msgid "Minimum amount of Lowercase Characters"
 msgstr "Minimum amount of Lowercase Characters"
 
-#: src/pages/policies/password/PasswordPolicyForm.ts:104
+#: src/pages/policies/password/PasswordPolicyForm.ts:102
 msgid "Minimum amount of Symbols Characters"
 msgstr "Minimum amount of Symbols Characters"
 
-#: src/pages/policies/password/PasswordPolicyForm.ts:92
+#: src/pages/policies/password/PasswordPolicyForm.ts:90
 msgid "Minimum amount of Uppercase Characters"
 msgstr "Minimum amount of Uppercase Characters"
 
-#: src/pages/policies/password/PasswordPolicyForm.ts:86
+#: src/pages/policies/password/PasswordPolicyForm.ts:84
 msgid "Minimum length"
 msgstr "Minimum length"
 
@@ -1951,12 +1951,12 @@ msgstr "My Applications"
 #: src/pages/outposts/ServiceConnectionListPage.ts:53
 #: src/pages/policies/PolicyListPage.ts:56
 #: src/pages/policies/dummy/DummyPolicyForm.ts:54
-#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:57
-#: src/pages/policies/expiry/ExpiryPolicyForm.ts:56
-#: src/pages/policies/expression/ExpressionPolicyForm.ts:57
-#: src/pages/policies/hibp/HaveIBeenPwnedPolicyForm.ts:57
-#: src/pages/policies/password/PasswordPolicyForm.ts:56
-#: src/pages/policies/reputation/ReputationPolicyForm.ts:56
+#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:55
+#: src/pages/policies/expiry/ExpiryPolicyForm.ts:54
+#: src/pages/policies/expression/ExpressionPolicyForm.ts:55
+#: src/pages/policies/hibp/HaveIBeenPwnedPolicyForm.ts:55
+#: src/pages/policies/password/PasswordPolicyForm.ts:54
+#: src/pages/policies/reputation/ReputationPolicyForm.ts:54
 #: src/pages/property-mappings/PropertyMappingLDAPForm.ts:50
 #: src/pages/property-mappings/PropertyMappingListPage.ts:54
 #: src/pages/property-mappings/PropertyMappingSAMLForm.ts:50
@@ -1981,31 +1981,31 @@ msgstr "My Applications"
 #: src/pages/sources/saml/SAMLSourceForm.ts:52
 #: src/pages/sources/saml/SAMLSourceViewPage.ts:66
 #: src/pages/stages/StageListPage.ts:65
-#: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts:57
-#: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts:56
+#: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts:55
+#: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts:54
 #: src/pages/stages/authenticator_validate/AuthenticatorValidateStageForm.ts:64
-#: src/pages/stages/authenticator_webauthn/AuthenticateWebAuthnStageForm.ts:54
-#: src/pages/stages/captcha/CaptchaStageForm.ts:55
+#: src/pages/stages/authenticator_webauthn/AuthenticateWebAuthnStageForm.ts:52
+#: src/pages/stages/captcha/CaptchaStageForm.ts:53
 #: src/pages/stages/consent/ConsentStageForm.ts:57
-#: src/pages/stages/deny/DenyStageForm.ts:54
-#: src/pages/stages/dummy/DummyStageForm.ts:54
-#: src/pages/stages/email/EmailStageForm.ts:122
-#: src/pages/stages/identification/IdentificationStageForm.ts:63
-#: src/pages/stages/invitation/InvitationStageForm.ts:56
-#: src/pages/stages/password/PasswordStageForm.ts:63
-#: src/pages/stages/prompt/PromptStageForm.ts:58
-#: src/pages/stages/user_delete/UserDeleteStageForm.ts:55
-#: src/pages/stages/user_login/UserLoginStageForm.ts:55
-#: src/pages/stages/user_logout/UserLogoutStageForm.ts:54
-#: src/pages/stages/user_write/UserWriteStageForm.ts:55
+#: src/pages/stages/deny/DenyStageForm.ts:52
+#: src/pages/stages/dummy/DummyStageForm.ts:52
+#: src/pages/stages/email/EmailStageForm.ts:123
+#: src/pages/stages/identification/IdentificationStageForm.ts:61
+#: src/pages/stages/invitation/InvitationStageForm.ts:54
+#: src/pages/stages/password/PasswordStageForm.ts:61
+#: src/pages/stages/prompt/PromptStageForm.ts:56
+#: src/pages/stages/user_delete/UserDeleteStageForm.ts:53
+#: src/pages/stages/user_login/UserLoginStageForm.ts:53
+#: src/pages/stages/user_logout/UserLogoutStageForm.ts:52
+#: src/pages/stages/user_write/UserWriteStageForm.ts:53
 #: src/pages/user-settings/UserDetailsPage.ts:64
-#: src/pages/users/UserForm.ts:54
+#: src/pages/users/UserForm.ts:59
 #: src/pages/users/UserListPage.ts:54
 #: src/pages/users/UserViewPage.ts:92
 msgid "Name"
 msgstr "Name"
 
-#: src/pages/stages/prompt/PromptForm.ts:87
+#: src/pages/stages/prompt/PromptForm.ts:92
 msgid "Name of the form field, also used to store the value."
 msgstr "Name of the form field, also used to store the value."
 
@@ -2147,7 +2147,7 @@ msgstr "Notifications"
 msgid "Notifications Transport"
 msgstr "Notifications Transport"
 
-#: src/pages/stages/prompt/PromptForm.ts:57
+#: src/pages/stages/prompt/PromptForm.ts:62
 msgid "Number"
 msgstr "Number"
 
@@ -2182,7 +2182,7 @@ msgstr "Offset after which consent expires. (Format: hours=1;minutes=2;seconds=3
 msgid "On behalf of {0}"
 msgstr "On behalf of {0}"
 
-#: src/pages/policies/expiry/ExpiryPolicyForm.ts:87
+#: src/pages/policies/expiry/ExpiryPolicyForm.ts:85
 msgid "Only fail the policy, don't invalidate user's password."
 msgstr "Only fail the policy, don't invalidate user's password."
 
@@ -2210,15 +2210,15 @@ msgstr "Optional Private Key. If this is set, you can use this keypair for encry
 msgid "Optional URL if the IDP supports Single-Logout."
 msgstr "Optional URL if the IDP supports Single-Logout."
 
-#: src/pages/stages/invitation/InvitationForm.ts:56
+#: src/pages/stages/invitation/InvitationForm.ts:61
 msgid "Optional data which is loaded into the flow's 'prompt_data' context variable. YAML or JSON."
 msgstr "Optional data which is loaded into the flow's 'prompt_data' context variable. YAML or JSON."
 
-#: src/pages/stages/identification/IdentificationStageForm.ts:121
+#: src/pages/stages/identification/IdentificationStageForm.ts:119
 msgid "Optional enrollment flow, which is linked at the bottom of the page."
 msgstr "Optional enrollment flow, which is linked at the bottom of the page."
 
-#: src/pages/stages/identification/IdentificationStageForm.ts:139
+#: src/pages/stages/identification/IdentificationStageForm.ts:137
 msgid "Optional recovery flow, which is linked at the bottom of the page."
 msgstr "Optional recovery flow, which is linked at the bottom of the page."
 
@@ -2226,7 +2226,7 @@ msgstr "Optional recovery flow, which is linked at the bottom of the page."
 msgid "Optional, comma-separated SubjectAlt Names."
 msgstr "Optional, comma-separated SubjectAlt Names."
 
-#: src/pages/stages/prompt/PromptForm.ts:116
+#: src/pages/stages/prompt/PromptForm.ts:121
 msgid "Optionally pre-fill the input value"
 msgstr "Optionally pre-fill the input value"
 
@@ -2238,7 +2238,7 @@ msgstr "Optionally set the 'FriendlyName' value of the Assertion attribute."
 #: src/pages/flows/StageBindingForm.ts:115
 #: src/pages/policies/BoundPoliciesList.ts:42
 #: src/pages/policies/PolicyBindingForm.ts:204
-#: src/pages/stages/prompt/PromptForm.ts:119
+#: src/pages/stages/prompt/PromptForm.ts:124
 #: src/pages/stages/prompt/PromptListPage.ts:49
 msgid "Order"
 msgstr "Order"
@@ -2309,12 +2309,12 @@ msgstr "Passing"
 msgid "Password"
 msgstr "Password"
 
-#: src/pages/policies/hibp/HaveIBeenPwnedPolicyForm.ts:79
-#: src/pages/policies/password/PasswordPolicyForm.ts:78
+#: src/pages/policies/hibp/HaveIBeenPwnedPolicyForm.ts:77
+#: src/pages/policies/password/PasswordPolicyForm.ts:76
 msgid "Password field"
 msgstr "Password field"
 
-#: src/pages/stages/prompt/PromptForm.ts:54
+#: src/pages/stages/prompt/PromptForm.ts:59
 msgid "Password: Masked input, password is validated against sources. Policies still have to be applied to this Stage. If two of these are used in the same stage, they are ensured to be identical."
 msgstr "Password: Masked input, password is validated against sources. Policies still have to be applied to this Stage. If two of these are used in the same stage, they are ensured to be identical."
 
@@ -2322,7 +2322,7 @@ msgstr "Password: Masked input, password is validated against sources. Policies
 msgid "Persistent"
 msgstr "Persistent"
 
-#: src/pages/stages/prompt/PromptForm.ts:113
+#: src/pages/stages/prompt/PromptForm.ts:118
 msgid "Placeholder"
 msgstr "Placeholder"
 
@@ -2380,12 +2380,12 @@ msgid "Policy {0}"
 msgstr "Policy {0}"
 
 #: src/pages/policies/dummy/DummyPolicyForm.ts:72
-#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:75
-#: src/pages/policies/expiry/ExpiryPolicyForm.ts:74
-#: src/pages/policies/expression/ExpressionPolicyForm.ts:75
-#: src/pages/policies/hibp/HaveIBeenPwnedPolicyForm.ts:75
-#: src/pages/policies/password/PasswordPolicyForm.ts:74
-#: src/pages/policies/reputation/ReputationPolicyForm.ts:74
+#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:73
+#: src/pages/policies/expiry/ExpiryPolicyForm.ts:72
+#: src/pages/policies/expression/ExpressionPolicyForm.ts:73
+#: src/pages/policies/hibp/HaveIBeenPwnedPolicyForm.ts:73
+#: src/pages/policies/password/PasswordPolicyForm.ts:72
+#: src/pages/policies/reputation/ReputationPolicyForm.ts:72
 msgid "Policy-specific settings"
 msgstr "Policy-specific settings"
 
@@ -2410,7 +2410,7 @@ msgid "Pre-authentication flow"
 msgstr "Pre-authentication flow"
 
 #: src/pages/crypto/CertificateKeyPairForm.ts:66
-#: src/pages/stages/captcha/CaptchaStageForm.ts:73
+#: src/pages/stages/captcha/CaptchaStageForm.ts:71
 msgid "Private Key"
 msgstr "Private Key"
 
@@ -2418,7 +2418,7 @@ msgstr "Private Key"
 msgid "Private key available?"
 msgstr "Private key available?"
 
-#: src/pages/stages/captcha/CaptchaStageForm.ts:78
+#: src/pages/stages/captcha/CaptchaStageForm.ts:76
 msgid "Private key, acquired from https://www.google.com/recaptcha/intro/v3.html."
 msgstr "Private key, acquired from https://www.google.com/recaptcha/intro/v3.html."
 
@@ -2508,11 +2508,11 @@ msgstr "Proxy"
 msgid "Public"
 msgstr "Public"
 
-#: src/pages/stages/captcha/CaptchaStageForm.ts:66
+#: src/pages/stages/captcha/CaptchaStageForm.ts:64
 msgid "Public Key"
 msgstr "Public Key"
 
-#: src/pages/stages/captcha/CaptchaStageForm.ts:70
+#: src/pages/stages/captcha/CaptchaStageForm.ts:68
 msgid "Public key, acquired from https://www.google.com/recaptcha/intro/v3.html."
 msgstr "Public key, acquired from https://www.google.com/recaptcha/intro/v3.html."
 
@@ -2556,7 +2556,7 @@ msgstr "Re-evaluate policies"
 msgid "Recovery"
 msgstr "Recovery"
 
-#: src/pages/stages/identification/IdentificationStageForm.ts:124
+#: src/pages/stages/identification/IdentificationStageForm.ts:122
 msgid "Recovery flow"
 msgstr "Recovery flow"
 
@@ -2605,7 +2605,7 @@ msgstr "Related"
 msgid "Reload"
 msgstr "Reload"
 
-#: src/pages/stages/user_logout/UserLogoutStageForm.ts:51
+#: src/pages/stages/user_logout/UserLogoutStageForm.ts:49
 msgid "Remove the user from the current session."
 msgstr "Remove the user from the current session."
 
@@ -2622,12 +2622,12 @@ msgstr "Request has been denied."
 msgid "Request token URL"
 msgstr "Request token URL"
 
-#: src/pages/stages/prompt/PromptForm.ts:108
+#: src/pages/stages/prompt/PromptForm.ts:113
 msgid "Required"
 msgstr "Required"
 
 #: src/pages/user-settings/UserDetailsPage.ts:61
-#: src/pages/users/UserForm.ts:51
+#: src/pages/users/UserForm.ts:56
 msgid "Required. 150 characters or fewer. Letters, digits and @/./+/-/_ only."
 msgstr "Required. 150 characters or fewer. Letters, digits and @/./+/-/_ only."
 
@@ -2696,19 +2696,19 @@ msgstr "SHA512"
 msgid "SLO URL"
 msgstr "SLO URL"
 
-#: src/pages/stages/email/EmailStageForm.ts:62
+#: src/pages/stages/email/EmailStageForm.ts:63
 msgid "SMTP Host"
 msgstr "SMTP Host"
 
-#: src/pages/stages/email/EmailStageForm.ts:79
+#: src/pages/stages/email/EmailStageForm.ts:80
 msgid "SMTP Password"
 msgstr "SMTP Password"
 
-#: src/pages/stages/email/EmailStageForm.ts:68
+#: src/pages/stages/email/EmailStageForm.ts:69
 msgid "SMTP Port"
 msgstr "SMTP Port"
 
-#: src/pages/stages/email/EmailStageForm.ts:74
+#: src/pages/stages/email/EmailStageForm.ts:75
 msgid "SMTP Username"
 msgstr "SMTP Username"
 
@@ -2743,7 +2743,7 @@ msgstr "Search..."
 msgid "Secret:"
 msgstr "Secret:"
 
-#: src/pages/policies/expression/ExpressionPolicyForm.ts:87
+#: src/pages/policies/expression/ExpressionPolicyForm.ts:85
 #: src/pages/property-mappings/PropertyMappingLDAPForm.ts:71
 #: src/pages/property-mappings/PropertyMappingSAMLForm.ts:81
 #: src/pages/property-mappings/PropertyMappingScopeForm.ts:78
@@ -2782,7 +2782,7 @@ msgstr "Select which server a user has to be a member of to be allowed to authen
 msgid "Select which transports should be used to notify the user. If none are selected, the notification will only be shown in the authentik UI."
 msgstr "Select which transports should be used to notify the user. If none are selected, the notification will only be shown in the authentik UI."
 
-#: src/pages/stages/prompt/PromptStageForm.ts:120
+#: src/pages/stages/prompt/PromptStageForm.ts:118
 msgid "Selected policies are executed when the stage is submitted to validate the data."
 msgstr "Selected policies are executed when the stage is submitted to validate the data."
 
@@ -2790,7 +2790,7 @@ msgstr "Selected policies are executed when the stage is submitted to validate t
 msgid "Selecting a service-connection enables the management of the outpost by authentik."
 msgstr "Selecting a service-connection enables the management of the outpost by authentik."
 
-#: src/pages/stages/password/PasswordStageForm.ts:85
+#: src/pages/stages/password/PasswordStageForm.ts:83
 msgid "Selection of backends to test the password against."
 msgstr "Selection of backends to test the password against."
 
@@ -2810,7 +2810,7 @@ msgstr "Send once"
 msgid "Sent to group"
 msgstr "Sent to group"
 
-#: src/pages/stages/prompt/PromptForm.ts:69
+#: src/pages/stages/prompt/PromptForm.ts:74
 msgid "Separator: Static Separator Line"
 msgstr "Separator: Static Separator Line"
 
@@ -2835,7 +2835,7 @@ msgstr "Service Provider Binding"
 msgid "Service connection"
 msgstr "Service connection"
 
-#: src/pages/stages/user_login/UserLoginStageForm.ts:66
+#: src/pages/stages/user_login/UserLoginStageForm.ts:64
 msgid "Session duration"
 msgstr "Session duration"
 
@@ -2859,7 +2859,7 @@ msgstr "Set a custom HTTP-Basic Authentication header based on values from authe
 #: src/pages/outposts/OutpostForm.ts:127
 #: src/pages/outposts/ServiceConnectionKubernetesForm.ts:71
 #: src/pages/policies/PolicyTestForm.ts:79
-#: src/pages/users/UserForm.ts:82
+#: src/pages/users/UserForm.ts:87
 msgid "Set custom attributes using YAML or JSON."
 msgstr "Set custom attributes using YAML or JSON."
 
@@ -2868,11 +2868,11 @@ msgstr "Set custom attributes using YAML or JSON."
 msgid "Severity"
 msgstr "Severity"
 
-#: src/pages/stages/prompt/PromptStageForm.ts:55
+#: src/pages/stages/prompt/PromptStageForm.ts:53
 msgid "Show arbitrary input fields to the user, for example during enrollment. Data is saved in the flow context under the 'prompt_data' variable."
 msgstr "Show arbitrary input fields to the user, for example during enrollment. Data is saved in the flow context under the 'prompt_data' variable."
 
-#: src/pages/stages/identification/IdentificationStageForm.ts:100
+#: src/pages/stages/identification/IdentificationStageForm.ts:98
 msgid "Show matched user"
 msgstr "Show matched user"
 
@@ -2901,7 +2901,7 @@ msgstr "Signing keypair"
 msgid "Single Prompts that can be used for Prompt Stages."
 msgstr "Single Prompts that can be used for Prompt Stages."
 
-#: src/pages/stages/invitation/InvitationForm.ts:62
+#: src/pages/stages/invitation/InvitationForm.ts:67
 msgid "Single use"
 msgstr "Single use"
 
@@ -2960,15 +2960,15 @@ msgstr "Stage binding"
 msgid "Stage used to configure Authenticator when user doesn't have any compatible devices. After this configuration Stage passes, the user is not prompted again."
 msgstr "Stage used to configure Authenticator when user doesn't have any compatible devices. After this configuration Stage passes, the user is not prompted again."
 
-#: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts:53
+#: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts:51
 msgid "Stage used to configure a TOTP authenticator (i.e. Authy/Google Authenticator)."
 msgstr "Stage used to configure a TOTP authenticator (i.e. Authy/Google Authenticator)."
 
-#: src/pages/stages/authenticator_webauthn/AuthenticateWebAuthnStageForm.ts:51
+#: src/pages/stages/authenticator_webauthn/AuthenticateWebAuthnStageForm.ts:49
 msgid "Stage used to configure a WebAutnn authenticator (i.e. Yubikey, FaceID/Windows Hello)."
 msgstr "Stage used to configure a WebAutnn authenticator (i.e. Yubikey, FaceID/Windows Hello)."
 
-#: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts:54
+#: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts:52
 msgid "Stage used to configure a static authenticator (i.e. static tokens). This stage should be used for configuration flows."
 msgstr "Stage used to configure a static authenticator (i.e. static tokens). This stage should be used for configuration flows."
 
@@ -2976,17 +2976,17 @@ msgstr "Stage used to configure a static authenticator (i.e. static tokens). Thi
 msgid "Stage used to validate any authenticator. This stage should be used during authentication or authorization flows."
 msgstr "Stage used to validate any authenticator. This stage should be used during authentication or authorization flows."
 
-#: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts:64
-#: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts:63
+#: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts:62
+#: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts:61
 #: src/pages/stages/authenticator_validate/AuthenticatorValidateStageForm.ts:71
-#: src/pages/stages/captcha/CaptchaStageForm.ts:62
+#: src/pages/stages/captcha/CaptchaStageForm.ts:60
 #: src/pages/stages/consent/ConsentStageForm.ts:64
-#: src/pages/stages/email/EmailStageForm.ts:129
-#: src/pages/stages/identification/IdentificationStageForm.ts:70
-#: src/pages/stages/invitation/InvitationStageForm.ts:63
-#: src/pages/stages/password/PasswordStageForm.ts:70
-#: src/pages/stages/prompt/PromptStageForm.ts:65
-#: src/pages/stages/user_login/UserLoginStageForm.ts:62
+#: src/pages/stages/email/EmailStageForm.ts:130
+#: src/pages/stages/identification/IdentificationStageForm.ts:68
+#: src/pages/stages/invitation/InvitationStageForm.ts:61
+#: src/pages/stages/password/PasswordStageForm.ts:68
+#: src/pages/stages/prompt/PromptStageForm.ts:63
+#: src/pages/stages/user_login/UserLoginStageForm.ts:60
 msgid "Stage-specific settings"
 msgstr "Stage-specific settings"
 
@@ -3013,11 +3013,11 @@ msgstr "Static Tokens"
 msgid "Static tokens"
 msgstr "Static tokens"
 
-#: src/pages/stages/prompt/PromptForm.ts:75
+#: src/pages/stages/prompt/PromptForm.ts:80
 msgid "Static: Static value, displayed as-is."
 msgstr "Static: Static value, displayed as-is."
 
-#: src/pages/stages/deny/DenyStageForm.ts:51
+#: src/pages/stages/deny/DenyStageForm.ts:49
 msgid "Statically deny the flow. To use this stage effectively, disable *Evaluate on plan* on the respective binding."
 msgstr "Statically deny the flow. To use this stage effectively, disable *Evaluate on plan* on the respective binding."
 
@@ -3039,7 +3039,7 @@ msgstr "Status: Enabled"
 msgid "Stop impersonation"
 msgstr "Stop impersonation"
 
-#: src/pages/stages/email/EmailStageForm.ts:152
+#: src/pages/stages/email/EmailStageForm.ts:153
 msgid "Subject"
 msgstr "Subject"
 
@@ -3080,7 +3080,7 @@ msgstr "Successfully created flow."
 msgid "Successfully created group."
 msgstr "Successfully created group."
 
-#: src/pages/stages/invitation/InvitationForm.ts:39
+#: src/pages/stages/invitation/InvitationForm.ts:44
 msgid "Successfully created invitation."
 msgstr "Successfully created invitation."
 
@@ -3095,16 +3095,16 @@ msgid "Successfully created outpost."
 msgstr "Successfully created outpost."
 
 #: src/pages/policies/dummy/DummyPolicyForm.ts:44
-#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:47
-#: src/pages/policies/expiry/ExpiryPolicyForm.ts:46
-#: src/pages/policies/expression/ExpressionPolicyForm.ts:47
-#: src/pages/policies/hibp/HaveIBeenPwnedPolicyForm.ts:46
-#: src/pages/policies/password/PasswordPolicyForm.ts:46
-#: src/pages/policies/reputation/ReputationPolicyForm.ts:46
+#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:45
+#: src/pages/policies/expiry/ExpiryPolicyForm.ts:44
+#: src/pages/policies/expression/ExpressionPolicyForm.ts:45
+#: src/pages/policies/hibp/HaveIBeenPwnedPolicyForm.ts:44
+#: src/pages/policies/password/PasswordPolicyForm.ts:44
+#: src/pages/policies/reputation/ReputationPolicyForm.ts:44
 msgid "Successfully created policy."
 msgstr "Successfully created policy."
 
-#: src/pages/stages/prompt/PromptForm.ts:38
+#: src/pages/stages/prompt/PromptForm.ts:43
 msgid "Successfully created prompt."
 msgstr "Successfully created prompt."
 
@@ -3131,27 +3131,27 @@ msgstr "Successfully created service-connection."
 msgid "Successfully created source."
 msgstr "Successfully created source."
 
-#: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts:47
-#: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts:46
+#: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts:45
+#: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts:44
 #: src/pages/stages/authenticator_validate/AuthenticatorValidateStageForm.ts:48
-#: src/pages/stages/authenticator_webauthn/AuthenticateWebAuthnStageForm.ts:44
-#: src/pages/stages/captcha/CaptchaStageForm.ts:45
+#: src/pages/stages/authenticator_webauthn/AuthenticateWebAuthnStageForm.ts:42
+#: src/pages/stages/captcha/CaptchaStageForm.ts:43
 #: src/pages/stages/consent/ConsentStageForm.ts:47
-#: src/pages/stages/deny/DenyStageForm.ts:44
-#: src/pages/stages/dummy/DummyStageForm.ts:44
-#: src/pages/stages/email/EmailStageForm.ts:48
-#: src/pages/stages/identification/IdentificationStageForm.ts:47
-#: src/pages/stages/invitation/InvitationStageForm.ts:46
-#: src/pages/stages/password/PasswordStageForm.ts:47
-#: src/pages/stages/prompt/PromptStageForm.ts:48
-#: src/pages/stages/user_delete/UserDeleteStageForm.ts:44
-#: src/pages/stages/user_login/UserLoginStageForm.ts:45
-#: src/pages/stages/user_logout/UserLogoutStageForm.ts:44
-#: src/pages/stages/user_write/UserWriteStageForm.ts:44
+#: src/pages/stages/deny/DenyStageForm.ts:42
+#: src/pages/stages/dummy/DummyStageForm.ts:42
+#: src/pages/stages/email/EmailStageForm.ts:49
+#: src/pages/stages/identification/IdentificationStageForm.ts:45
+#: src/pages/stages/invitation/InvitationStageForm.ts:44
+#: src/pages/stages/password/PasswordStageForm.ts:45
+#: src/pages/stages/prompt/PromptStageForm.ts:46
+#: src/pages/stages/user_delete/UserDeleteStageForm.ts:42
+#: src/pages/stages/user_login/UserLoginStageForm.ts:43
+#: src/pages/stages/user_logout/UserLogoutStageForm.ts:42
+#: src/pages/stages/user_write/UserWriteStageForm.ts:42
 msgid "Successfully created stage."
 msgstr "Successfully created stage."
 
-#: src/pages/user-settings/tokens/UserTokenForm.ts:37
+#: src/pages/user-settings/tokens/UserTokenForm.ts:42
 msgid "Successfully created token."
 msgstr "Successfully created token."
 
@@ -3159,7 +3159,7 @@ msgstr "Successfully created token."
 msgid "Successfully created transport."
 msgstr "Successfully created transport."
 
-#: src/pages/users/UserForm.ts:40
+#: src/pages/users/UserForm.ts:45
 msgid "Successfully created user."
 msgstr "Successfully created user."
 
@@ -3218,7 +3218,7 @@ msgstr "Successfully updated flow."
 msgid "Successfully updated group."
 msgstr "Successfully updated group."
 
-#: src/pages/stages/invitation/InvitationForm.ts:36
+#: src/pages/stages/invitation/InvitationForm.ts:41
 msgid "Successfully updated invitation."
 msgstr "Successfully updated invitation."
 
@@ -3233,16 +3233,16 @@ msgid "Successfully updated outpost."
 msgstr "Successfully updated outpost."
 
 #: src/pages/policies/dummy/DummyPolicyForm.ts:41
-#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:44
-#: src/pages/policies/expiry/ExpiryPolicyForm.ts:43
-#: src/pages/policies/expression/ExpressionPolicyForm.ts:44
-#: src/pages/policies/hibp/HaveIBeenPwnedPolicyForm.ts:43
-#: src/pages/policies/password/PasswordPolicyForm.ts:43
-#: src/pages/policies/reputation/ReputationPolicyForm.ts:43
+#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:42
+#: src/pages/policies/expiry/ExpiryPolicyForm.ts:41
+#: src/pages/policies/expression/ExpressionPolicyForm.ts:42
+#: src/pages/policies/hibp/HaveIBeenPwnedPolicyForm.ts:41
+#: src/pages/policies/password/PasswordPolicyForm.ts:41
+#: src/pages/policies/reputation/ReputationPolicyForm.ts:41
 msgid "Successfully updated policy."
 msgstr "Successfully updated policy."
 
-#: src/pages/stages/prompt/PromptForm.ts:35
+#: src/pages/stages/prompt/PromptForm.ts:40
 msgid "Successfully updated prompt."
 msgstr "Successfully updated prompt."
 
@@ -3269,27 +3269,27 @@ msgstr "Successfully updated service-connection."
 msgid "Successfully updated source."
 msgstr "Successfully updated source."
 
-#: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts:44
-#: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts:43
+#: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts:42
+#: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts:41
 #: src/pages/stages/authenticator_validate/AuthenticatorValidateStageForm.ts:45
-#: src/pages/stages/authenticator_webauthn/AuthenticateWebAuthnStageForm.ts:41
-#: src/pages/stages/captcha/CaptchaStageForm.ts:42
+#: src/pages/stages/authenticator_webauthn/AuthenticateWebAuthnStageForm.ts:39
+#: src/pages/stages/captcha/CaptchaStageForm.ts:40
 #: src/pages/stages/consent/ConsentStageForm.ts:44
-#: src/pages/stages/deny/DenyStageForm.ts:41
-#: src/pages/stages/dummy/DummyStageForm.ts:41
-#: src/pages/stages/email/EmailStageForm.ts:45
-#: src/pages/stages/identification/IdentificationStageForm.ts:44
-#: src/pages/stages/invitation/InvitationStageForm.ts:43
-#: src/pages/stages/password/PasswordStageForm.ts:44
-#: src/pages/stages/prompt/PromptStageForm.ts:45
-#: src/pages/stages/user_delete/UserDeleteStageForm.ts:41
-#: src/pages/stages/user_login/UserLoginStageForm.ts:42
-#: src/pages/stages/user_logout/UserLogoutStageForm.ts:41
-#: src/pages/stages/user_write/UserWriteStageForm.ts:41
+#: src/pages/stages/deny/DenyStageForm.ts:39
+#: src/pages/stages/dummy/DummyStageForm.ts:39
+#: src/pages/stages/email/EmailStageForm.ts:46
+#: src/pages/stages/identification/IdentificationStageForm.ts:42
+#: src/pages/stages/invitation/InvitationStageForm.ts:41
+#: src/pages/stages/password/PasswordStageForm.ts:42
+#: src/pages/stages/prompt/PromptStageForm.ts:43
+#: src/pages/stages/user_delete/UserDeleteStageForm.ts:39
+#: src/pages/stages/user_login/UserLoginStageForm.ts:40
+#: src/pages/stages/user_logout/UserLogoutStageForm.ts:39
+#: src/pages/stages/user_write/UserWriteStageForm.ts:39
 msgid "Successfully updated stage."
 msgstr "Successfully updated stage."
 
-#: src/pages/user-settings/tokens/UserTokenForm.ts:34
+#: src/pages/user-settings/tokens/UserTokenForm.ts:39
 msgid "Successfully updated token."
 msgstr "Successfully updated token."
 
@@ -3297,7 +3297,7 @@ msgstr "Successfully updated token."
 msgid "Successfully updated transport."
 msgstr "Successfully updated transport."
 
-#: src/pages/users/UserForm.ts:37
+#: src/pages/users/UserForm.ts:42
 msgid "Successfully updated user."
 msgstr "Successfully updated user."
 
@@ -3321,7 +3321,7 @@ msgstr "Superuser-groups"
 msgid "Superusers"
 msgstr "Superusers"
 
-#: src/pages/policies/password/PasswordPolicyForm.ts:123
+#: src/pages/policies/password/PasswordPolicyForm.ts:121
 msgid "Symbol charset"
 msgstr "Symbol charset"
 
@@ -3374,7 +3374,7 @@ msgstr "Task finished with errors"
 msgid "Task finished with warnings"
 msgstr "Task finished with warnings"
 
-#: src/pages/stages/email/EmailStageForm.ts:158
+#: src/pages/stages/email/EmailStageForm.ts:159
 msgid "Template"
 msgstr "Template"
 
@@ -3394,7 +3394,7 @@ msgstr "Test Policy"
 msgid "Test Property Mapping"
 msgstr "Test Property Mapping"
 
-#: src/pages/stages/prompt/PromptForm.ts:45
+#: src/pages/stages/prompt/PromptForm.ts:50
 msgid "Text: Simple Text input"
 msgstr "Text: Simple Text input"
 
@@ -3440,19 +3440,19 @@ msgstr ""
 msgid "These policies control which users can access this application."
 msgstr "These policies control which users can access this application."
 
-#: src/pages/stages/invitation/InvitationStageForm.ts:53
+#: src/pages/stages/invitation/InvitationStageForm.ts:51
 msgid "This stage can be included in enrollment flows to accept invitations."
 msgstr "This stage can be included in enrollment flows to accept invitations."
 
-#: src/pages/stages/captcha/CaptchaStageForm.ts:52
+#: src/pages/stages/captcha/CaptchaStageForm.ts:50
 msgid "This stage checks the user's current session against the Google reCaptcha service."
 msgstr "This stage checks the user's current session against the Google reCaptcha service."
 
-#: src/pages/policies/reputation/ReputationPolicyForm.ts:94
+#: src/pages/policies/reputation/ReputationPolicyForm.ts:92
 msgid "Threshold"
 msgstr "Threshold"
 
-#: src/pages/stages/email/EmailStageForm.ts:149
+#: src/pages/stages/email/EmailStageForm.ts:150
 msgid "Time in minutes the token sent is valid."
 msgstr "Time in minutes the token sent is valid."
 
@@ -3466,7 +3466,7 @@ msgstr "Time-based One-Time Passwords"
 
 #: src/pages/policies/BoundPoliciesList.ts:43
 #: src/pages/policies/PolicyBindingForm.ts:210
-#: src/pages/stages/email/EmailStageForm.ts:101
+#: src/pages/stages/email/EmailStageForm.ts:102
 msgid "Timeout"
 msgstr "Timeout"
 
@@ -3484,11 +3484,11 @@ msgstr "Token"
 msgid "Token URL"
 msgstr "Token URL"
 
-#: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts:68
+#: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts:66
 msgid "Token count"
 msgstr "Token count"
 
-#: src/pages/stages/email/EmailStageForm.ts:145
+#: src/pages/stages/email/EmailStageForm.ts:146
 msgid "Token expiry"
 msgstr "Token expiry"
 
@@ -3542,7 +3542,7 @@ msgstr "Transports"
 #: src/pages/property-mappings/PropertyMappingListPage.ts:55
 #: src/pages/providers/ProviderListPage.ts:55
 #: src/pages/sources/SourcesListPage.ts:53
-#: src/pages/stages/prompt/PromptForm.ts:97
+#: src/pages/stages/prompt/PromptForm.ts:102
 #: src/pages/stages/prompt/PromptListPage.ts:48
 msgid "Type"
 msgstr "Type"
@@ -3751,11 +3751,11 @@ msgstr "Update {0}"
 msgid "Upstream host that the requests are forwarded to."
 msgstr "Upstream host that the requests are forwarded to."
 
-#: src/pages/stages/email/EmailStageForm.ts:96
+#: src/pages/stages/email/EmailStageForm.ts:97
 msgid "Use SSL"
 msgstr "Use SSL"
 
-#: src/pages/stages/email/EmailStageForm.ts:88
+#: src/pages/stages/email/EmailStageForm.ts:89
 msgid "Use TLS"
 msgstr "Use TLS"
 
@@ -3767,7 +3767,7 @@ msgstr "Use a code-based authenticator."
 msgid "Use a security key to prove your identity."
 msgstr "Use a security key to prove your identity."
 
-#: src/pages/stages/email/EmailStageForm.ts:139
+#: src/pages/stages/email/EmailStageForm.ts:140
 msgid "Use global settings"
 msgstr "Use global settings"
 
@@ -3821,7 +3821,7 @@ msgid "User events"
 msgstr "User events"
 
 #: src/pages/stages/authenticator_validate/AuthenticatorValidateStageForm.ts:99
-#: src/pages/stages/identification/IdentificationStageForm.ts:74
+#: src/pages/stages/identification/IdentificationStageForm.ts:72
 msgid "User fields"
 msgstr "User fields"
 
@@ -3848,7 +3848,7 @@ msgid "User's avatar"
 msgstr "User's avatar"
 
 #: src/pages/user-settings/UserDetailsPage.ts:68
-#: src/pages/users/UserForm.ts:58
+#: src/pages/users/UserForm.ts:63
 msgid "User's display name."
 msgstr "User's display name."
 
@@ -3865,14 +3865,14 @@ msgid "Userinfo URL"
 msgstr "Userinfo URL"
 
 #: src/flows/stages/identification/IdentificationStage.ts:150
-#: src/pages/stages/identification/IdentificationStageForm.ts:78
+#: src/pages/stages/identification/IdentificationStageForm.ts:76
 #: src/pages/user-settings/UserDetailsPage.ts:57
-#: src/pages/users/UserForm.ts:47
+#: src/pages/users/UserForm.ts:52
 #: src/pages/users/UserViewPage.ts:84
 msgid "Username"
 msgstr "Username"
 
-#: src/pages/stages/prompt/PromptForm.ts:48
+#: src/pages/stages/prompt/PromptForm.ts:53
 msgid "Username: Same as Text input, but checks for and prevents duplicate usernames."
 msgstr "Username: Same as Text input, but checks for and prevents duplicate usernames."
 
@@ -3906,11 +3906,11 @@ msgstr "Valid redirect URLs after a successful authorization flow. Also specify
 msgid "Validate SSL Certificates of upstream servers."
 msgstr "Validate SSL Certificates of upstream servers."
 
-#: src/pages/stages/password/PasswordStageForm.ts:60
+#: src/pages/stages/password/PasswordStageForm.ts:58
 msgid "Validate the user's password against the selected backend(s)."
 msgstr "Validate the user's password against the selected backend(s)."
 
-#: src/pages/stages/prompt/PromptStageForm.ts:103
+#: src/pages/stages/prompt/PromptStageForm.ts:101
 msgid "Validation Policies"
 msgstr "Validation Policies"
 
@@ -3922,7 +3922,7 @@ msgstr "Validity days"
 msgid "Verification Certificate"
 msgstr "Verification Certificate"
 
-#: src/pages/stages/email/EmailStageForm.ts:119
+#: src/pages/stages/email/EmailStageForm.ts:120
 msgid "Verify the user's email address by sending them a one-time-link. Can also be used for recovery to verify the user's authenticity."
 msgstr "Verify the user's email address by sending them a one-time-link. Can also be used for recovery to verify the user's authenticity."
 
@@ -3987,19 +3987,19 @@ msgstr "Webhook (generic)"
 msgid "Webhook URL"
 msgstr "Webhook URL"
 
-#: src/pages/stages/identification/IdentificationStageForm.ts:103
+#: src/pages/stages/identification/IdentificationStageForm.ts:101
 msgid "When a valid username/email has been entered, and this option is enabled, the user's username and avatar will be shown. Otherwise, the text that the user entered will be shown."
 msgstr "When a valid username/email has been entered, and this option is enabled, the user's username and avatar will be shown. Otherwise, the text that the user entered will be shown."
 
-#: src/pages/stages/email/EmailStageForm.ts:142
+#: src/pages/stages/email/EmailStageForm.ts:143
 msgid "When enabled, global Email connection settings will be used and connection settings below will be ignored."
 msgstr "When enabled, global Email connection settings will be used and connection settings below will be ignored."
 
-#: src/pages/stages/invitation/InvitationForm.ts:66
+#: src/pages/stages/invitation/InvitationForm.ts:71
 msgid "When enabled, the invitation will be deleted after usage."
 msgstr "When enabled, the invitation will be deleted after usage."
 
-#: src/pages/stages/identification/IdentificationStageForm.ts:94
+#: src/pages/stages/identification/IdentificationStageForm.ts:92
 msgid "When enabled, user fields are matched regardless of their casing."
 msgstr "When enabled, user fields are matched regardless of their casing."
 
@@ -4008,12 +4008,12 @@ msgid "When selected, incoming assertion's Signatures will be validated against
 msgstr "When selected, incoming assertion's Signatures will be validated against this certificate. To allow unsigned Requests, leave on default."
 
 #: src/pages/policies/dummy/DummyPolicyForm.ts:67
-#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:70
-#: src/pages/policies/expiry/ExpiryPolicyForm.ts:69
-#: src/pages/policies/expression/ExpressionPolicyForm.ts:70
-#: src/pages/policies/hibp/HaveIBeenPwnedPolicyForm.ts:70
-#: src/pages/policies/password/PasswordPolicyForm.ts:69
-#: src/pages/policies/reputation/ReputationPolicyForm.ts:69
+#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:68
+#: src/pages/policies/expiry/ExpiryPolicyForm.ts:67
+#: src/pages/policies/expression/ExpressionPolicyForm.ts:68
+#: src/pages/policies/hibp/HaveIBeenPwnedPolicyForm.ts:68
+#: src/pages/policies/password/PasswordPolicyForm.ts:67
+#: src/pages/policies/reputation/ReputationPolicyForm.ts:67
 msgid "When this option is enabled, all executions of this policy will be logged. By default, only execution errors are logged."
 msgstr "When this option is enabled, all executions of this policy will be logged. By default, only execution errors are logged."
 
@@ -4029,7 +4029,7 @@ msgstr "Windows"
 msgid "Workers"
 msgstr "Workers"
 
-#: src/pages/stages/user_write/UserWriteStageForm.ts:51
+#: src/pages/stages/user_write/UserWriteStageForm.ts:49
 msgid ""
 "Write any data from the flow's context's 'prompt_data' to the currently pending user. If no user\n"
 "is pending, a new user is created, and data is written to them."
@@ -4058,11 +4058,11 @@ msgstr "Yes"
 msgid "You're currently impersonating {0}."
 msgstr "You're currently impersonating {0}."
 
-#: src/pages/stages/password/PasswordStageForm.ts:79
+#: src/pages/stages/password/PasswordStageForm.ts:77
 msgid "authentik Builtin Database"
 msgstr "authentik Builtin Database"
 
-#: src/pages/stages/password/PasswordStageForm.ts:82
+#: src/pages/stages/password/PasswordStageForm.ts:80
 msgid "authentik LDAP Backend"
 msgstr "authentik LDAP Backend"
 
@@ -4075,11 +4075,11 @@ msgstr "no tabs defined"
 msgid "{0}"
 msgstr "{0}"
 
-#: src/pages/stages/prompt/PromptStageForm.ts:82
+#: src/pages/stages/prompt/PromptStageForm.ts:80
 msgid "{0} (\"{1}\", of type {2})"
 msgstr "{0} (\"{1}\", of type {2})"
 
-#: src/pages/stages/prompt/PromptStageForm.ts:115
+#: src/pages/stages/prompt/PromptStageForm.ts:113
 msgid "{0} ({1})"
 msgstr "{0} ({1})"
 
diff --git a/web/src/locales/pseudo-LOCALE.po b/web/src/locales/pseudo-LOCALE.po
index 4fa139ff7..80adb8ca2 100644
--- a/web/src/locales/pseudo-LOCALE.po
+++ b/web/src/locales/pseudo-LOCALE.po
@@ -16,7 +16,7 @@ msgstr ""
 #: src/pages/providers/oauth2/OAuth2ProviderForm.ts:141
 #: src/pages/providers/oauth2/OAuth2ProviderForm.ts:149
 #: src/pages/providers/saml/SAMLProviderForm.ts:201
-#: src/pages/stages/user_login/UserLoginStageForm.ts:71
+#: src/pages/stages/user_login/UserLoginStageForm.ts:69
 msgid "(Format: hours=-1;minutes=-2;seconds=-3)."
 msgstr ""
 
@@ -24,11 +24,11 @@ msgstr ""
 msgid "-"
 msgstr ""
 
-#: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts:72
+#: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts:70
 msgid "6 digits, widely compatible"
 msgstr ""
 
-#: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts:75
+#: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts:73
 msgid "8 digits, not compatible with apps like Google Authenticator"
 msgstr ""
 
@@ -86,7 +86,7 @@ msgstr ""
 #: src/elements/events/ObjectChangelog.ts:38
 #: src/elements/events/UserEvents.ts:35
 #: src/pages/events/EventListPage.ts:43
-#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:79
+#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:77
 msgid "Action"
 msgstr ""
 
@@ -123,7 +123,7 @@ msgstr ""
 msgid "Advanced protocol settings"
 msgstr ""
 
-#: src/pages/policies/password/PasswordPolicyForm.ts:119
+#: src/pages/policies/password/PasswordPolicyForm.ts:117
 #: src/pages/sources/ldap/LDAPSourceForm.ts:138
 msgid "Advanced settings"
 msgstr ""
@@ -148,7 +148,7 @@ msgstr ""
 msgid "Allow friends to authenticate via Plex, even if you don't share any servers"
 msgstr ""
 
-#: src/pages/policies/hibp/HaveIBeenPwnedPolicyForm.ts:90
+#: src/pages/policies/hibp/HaveIBeenPwnedPolicyForm.ts:88
 msgid "Allow up to N occurrences in the HIBP database."
 msgstr ""
 
@@ -156,7 +156,7 @@ msgstr ""
 msgid "Allow users to use Applications based on properties, enforce Password Criteria and selectively apply Stages."
 msgstr ""
 
-#: src/pages/policies/hibp/HaveIBeenPwnedPolicyForm.ts:86
+#: src/pages/policies/hibp/HaveIBeenPwnedPolicyForm.ts:84
 msgid "Allowed count"
 msgstr ""
 
@@ -168,7 +168,7 @@ msgstr ""
 msgid "Allows authentication flows initiated by the IdP. This can be a security risk, as no validation of the request ID is done."
 msgstr ""
 
-#: src/pages/policies/reputation/ReputationPolicyForm.ts:53
+#: src/pages/policies/reputation/ReputationPolicyForm.ts:51
 msgid "Allows/denys requests based on the users and/or the IPs reputation."
 msgstr ""
 
@@ -181,7 +181,7 @@ msgid "Always require consent"
 msgstr ""
 
 #: src/pages/events/EventInfo.ts:59
-#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:99
+#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:97
 msgid "App"
 msgstr ""
 
@@ -259,8 +259,8 @@ msgid "Attribute name used for SAML Assertions. Can be a URN OID, a schema refer
 msgstr ""
 
 #: src/pages/groups/GroupForm.ts:139
-#: src/pages/stages/invitation/InvitationForm.ts:52
-#: src/pages/users/UserForm.ts:77
+#: src/pages/stages/invitation/InvitationForm.ts:57
+#: src/pages/users/UserForm.ts:82
 msgid "Attributes"
 msgstr ""
 
@@ -316,7 +316,7 @@ msgstr ""
 msgid "Authorized application:"
 msgstr ""
 
-#: src/pages/stages/password/PasswordStageForm.ts:74
+#: src/pages/stages/password/PasswordStageForm.ts:72
 msgid "Backends"
 msgstr ""
 
@@ -431,7 +431,7 @@ msgstr ""
 msgid "Cancel"
 msgstr ""
 
-#: src/pages/stages/identification/IdentificationStageForm.ts:91
+#: src/pages/stages/identification/IdentificationStageForm.ts:89
 msgid "Case insensitive matching"
 msgstr ""
 
@@ -490,15 +490,15 @@ msgstr ""
 msgid "Changelog"
 msgstr ""
 
-#: src/pages/policies/password/PasswordPolicyForm.ts:127
+#: src/pages/policies/password/PasswordPolicyForm.ts:125
 msgid "Characters which are considered as symbols."
 msgstr ""
 
-#: src/pages/policies/reputation/ReputationPolicyForm.ts:81
+#: src/pages/policies/reputation/ReputationPolicyForm.ts:79
 msgid "Check IP"
 msgstr ""
 
-#: src/pages/policies/reputation/ReputationPolicyForm.ts:89
+#: src/pages/policies/reputation/ReputationPolicyForm.ts:87
 msgid "Check Username"
 msgstr ""
 
@@ -506,21 +506,21 @@ msgstr ""
 msgid "Check your Emails for a password reset link."
 msgstr ""
 
-#: src/pages/stages/prompt/PromptForm.ts:60
+#: src/pages/stages/prompt/PromptForm.ts:65
 msgid "Checkbox"
 msgstr ""
 
-#: src/pages/policies/hibp/HaveIBeenPwnedPolicyForm.ts:53
+#: src/pages/policies/hibp/HaveIBeenPwnedPolicyForm.ts:51
 msgid ""
 "Checks a value from the policy request against the Have I been Pwned API, and denys the request based upon that.\n"
 "Note that only a part of the hash of the password is sent, the full comparison is done clientside."
 msgstr ""
 
-#: src/pages/policies/expiry/ExpiryPolicyForm.ts:53
+#: src/pages/policies/expiry/ExpiryPolicyForm.ts:51
 msgid "Checks if the request's user's password has been changed in the last x days, and denys based on settings."
 msgstr ""
 
-#: src/pages/policies/password/PasswordPolicyForm.ts:53
+#: src/pages/policies/password/PasswordPolicyForm.ts:51
 msgid "Checks the value from the policy request against several rules, mostly used to ensure password strength."
 msgstr ""
 
@@ -541,7 +541,7 @@ msgstr ""
 #: src/elements/events/ObjectChangelog.ts:41
 #: src/elements/events/UserEvents.ts:38
 #: src/pages/events/EventListPage.ts:46
-#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:93
+#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:91
 msgid "Client IP"
 msgstr ""
 
@@ -579,10 +579,10 @@ msgstr ""
 msgid "Configuration"
 msgstr ""
 
-#: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts:74
-#: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts:80
+#: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts:72
+#: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts:78
 #: src/pages/stages/authenticator_validate/AuthenticatorValidateStageForm.ts:118
-#: src/pages/stages/password/PasswordStageForm.ts:89
+#: src/pages/stages/password/PasswordStageForm.ts:87
 msgid "Configuration flow"
 msgstr ""
 
@@ -631,7 +631,7 @@ msgid "Connection error, reconnecting..."
 msgstr ""
 
 #: src/pages/sources/ldap/LDAPSourceForm.ts:98
-#: src/pages/stages/email/EmailStageForm.ts:58
+#: src/pages/stages/email/EmailStageForm.ts:59
 msgid "Connection settings"
 msgstr ""
 
@@ -687,7 +687,7 @@ msgstr ""
 msgid "Continue"
 msgstr ""
 
-#: src/pages/stages/invitation/InvitationStageForm.ts:70
+#: src/pages/stages/invitation/InvitationStageForm.ts:68
 msgid "Continue flow without invitation"
 msgstr ""
 
@@ -743,8 +743,8 @@ msgstr ""
 #: src/pages/stages/invitation/InvitationListPage.ts:85
 #: src/pages/stages/prompt/PromptListPage.ts:96
 #: src/pages/stages/prompt/PromptListPage.ts:104
-#: src/pages/stages/prompt/PromptStageForm.ts:90
-#: src/pages/stages/prompt/PromptStageForm.ts:98
+#: src/pages/stages/prompt/PromptStageForm.ts:88
+#: src/pages/stages/prompt/PromptStageForm.ts:96
 #: src/pages/user-settings/tokens/UserTokenList.ts:50
 #: src/pages/user-settings/tokens/UserTokenList.ts:58
 #: src/pages/users/UserListPage.ts:155
@@ -801,7 +801,7 @@ msgid "Create Policy"
 msgstr ""
 
 #: src/pages/stages/prompt/PromptListPage.ts:99
-#: src/pages/stages/prompt/PromptStageForm.ts:93
+#: src/pages/stages/prompt/PromptStageForm.ts:91
 msgid "Create Prompt"
 msgstr ""
 
@@ -861,11 +861,11 @@ msgstr ""
 msgid "DSA-SHA1"
 msgstr ""
 
-#: src/pages/stages/prompt/PromptForm.ts:63
+#: src/pages/stages/prompt/PromptForm.ts:68
 msgid "Date"
 msgstr ""
 
-#: src/pages/stages/prompt/PromptForm.ts:66
+#: src/pages/stages/prompt/PromptForm.ts:71
 msgid "Date Time"
 msgstr ""
 
@@ -925,7 +925,7 @@ msgstr ""
 msgid "Delete temporary users after"
 msgstr ""
 
-#: src/pages/stages/user_delete/UserDeleteStageForm.ts:51
+#: src/pages/stages/user_delete/UserDeleteStageForm.ts:49
 msgid ""
 "Delete the currently pending user. CAUTION, this stage does not ask for\n"
 "confirmation. Use a consent stage to ensure the user is aware of their actions."
@@ -942,7 +942,7 @@ msgstr ""
 #: src/pages/applications/ApplicationForm.ts:175
 #: src/pages/property-mappings/PropertyMappingScopeForm.ts:63
 #: src/pages/system-tasks/SystemTaskListPage.ts:55
-#: src/pages/user-settings/tokens/UserTokenForm.ts:50
+#: src/pages/user-settings/tokens/UserTokenForm.ts:55
 msgid "Description"
 msgstr ""
 
@@ -950,7 +950,7 @@ msgstr ""
 msgid "Description shown to the user when consenting. If left empty, the user won't be informed."
 msgstr ""
 
-#: src/pages/users/UserForm.ts:74
+#: src/pages/users/UserForm.ts:79
 msgid "Designates whether this user should be treated as active. Unselect this instead of deleting accounts."
 msgstr ""
 
@@ -963,7 +963,7 @@ msgstr ""
 msgid "Determines how authentik sends the response back to the Service Provider."
 msgstr ""
 
-#: src/pages/stages/user_login/UserLoginStageForm.ts:70
+#: src/pages/stages/user_login/UserLoginStageForm.ts:68
 msgid "Determines how long a session lasts. Default of 0 seconds means that the sessions lasts until the browser is closed."
 msgstr ""
 
@@ -980,7 +980,7 @@ msgstr ""
 msgid "Digest algorithm"
 msgstr ""
 
-#: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts:67
+#: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts:65
 msgid "Digits"
 msgstr ""
 
@@ -1014,7 +1014,7 @@ msgstr ""
 msgid "Download"
 msgstr ""
 
-#: src/pages/stages/dummy/DummyStageForm.ts:51
+#: src/pages/stages/dummy/DummyStageForm.ts:49
 msgid "Dummy stage used for testing. Shows a simple continue button and always passes."
 msgstr ""
 
@@ -1079,9 +1079,9 @@ msgstr ""
 
 #: src/flows/stages/identification/IdentificationStage.ts:146
 #: src/pages/events/TransportForm.ts:51
-#: src/pages/stages/identification/IdentificationStageForm.ts:81
+#: src/pages/stages/identification/IdentificationStageForm.ts:79
 #: src/pages/user-settings/UserDetailsPage.ts:71
-#: src/pages/users/UserForm.ts:61
+#: src/pages/users/UserForm.ts:66
 #: src/pages/users/UserViewPage.ts:100
 msgid "Email"
 msgstr ""
@@ -1094,7 +1094,7 @@ msgstr ""
 msgid "Email or username"
 msgstr ""
 
-#: src/pages/stages/prompt/PromptForm.ts:51
+#: src/pages/stages/prompt/PromptForm.ts:56
 msgid "Email: Text field with Email type."
 msgstr ""
 
@@ -1139,7 +1139,7 @@ msgstr ""
 #: src/pages/sources/oauth/OAuthSourceForm.ts:252
 #: src/pages/sources/plex/PlexSourceForm.ts:206
 #: src/pages/sources/saml/SAMLSourceForm.ts:264
-#: src/pages/stages/identification/IdentificationStageForm.ts:106
+#: src/pages/stages/identification/IdentificationStageForm.ts:104
 msgid "Enrollment flow"
 msgstr ""
 
@@ -1151,7 +1151,7 @@ msgstr ""
 msgid "Error creating credential: {err}"
 msgstr ""
 
-#: src/pages/policies/password/PasswordPolicyForm.ts:110
+#: src/pages/policies/password/PasswordPolicyForm.ts:108
 msgid "Error message"
 msgstr ""
 
@@ -1213,24 +1213,24 @@ msgstr ""
 msgid "Execute flow"
 msgstr ""
 
-#: src/pages/policies/expression/ExpressionPolicyForm.ts:54
+#: src/pages/policies/expression/ExpressionPolicyForm.ts:52
 msgid "Executes the python snippet to determine whether to allow or deny a request."
 msgstr ""
 
 #: src/pages/policies/dummy/DummyPolicyForm.ts:63
-#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:66
-#: src/pages/policies/expiry/ExpiryPolicyForm.ts:65
-#: src/pages/policies/expression/ExpressionPolicyForm.ts:66
-#: src/pages/policies/hibp/HaveIBeenPwnedPolicyForm.ts:66
-#: src/pages/policies/password/PasswordPolicyForm.ts:65
-#: src/pages/policies/reputation/ReputationPolicyForm.ts:65
+#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:64
+#: src/pages/policies/expiry/ExpiryPolicyForm.ts:63
+#: src/pages/policies/expression/ExpressionPolicyForm.ts:64
+#: src/pages/policies/hibp/HaveIBeenPwnedPolicyForm.ts:64
+#: src/pages/policies/password/PasswordPolicyForm.ts:63
+#: src/pages/policies/reputation/ReputationPolicyForm.ts:63
 msgid "Execution logging"
 msgstr ""
 
 #: src/elements/oauth/UserCodeList.ts:30
 #: src/elements/oauth/UserRefreshList.ts:30
 #: src/elements/user/UserConsentList.ts:30
-#: src/pages/stages/invitation/InvitationForm.ts:46
+#: src/pages/stages/invitation/InvitationForm.ts:51
 msgid "Expires"
 msgstr ""
 
@@ -1261,14 +1261,14 @@ msgid "Export"
 msgstr ""
 
 #: src/pages/events/EventInfo.ts:133
-#: src/pages/policies/expression/ExpressionPolicyForm.ts:79
+#: src/pages/policies/expression/ExpressionPolicyForm.ts:77
 #: src/pages/property-mappings/PropertyMappingLDAPForm.ts:63
 #: src/pages/property-mappings/PropertyMappingSAMLForm.ts:73
 #: src/pages/property-mappings/PropertyMappingScopeForm.ts:70
 msgid "Expression"
 msgstr ""
 
-#: src/pages/policies/expression/ExpressionPolicyForm.ts:85
+#: src/pages/policies/expression/ExpressionPolicyForm.ts:83
 #: src/pages/property-mappings/PropertyMappingLDAPForm.ts:69
 #: src/pages/property-mappings/PropertyMappingSAMLForm.ts:79
 #: src/pages/property-mappings/PropertyMappingScopeForm.ts:76
@@ -1287,7 +1287,7 @@ msgstr ""
 msgid "External host"
 msgstr ""
 
-#: src/pages/stages/password/PasswordStageForm.ts:111
+#: src/pages/stages/password/PasswordStageForm.ts:109
 msgid "Failed attempts before cancel"
 msgstr ""
 
@@ -1307,12 +1307,12 @@ msgstr ""
 msgid "Field"
 msgstr ""
 
-#: src/pages/stages/prompt/PromptForm.ts:83
+#: src/pages/stages/prompt/PromptForm.ts:88
 msgid "Field Key"
 msgstr ""
 
-#: src/pages/policies/hibp/HaveIBeenPwnedPolicyForm.ts:83
-#: src/pages/policies/password/PasswordPolicyForm.ts:82
+#: src/pages/policies/hibp/HaveIBeenPwnedPolicyForm.ts:81
+#: src/pages/policies/password/PasswordPolicyForm.ts:80
 msgid "Field key to check, field keys defined in Prompt stages are available."
 msgstr ""
 
@@ -1328,11 +1328,11 @@ msgstr ""
 msgid "Field which contains members of a group."
 msgstr ""
 
-#: src/pages/stages/prompt/PromptStageForm.ts:69
+#: src/pages/stages/prompt/PromptStageForm.ts:67
 msgid "Fields"
 msgstr ""
 
-#: src/pages/stages/identification/IdentificationStageForm.ts:84
+#: src/pages/stages/identification/IdentificationStageForm.ts:82
 msgid "Fields a user can identify themselves with. If no fields are selected, the user will only be able to use sources."
 msgstr ""
 
@@ -1367,12 +1367,12 @@ msgstr ""
 msgid "Flow used before authentication."
 msgstr ""
 
-#: src/pages/stages/password/PasswordStageForm.ts:108
+#: src/pages/stages/password/PasswordStageForm.ts:106
 msgid "Flow used by an authenticated user to configure their password. If empty, user will not be able to configure change their password."
 msgstr ""
 
-#: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts:93
-#: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts:98
+#: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts:91
+#: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts:96
 msgid "Flow used by an authenticated user to configure this Stage. If empty, user will not be able to configure this stage."
 msgstr ""
 
@@ -1419,7 +1419,7 @@ msgstr ""
 msgid "Friendly Name"
 msgstr ""
 
-#: src/pages/stages/email/EmailStageForm.ts:107
+#: src/pages/stages/email/EmailStageForm.ts:108
 msgid "From address"
 msgstr ""
 
@@ -1502,7 +1502,7 @@ msgstr ""
 msgid "Healthy sources"
 msgstr ""
 
-#: src/pages/stages/prompt/PromptForm.ts:72
+#: src/pages/stages/prompt/PromptForm.ts:77
 msgid "Hidden: Hidden field, can be used to insert data into form."
 msgstr ""
 
@@ -1523,14 +1523,14 @@ msgstr ""
 #: src/pages/sources/ldap/LDAPSourceForm.ts:191
 #: src/pages/sources/plex/PlexSourceForm.ts:168
 #: src/pages/stages/authenticator_validate/AuthenticatorValidateStageForm.ts:114
-#: src/pages/stages/identification/IdentificationStageForm.ts:85
-#: src/pages/stages/password/PasswordStageForm.ts:86
-#: src/pages/stages/prompt/PromptStageForm.ts:87
-#: src/pages/stages/prompt/PromptStageForm.ts:121
+#: src/pages/stages/identification/IdentificationStageForm.ts:83
+#: src/pages/stages/password/PasswordStageForm.ts:84
+#: src/pages/stages/prompt/PromptStageForm.ts:85
+#: src/pages/stages/prompt/PromptStageForm.ts:119
 msgid "Hold control/command to select multiple items."
 msgstr ""
 
-#: src/pages/stages/password/PasswordStageForm.ts:115
+#: src/pages/stages/password/PasswordStageForm.ts:113
 msgid "How many attempts a user has before the flow is canceled. To lock the user out, use a reputation policy and a user_write stage."
 msgstr ""
 
@@ -1545,7 +1545,7 @@ msgstr ""
 #: src/pages/flows/FlowListPage.ts:46
 #: src/pages/system-tasks/SystemTaskListPage.ts:54
 #: src/pages/tokens/TokenListPage.ts:44
-#: src/pages/user-settings/tokens/UserTokenForm.ts:44
+#: src/pages/user-settings/tokens/UserTokenForm.ts:49
 #: src/pages/user-settings/tokens/UserTokenList.ts:39
 msgid "Identifier"
 msgstr ""
@@ -1563,7 +1563,7 @@ msgstr ""
 msgid "If left empty, authentik will try to extract the launch URL based on the selected provider."
 msgstr ""
 
-#: src/pages/stages/invitation/InvitationStageForm.ts:73
+#: src/pages/stages/invitation/InvitationStageForm.ts:71
 msgid "If this flag is set, this Stage will jump to the next Stage when no Invitation is given. By default this Stage will cancel the Flow when no invitation is given."
 msgstr ""
 
@@ -1625,7 +1625,7 @@ msgstr ""
 msgid "Invitations"
 msgstr ""
 
-#: src/pages/users/UserForm.ts:71
+#: src/pages/users/UserForm.ts:76
 msgid "Is active"
 msgstr ""
 
@@ -1672,12 +1672,12 @@ msgstr ""
 msgid "LDAP Sync status"
 msgstr ""
 
-#: src/pages/stages/prompt/PromptForm.ts:90
+#: src/pages/stages/prompt/PromptForm.ts:95
 #: src/pages/stages/prompt/PromptListPage.ts:47
 msgid "Label"
 msgstr ""
 
-#: src/pages/stages/prompt/PromptForm.ts:94
+#: src/pages/stages/prompt/PromptForm.ts:99
 msgid "Label shown next to/above the prompt."
 msgstr ""
 
@@ -1708,7 +1708,7 @@ msgstr ""
 msgid "Launch URL"
 msgstr ""
 
-#: src/pages/stages/identification/IdentificationStageForm.ts:60
+#: src/pages/stages/identification/IdentificationStageForm.ts:58
 msgid "Let the user identify themselves with their username or Email address."
 msgstr ""
 
@@ -1775,8 +1775,8 @@ msgstr ""
 #: src/pages/policies/PolicyBindingForm.ts:173
 #: src/pages/policies/PolicyBindingForm.ts:189
 #: src/pages/policies/PolicyTestForm.ts:71
-#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:88
-#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:108
+#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:86
+#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:106
 #: src/pages/property-mappings/PropertyMappingTestForm.ts:61
 #: src/pages/providers/ldap/LDAPProviderForm.ts:70
 #: src/pages/providers/ldap/LDAPProviderForm.ts:84
@@ -1802,15 +1802,15 @@ msgstr ""
 #: src/pages/sources/saml/SAMLSourceForm.ts:238
 #: src/pages/sources/saml/SAMLSourceForm.ts:259
 #: src/pages/sources/saml/SAMLSourceForm.ts:280
-#: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts:90
-#: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts:96
+#: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts:88
+#: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts:94
 #: src/pages/stages/authenticator_validate/AuthenticatorValidateStageForm.ts:131
-#: src/pages/stages/email/EmailStageForm.ts:170
-#: src/pages/stages/identification/IdentificationStageForm.ts:119
-#: src/pages/stages/identification/IdentificationStageForm.ts:137
-#: src/pages/stages/password/PasswordStageForm.ts:106
-#: src/pages/stages/prompt/PromptStageForm.ts:85
-#: src/pages/stages/prompt/PromptStageForm.ts:118
+#: src/pages/stages/email/EmailStageForm.ts:171
+#: src/pages/stages/identification/IdentificationStageForm.ts:117
+#: src/pages/stages/identification/IdentificationStageForm.ts:135
+#: src/pages/stages/password/PasswordStageForm.ts:104
+#: src/pages/stages/prompt/PromptStageForm.ts:83
+#: src/pages/stages/prompt/PromptStageForm.ts:116
 msgid "Loading..."
 msgstr ""
 
@@ -1820,7 +1820,7 @@ msgstr ""
 msgid "Local"
 msgstr ""
 
-#: src/pages/stages/user_login/UserLoginStageForm.ts:52
+#: src/pages/stages/user_login/UserLoginStageForm.ts:50
 msgid "Log the currently pending user in."
 msgstr ""
 
@@ -1853,23 +1853,23 @@ msgstr ""
 msgid "Long-running operations which authentik executes in the background."
 msgstr ""
 
-#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:90
+#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:88
 msgid "Match created events with this action type. When left empty, all action types will be matched."
 msgstr ""
 
-#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:110
+#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:108
 msgid "Match events created by selected application. When left empty, all applications are matched."
 msgstr ""
 
-#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:96
+#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:94
 msgid "Matches Event's Client IP (strict matching, for network matching use an Expression Policy."
 msgstr ""
 
-#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:54
+#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:52
 msgid "Matches an event against a set of criteria. If any of the configured values match, the policy passes."
 msgstr ""
 
-#: src/pages/policies/expiry/ExpiryPolicyForm.ts:78
+#: src/pages/policies/expiry/ExpiryPolicyForm.ts:76
 msgid "Maximum age (in days)"
 msgstr ""
 
@@ -1891,19 +1891,19 @@ msgstr ""
 msgid "Metadata"
 msgstr ""
 
-#: src/pages/policies/password/PasswordPolicyForm.ts:98
+#: src/pages/policies/password/PasswordPolicyForm.ts:96
 msgid "Minimum amount of Lowercase Characters"
 msgstr ""
 
-#: src/pages/policies/password/PasswordPolicyForm.ts:104
+#: src/pages/policies/password/PasswordPolicyForm.ts:102
 msgid "Minimum amount of Symbols Characters"
 msgstr ""
 
-#: src/pages/policies/password/PasswordPolicyForm.ts:92
+#: src/pages/policies/password/PasswordPolicyForm.ts:90
 msgid "Minimum amount of Uppercase Characters"
 msgstr ""
 
-#: src/pages/policies/password/PasswordPolicyForm.ts:86
+#: src/pages/policies/password/PasswordPolicyForm.ts:84
 msgid "Minimum length"
 msgstr ""
 
@@ -1947,12 +1947,12 @@ msgstr ""
 #: src/pages/outposts/ServiceConnectionListPage.ts:53
 #: src/pages/policies/PolicyListPage.ts:56
 #: src/pages/policies/dummy/DummyPolicyForm.ts:54
-#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:57
-#: src/pages/policies/expiry/ExpiryPolicyForm.ts:56
-#: src/pages/policies/expression/ExpressionPolicyForm.ts:57
-#: src/pages/policies/hibp/HaveIBeenPwnedPolicyForm.ts:57
-#: src/pages/policies/password/PasswordPolicyForm.ts:56
-#: src/pages/policies/reputation/ReputationPolicyForm.ts:56
+#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:55
+#: src/pages/policies/expiry/ExpiryPolicyForm.ts:54
+#: src/pages/policies/expression/ExpressionPolicyForm.ts:55
+#: src/pages/policies/hibp/HaveIBeenPwnedPolicyForm.ts:55
+#: src/pages/policies/password/PasswordPolicyForm.ts:54
+#: src/pages/policies/reputation/ReputationPolicyForm.ts:54
 #: src/pages/property-mappings/PropertyMappingLDAPForm.ts:50
 #: src/pages/property-mappings/PropertyMappingListPage.ts:54
 #: src/pages/property-mappings/PropertyMappingSAMLForm.ts:50
@@ -1977,31 +1977,31 @@ msgstr ""
 #: src/pages/sources/saml/SAMLSourceForm.ts:52
 #: src/pages/sources/saml/SAMLSourceViewPage.ts:66
 #: src/pages/stages/StageListPage.ts:65
-#: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts:57
-#: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts:56
+#: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts:55
+#: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts:54
 #: src/pages/stages/authenticator_validate/AuthenticatorValidateStageForm.ts:64
-#: src/pages/stages/authenticator_webauthn/AuthenticateWebAuthnStageForm.ts:54
-#: src/pages/stages/captcha/CaptchaStageForm.ts:55
+#: src/pages/stages/authenticator_webauthn/AuthenticateWebAuthnStageForm.ts:52
+#: src/pages/stages/captcha/CaptchaStageForm.ts:53
 #: src/pages/stages/consent/ConsentStageForm.ts:57
-#: src/pages/stages/deny/DenyStageForm.ts:54
-#: src/pages/stages/dummy/DummyStageForm.ts:54
-#: src/pages/stages/email/EmailStageForm.ts:122
-#: src/pages/stages/identification/IdentificationStageForm.ts:63
-#: src/pages/stages/invitation/InvitationStageForm.ts:56
-#: src/pages/stages/password/PasswordStageForm.ts:63
-#: src/pages/stages/prompt/PromptStageForm.ts:58
-#: src/pages/stages/user_delete/UserDeleteStageForm.ts:55
-#: src/pages/stages/user_login/UserLoginStageForm.ts:55
-#: src/pages/stages/user_logout/UserLogoutStageForm.ts:54
-#: src/pages/stages/user_write/UserWriteStageForm.ts:55
+#: src/pages/stages/deny/DenyStageForm.ts:52
+#: src/pages/stages/dummy/DummyStageForm.ts:52
+#: src/pages/stages/email/EmailStageForm.ts:123
+#: src/pages/stages/identification/IdentificationStageForm.ts:61
+#: src/pages/stages/invitation/InvitationStageForm.ts:54
+#: src/pages/stages/password/PasswordStageForm.ts:61
+#: src/pages/stages/prompt/PromptStageForm.ts:56
+#: src/pages/stages/user_delete/UserDeleteStageForm.ts:53
+#: src/pages/stages/user_login/UserLoginStageForm.ts:53
+#: src/pages/stages/user_logout/UserLogoutStageForm.ts:52
+#: src/pages/stages/user_write/UserWriteStageForm.ts:53
 #: src/pages/user-settings/UserDetailsPage.ts:64
-#: src/pages/users/UserForm.ts:54
+#: src/pages/users/UserForm.ts:59
 #: src/pages/users/UserListPage.ts:54
 #: src/pages/users/UserViewPage.ts:92
 msgid "Name"
 msgstr ""
 
-#: src/pages/stages/prompt/PromptForm.ts:87
+#: src/pages/stages/prompt/PromptForm.ts:92
 msgid "Name of the form field, also used to store the value."
 msgstr ""
 
@@ -2143,7 +2143,7 @@ msgstr ""
 msgid "Notifications Transport"
 msgstr ""
 
-#: src/pages/stages/prompt/PromptForm.ts:57
+#: src/pages/stages/prompt/PromptForm.ts:62
 msgid "Number"
 msgstr ""
 
@@ -2178,7 +2178,7 @@ msgstr ""
 msgid "On behalf of {0}"
 msgstr ""
 
-#: src/pages/policies/expiry/ExpiryPolicyForm.ts:87
+#: src/pages/policies/expiry/ExpiryPolicyForm.ts:85
 msgid "Only fail the policy, don't invalidate user's password."
 msgstr ""
 
@@ -2206,15 +2206,15 @@ msgstr ""
 msgid "Optional URL if the IDP supports Single-Logout."
 msgstr ""
 
-#: src/pages/stages/invitation/InvitationForm.ts:56
+#: src/pages/stages/invitation/InvitationForm.ts:61
 msgid "Optional data which is loaded into the flow's 'prompt_data' context variable. YAML or JSON."
 msgstr ""
 
-#: src/pages/stages/identification/IdentificationStageForm.ts:121
+#: src/pages/stages/identification/IdentificationStageForm.ts:119
 msgid "Optional enrollment flow, which is linked at the bottom of the page."
 msgstr ""
 
-#: src/pages/stages/identification/IdentificationStageForm.ts:139
+#: src/pages/stages/identification/IdentificationStageForm.ts:137
 msgid "Optional recovery flow, which is linked at the bottom of the page."
 msgstr ""
 
@@ -2222,7 +2222,7 @@ msgstr ""
 msgid "Optional, comma-separated SubjectAlt Names."
 msgstr ""
 
-#: src/pages/stages/prompt/PromptForm.ts:116
+#: src/pages/stages/prompt/PromptForm.ts:121
 msgid "Optionally pre-fill the input value"
 msgstr ""
 
@@ -2234,7 +2234,7 @@ msgstr ""
 #: src/pages/flows/StageBindingForm.ts:115
 #: src/pages/policies/BoundPoliciesList.ts:42
 #: src/pages/policies/PolicyBindingForm.ts:204
-#: src/pages/stages/prompt/PromptForm.ts:119
+#: src/pages/stages/prompt/PromptForm.ts:124
 #: src/pages/stages/prompt/PromptListPage.ts:49
 msgid "Order"
 msgstr ""
@@ -2305,12 +2305,12 @@ msgstr ""
 msgid "Password"
 msgstr ""
 
-#: src/pages/policies/hibp/HaveIBeenPwnedPolicyForm.ts:79
-#: src/pages/policies/password/PasswordPolicyForm.ts:78
+#: src/pages/policies/hibp/HaveIBeenPwnedPolicyForm.ts:77
+#: src/pages/policies/password/PasswordPolicyForm.ts:76
 msgid "Password field"
 msgstr ""
 
-#: src/pages/stages/prompt/PromptForm.ts:54
+#: src/pages/stages/prompt/PromptForm.ts:59
 msgid "Password: Masked input, password is validated against sources. Policies still have to be applied to this Stage. If two of these are used in the same stage, they are ensured to be identical."
 msgstr ""
 
@@ -2318,7 +2318,7 @@ msgstr ""
 msgid "Persistent"
 msgstr ""
 
-#: src/pages/stages/prompt/PromptForm.ts:113
+#: src/pages/stages/prompt/PromptForm.ts:118
 msgid "Placeholder"
 msgstr ""
 
@@ -2376,12 +2376,12 @@ msgid "Policy {0}"
 msgstr ""
 
 #: src/pages/policies/dummy/DummyPolicyForm.ts:72
-#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:75
-#: src/pages/policies/expiry/ExpiryPolicyForm.ts:74
-#: src/pages/policies/expression/ExpressionPolicyForm.ts:75
-#: src/pages/policies/hibp/HaveIBeenPwnedPolicyForm.ts:75
-#: src/pages/policies/password/PasswordPolicyForm.ts:74
-#: src/pages/policies/reputation/ReputationPolicyForm.ts:74
+#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:73
+#: src/pages/policies/expiry/ExpiryPolicyForm.ts:72
+#: src/pages/policies/expression/ExpressionPolicyForm.ts:73
+#: src/pages/policies/hibp/HaveIBeenPwnedPolicyForm.ts:73
+#: src/pages/policies/password/PasswordPolicyForm.ts:72
+#: src/pages/policies/reputation/ReputationPolicyForm.ts:72
 msgid "Policy-specific settings"
 msgstr ""
 
@@ -2406,7 +2406,7 @@ msgid "Pre-authentication flow"
 msgstr ""
 
 #: src/pages/crypto/CertificateKeyPairForm.ts:66
-#: src/pages/stages/captcha/CaptchaStageForm.ts:73
+#: src/pages/stages/captcha/CaptchaStageForm.ts:71
 msgid "Private Key"
 msgstr ""
 
@@ -2414,7 +2414,7 @@ msgstr ""
 msgid "Private key available?"
 msgstr ""
 
-#: src/pages/stages/captcha/CaptchaStageForm.ts:78
+#: src/pages/stages/captcha/CaptchaStageForm.ts:76
 msgid "Private key, acquired from https://www.google.com/recaptcha/intro/v3.html."
 msgstr ""
 
@@ -2504,11 +2504,11 @@ msgstr ""
 msgid "Public"
 msgstr ""
 
-#: src/pages/stages/captcha/CaptchaStageForm.ts:66
+#: src/pages/stages/captcha/CaptchaStageForm.ts:64
 msgid "Public Key"
 msgstr ""
 
-#: src/pages/stages/captcha/CaptchaStageForm.ts:70
+#: src/pages/stages/captcha/CaptchaStageForm.ts:68
 msgid "Public key, acquired from https://www.google.com/recaptcha/intro/v3.html."
 msgstr ""
 
@@ -2552,7 +2552,7 @@ msgstr ""
 msgid "Recovery"
 msgstr ""
 
-#: src/pages/stages/identification/IdentificationStageForm.ts:124
+#: src/pages/stages/identification/IdentificationStageForm.ts:122
 msgid "Recovery flow"
 msgstr ""
 
@@ -2601,7 +2601,7 @@ msgstr ""
 msgid "Reload"
 msgstr ""
 
-#: src/pages/stages/user_logout/UserLogoutStageForm.ts:51
+#: src/pages/stages/user_logout/UserLogoutStageForm.ts:49
 msgid "Remove the user from the current session."
 msgstr ""
 
@@ -2618,12 +2618,12 @@ msgstr ""
 msgid "Request token URL"
 msgstr ""
 
-#: src/pages/stages/prompt/PromptForm.ts:108
+#: src/pages/stages/prompt/PromptForm.ts:113
 msgid "Required"
 msgstr ""
 
 #: src/pages/user-settings/UserDetailsPage.ts:61
-#: src/pages/users/UserForm.ts:51
+#: src/pages/users/UserForm.ts:56
 msgid "Required. 150 characters or fewer. Letters, digits and @/./+/-/_ only."
 msgstr ""
 
@@ -2692,19 +2692,19 @@ msgstr ""
 msgid "SLO URL"
 msgstr ""
 
-#: src/pages/stages/email/EmailStageForm.ts:62
+#: src/pages/stages/email/EmailStageForm.ts:63
 msgid "SMTP Host"
 msgstr ""
 
-#: src/pages/stages/email/EmailStageForm.ts:79
+#: src/pages/stages/email/EmailStageForm.ts:80
 msgid "SMTP Password"
 msgstr ""
 
-#: src/pages/stages/email/EmailStageForm.ts:68
+#: src/pages/stages/email/EmailStageForm.ts:69
 msgid "SMTP Port"
 msgstr ""
 
-#: src/pages/stages/email/EmailStageForm.ts:74
+#: src/pages/stages/email/EmailStageForm.ts:75
 msgid "SMTP Username"
 msgstr ""
 
@@ -2739,7 +2739,7 @@ msgstr ""
 msgid "Secret:"
 msgstr ""
 
-#: src/pages/policies/expression/ExpressionPolicyForm.ts:87
+#: src/pages/policies/expression/ExpressionPolicyForm.ts:85
 #: src/pages/property-mappings/PropertyMappingLDAPForm.ts:71
 #: src/pages/property-mappings/PropertyMappingSAMLForm.ts:81
 #: src/pages/property-mappings/PropertyMappingScopeForm.ts:78
@@ -2778,7 +2778,7 @@ msgstr ""
 msgid "Select which transports should be used to notify the user. If none are selected, the notification will only be shown in the authentik UI."
 msgstr ""
 
-#: src/pages/stages/prompt/PromptStageForm.ts:120
+#: src/pages/stages/prompt/PromptStageForm.ts:118
 msgid "Selected policies are executed when the stage is submitted to validate the data."
 msgstr ""
 
@@ -2786,7 +2786,7 @@ msgstr ""
 msgid "Selecting a service-connection enables the management of the outpost by authentik."
 msgstr ""
 
-#: src/pages/stages/password/PasswordStageForm.ts:85
+#: src/pages/stages/password/PasswordStageForm.ts:83
 msgid "Selection of backends to test the password against."
 msgstr ""
 
@@ -2806,7 +2806,7 @@ msgstr ""
 msgid "Sent to group"
 msgstr ""
 
-#: src/pages/stages/prompt/PromptForm.ts:69
+#: src/pages/stages/prompt/PromptForm.ts:74
 msgid "Separator: Static Separator Line"
 msgstr ""
 
@@ -2831,7 +2831,7 @@ msgstr ""
 msgid "Service connection"
 msgstr ""
 
-#: src/pages/stages/user_login/UserLoginStageForm.ts:66
+#: src/pages/stages/user_login/UserLoginStageForm.ts:64
 msgid "Session duration"
 msgstr ""
 
@@ -2855,7 +2855,7 @@ msgstr ""
 #: src/pages/outposts/OutpostForm.ts:127
 #: src/pages/outposts/ServiceConnectionKubernetesForm.ts:71
 #: src/pages/policies/PolicyTestForm.ts:79
-#: src/pages/users/UserForm.ts:82
+#: src/pages/users/UserForm.ts:87
 msgid "Set custom attributes using YAML or JSON."
 msgstr ""
 
@@ -2864,11 +2864,11 @@ msgstr ""
 msgid "Severity"
 msgstr ""
 
-#: src/pages/stages/prompt/PromptStageForm.ts:55
+#: src/pages/stages/prompt/PromptStageForm.ts:53
 msgid "Show arbitrary input fields to the user, for example during enrollment. Data is saved in the flow context under the 'prompt_data' variable."
 msgstr ""
 
-#: src/pages/stages/identification/IdentificationStageForm.ts:100
+#: src/pages/stages/identification/IdentificationStageForm.ts:98
 msgid "Show matched user"
 msgstr ""
 
@@ -2897,7 +2897,7 @@ msgstr ""
 msgid "Single Prompts that can be used for Prompt Stages."
 msgstr ""
 
-#: src/pages/stages/invitation/InvitationForm.ts:62
+#: src/pages/stages/invitation/InvitationForm.ts:67
 msgid "Single use"
 msgstr ""
 
@@ -2956,15 +2956,15 @@ msgstr ""
 msgid "Stage used to configure Authenticator when user doesn't have any compatible devices. After this configuration Stage passes, the user is not prompted again."
 msgstr ""
 
-#: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts:53
+#: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts:51
 msgid "Stage used to configure a TOTP authenticator (i.e. Authy/Google Authenticator)."
 msgstr ""
 
-#: src/pages/stages/authenticator_webauthn/AuthenticateWebAuthnStageForm.ts:51
+#: src/pages/stages/authenticator_webauthn/AuthenticateWebAuthnStageForm.ts:49
 msgid "Stage used to configure a WebAutnn authenticator (i.e. Yubikey, FaceID/Windows Hello)."
 msgstr ""
 
-#: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts:54
+#: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts:52
 msgid "Stage used to configure a static authenticator (i.e. static tokens). This stage should be used for configuration flows."
 msgstr ""
 
@@ -2972,17 +2972,17 @@ msgstr ""
 msgid "Stage used to validate any authenticator. This stage should be used during authentication or authorization flows."
 msgstr ""
 
-#: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts:64
-#: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts:63
+#: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts:62
+#: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts:61
 #: src/pages/stages/authenticator_validate/AuthenticatorValidateStageForm.ts:71
-#: src/pages/stages/captcha/CaptchaStageForm.ts:62
+#: src/pages/stages/captcha/CaptchaStageForm.ts:60
 #: src/pages/stages/consent/ConsentStageForm.ts:64
-#: src/pages/stages/email/EmailStageForm.ts:129
-#: src/pages/stages/identification/IdentificationStageForm.ts:70
-#: src/pages/stages/invitation/InvitationStageForm.ts:63
-#: src/pages/stages/password/PasswordStageForm.ts:70
-#: src/pages/stages/prompt/PromptStageForm.ts:65
-#: src/pages/stages/user_login/UserLoginStageForm.ts:62
+#: src/pages/stages/email/EmailStageForm.ts:130
+#: src/pages/stages/identification/IdentificationStageForm.ts:68
+#: src/pages/stages/invitation/InvitationStageForm.ts:61
+#: src/pages/stages/password/PasswordStageForm.ts:68
+#: src/pages/stages/prompt/PromptStageForm.ts:63
+#: src/pages/stages/user_login/UserLoginStageForm.ts:60
 msgid "Stage-specific settings"
 msgstr ""
 
@@ -3009,11 +3009,11 @@ msgstr ""
 msgid "Static tokens"
 msgstr ""
 
-#: src/pages/stages/prompt/PromptForm.ts:75
+#: src/pages/stages/prompt/PromptForm.ts:80
 msgid "Static: Static value, displayed as-is."
 msgstr ""
 
-#: src/pages/stages/deny/DenyStageForm.ts:51
+#: src/pages/stages/deny/DenyStageForm.ts:49
 msgid "Statically deny the flow. To use this stage effectively, disable *Evaluate on plan* on the respective binding."
 msgstr ""
 
@@ -3035,7 +3035,7 @@ msgstr ""
 msgid "Stop impersonation"
 msgstr ""
 
-#: src/pages/stages/email/EmailStageForm.ts:152
+#: src/pages/stages/email/EmailStageForm.ts:153
 msgid "Subject"
 msgstr ""
 
@@ -3076,7 +3076,7 @@ msgstr ""
 msgid "Successfully created group."
 msgstr ""
 
-#: src/pages/stages/invitation/InvitationForm.ts:39
+#: src/pages/stages/invitation/InvitationForm.ts:44
 msgid "Successfully created invitation."
 msgstr ""
 
@@ -3091,16 +3091,16 @@ msgid "Successfully created outpost."
 msgstr ""
 
 #: src/pages/policies/dummy/DummyPolicyForm.ts:44
-#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:47
-#: src/pages/policies/expiry/ExpiryPolicyForm.ts:46
-#: src/pages/policies/expression/ExpressionPolicyForm.ts:47
-#: src/pages/policies/hibp/HaveIBeenPwnedPolicyForm.ts:46
-#: src/pages/policies/password/PasswordPolicyForm.ts:46
-#: src/pages/policies/reputation/ReputationPolicyForm.ts:46
+#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:45
+#: src/pages/policies/expiry/ExpiryPolicyForm.ts:44
+#: src/pages/policies/expression/ExpressionPolicyForm.ts:45
+#: src/pages/policies/hibp/HaveIBeenPwnedPolicyForm.ts:44
+#: src/pages/policies/password/PasswordPolicyForm.ts:44
+#: src/pages/policies/reputation/ReputationPolicyForm.ts:44
 msgid "Successfully created policy."
 msgstr ""
 
-#: src/pages/stages/prompt/PromptForm.ts:38
+#: src/pages/stages/prompt/PromptForm.ts:43
 msgid "Successfully created prompt."
 msgstr ""
 
@@ -3127,27 +3127,27 @@ msgstr ""
 msgid "Successfully created source."
 msgstr ""
 
-#: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts:47
-#: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts:46
+#: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts:45
+#: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts:44
 #: src/pages/stages/authenticator_validate/AuthenticatorValidateStageForm.ts:48
-#: src/pages/stages/authenticator_webauthn/AuthenticateWebAuthnStageForm.ts:44
-#: src/pages/stages/captcha/CaptchaStageForm.ts:45
+#: src/pages/stages/authenticator_webauthn/AuthenticateWebAuthnStageForm.ts:42
+#: src/pages/stages/captcha/CaptchaStageForm.ts:43
 #: src/pages/stages/consent/ConsentStageForm.ts:47
-#: src/pages/stages/deny/DenyStageForm.ts:44
-#: src/pages/stages/dummy/DummyStageForm.ts:44
-#: src/pages/stages/email/EmailStageForm.ts:48
-#: src/pages/stages/identification/IdentificationStageForm.ts:47
-#: src/pages/stages/invitation/InvitationStageForm.ts:46
-#: src/pages/stages/password/PasswordStageForm.ts:47
-#: src/pages/stages/prompt/PromptStageForm.ts:48
-#: src/pages/stages/user_delete/UserDeleteStageForm.ts:44
-#: src/pages/stages/user_login/UserLoginStageForm.ts:45
-#: src/pages/stages/user_logout/UserLogoutStageForm.ts:44
-#: src/pages/stages/user_write/UserWriteStageForm.ts:44
+#: src/pages/stages/deny/DenyStageForm.ts:42
+#: src/pages/stages/dummy/DummyStageForm.ts:42
+#: src/pages/stages/email/EmailStageForm.ts:49
+#: src/pages/stages/identification/IdentificationStageForm.ts:45
+#: src/pages/stages/invitation/InvitationStageForm.ts:44
+#: src/pages/stages/password/PasswordStageForm.ts:45
+#: src/pages/stages/prompt/PromptStageForm.ts:46
+#: src/pages/stages/user_delete/UserDeleteStageForm.ts:42
+#: src/pages/stages/user_login/UserLoginStageForm.ts:43
+#: src/pages/stages/user_logout/UserLogoutStageForm.ts:42
+#: src/pages/stages/user_write/UserWriteStageForm.ts:42
 msgid "Successfully created stage."
 msgstr ""
 
-#: src/pages/user-settings/tokens/UserTokenForm.ts:37
+#: src/pages/user-settings/tokens/UserTokenForm.ts:42
 msgid "Successfully created token."
 msgstr ""
 
@@ -3155,7 +3155,7 @@ msgstr ""
 msgid "Successfully created transport."
 msgstr ""
 
-#: src/pages/users/UserForm.ts:40
+#: src/pages/users/UserForm.ts:45
 msgid "Successfully created user."
 msgstr ""
 
@@ -3214,7 +3214,7 @@ msgstr ""
 msgid "Successfully updated group."
 msgstr ""
 
-#: src/pages/stages/invitation/InvitationForm.ts:36
+#: src/pages/stages/invitation/InvitationForm.ts:41
 msgid "Successfully updated invitation."
 msgstr ""
 
@@ -3229,16 +3229,16 @@ msgid "Successfully updated outpost."
 msgstr ""
 
 #: src/pages/policies/dummy/DummyPolicyForm.ts:41
-#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:44
-#: src/pages/policies/expiry/ExpiryPolicyForm.ts:43
-#: src/pages/policies/expression/ExpressionPolicyForm.ts:44
-#: src/pages/policies/hibp/HaveIBeenPwnedPolicyForm.ts:43
-#: src/pages/policies/password/PasswordPolicyForm.ts:43
-#: src/pages/policies/reputation/ReputationPolicyForm.ts:43
+#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:42
+#: src/pages/policies/expiry/ExpiryPolicyForm.ts:41
+#: src/pages/policies/expression/ExpressionPolicyForm.ts:42
+#: src/pages/policies/hibp/HaveIBeenPwnedPolicyForm.ts:41
+#: src/pages/policies/password/PasswordPolicyForm.ts:41
+#: src/pages/policies/reputation/ReputationPolicyForm.ts:41
 msgid "Successfully updated policy."
 msgstr ""
 
-#: src/pages/stages/prompt/PromptForm.ts:35
+#: src/pages/stages/prompt/PromptForm.ts:40
 msgid "Successfully updated prompt."
 msgstr ""
 
@@ -3265,27 +3265,27 @@ msgstr ""
 msgid "Successfully updated source."
 msgstr ""
 
-#: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts:44
-#: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts:43
+#: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts:42
+#: src/pages/stages/authenticator_totp/AuthenticatorTOTPStageForm.ts:41
 #: src/pages/stages/authenticator_validate/AuthenticatorValidateStageForm.ts:45
-#: src/pages/stages/authenticator_webauthn/AuthenticateWebAuthnStageForm.ts:41
-#: src/pages/stages/captcha/CaptchaStageForm.ts:42
+#: src/pages/stages/authenticator_webauthn/AuthenticateWebAuthnStageForm.ts:39
+#: src/pages/stages/captcha/CaptchaStageForm.ts:40
 #: src/pages/stages/consent/ConsentStageForm.ts:44
-#: src/pages/stages/deny/DenyStageForm.ts:41
-#: src/pages/stages/dummy/DummyStageForm.ts:41
-#: src/pages/stages/email/EmailStageForm.ts:45
-#: src/pages/stages/identification/IdentificationStageForm.ts:44
-#: src/pages/stages/invitation/InvitationStageForm.ts:43
-#: src/pages/stages/password/PasswordStageForm.ts:44
-#: src/pages/stages/prompt/PromptStageForm.ts:45
-#: src/pages/stages/user_delete/UserDeleteStageForm.ts:41
-#: src/pages/stages/user_login/UserLoginStageForm.ts:42
-#: src/pages/stages/user_logout/UserLogoutStageForm.ts:41
-#: src/pages/stages/user_write/UserWriteStageForm.ts:41
+#: src/pages/stages/deny/DenyStageForm.ts:39
+#: src/pages/stages/dummy/DummyStageForm.ts:39
+#: src/pages/stages/email/EmailStageForm.ts:46
+#: src/pages/stages/identification/IdentificationStageForm.ts:42
+#: src/pages/stages/invitation/InvitationStageForm.ts:41
+#: src/pages/stages/password/PasswordStageForm.ts:42
+#: src/pages/stages/prompt/PromptStageForm.ts:43
+#: src/pages/stages/user_delete/UserDeleteStageForm.ts:39
+#: src/pages/stages/user_login/UserLoginStageForm.ts:40
+#: src/pages/stages/user_logout/UserLogoutStageForm.ts:39
+#: src/pages/stages/user_write/UserWriteStageForm.ts:39
 msgid "Successfully updated stage."
 msgstr ""
 
-#: src/pages/user-settings/tokens/UserTokenForm.ts:34
+#: src/pages/user-settings/tokens/UserTokenForm.ts:39
 msgid "Successfully updated token."
 msgstr ""
 
@@ -3293,7 +3293,7 @@ msgstr ""
 msgid "Successfully updated transport."
 msgstr ""
 
-#: src/pages/users/UserForm.ts:37
+#: src/pages/users/UserForm.ts:42
 msgid "Successfully updated user."
 msgstr ""
 
@@ -3317,7 +3317,7 @@ msgstr ""
 msgid "Superusers"
 msgstr ""
 
-#: src/pages/policies/password/PasswordPolicyForm.ts:123
+#: src/pages/policies/password/PasswordPolicyForm.ts:121
 msgid "Symbol charset"
 msgstr ""
 
@@ -3370,7 +3370,7 @@ msgstr ""
 msgid "Task finished with warnings"
 msgstr ""
 
-#: src/pages/stages/email/EmailStageForm.ts:158
+#: src/pages/stages/email/EmailStageForm.ts:159
 msgid "Template"
 msgstr ""
 
@@ -3390,7 +3390,7 @@ msgstr ""
 msgid "Test Property Mapping"
 msgstr ""
 
-#: src/pages/stages/prompt/PromptForm.ts:45
+#: src/pages/stages/prompt/PromptForm.ts:50
 msgid "Text: Simple Text input"
 msgstr ""
 
@@ -3432,19 +3432,19 @@ msgstr ""
 msgid "These policies control which users can access this application."
 msgstr ""
 
-#: src/pages/stages/invitation/InvitationStageForm.ts:53
+#: src/pages/stages/invitation/InvitationStageForm.ts:51
 msgid "This stage can be included in enrollment flows to accept invitations."
 msgstr ""
 
-#: src/pages/stages/captcha/CaptchaStageForm.ts:52
+#: src/pages/stages/captcha/CaptchaStageForm.ts:50
 msgid "This stage checks the user's current session against the Google reCaptcha service."
 msgstr ""
 
-#: src/pages/policies/reputation/ReputationPolicyForm.ts:94
+#: src/pages/policies/reputation/ReputationPolicyForm.ts:92
 msgid "Threshold"
 msgstr ""
 
-#: src/pages/stages/email/EmailStageForm.ts:149
+#: src/pages/stages/email/EmailStageForm.ts:150
 msgid "Time in minutes the token sent is valid."
 msgstr ""
 
@@ -3458,7 +3458,7 @@ msgstr ""
 
 #: src/pages/policies/BoundPoliciesList.ts:43
 #: src/pages/policies/PolicyBindingForm.ts:210
-#: src/pages/stages/email/EmailStageForm.ts:101
+#: src/pages/stages/email/EmailStageForm.ts:102
 msgid "Timeout"
 msgstr ""
 
@@ -3476,11 +3476,11 @@ msgstr ""
 msgid "Token URL"
 msgstr ""
 
-#: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts:68
+#: src/pages/stages/authenticator_static/AuthenticatorStaticStageForm.ts:66
 msgid "Token count"
 msgstr ""
 
-#: src/pages/stages/email/EmailStageForm.ts:145
+#: src/pages/stages/email/EmailStageForm.ts:146
 msgid "Token expiry"
 msgstr ""
 
@@ -3534,7 +3534,7 @@ msgstr ""
 #: src/pages/property-mappings/PropertyMappingListPage.ts:55
 #: src/pages/providers/ProviderListPage.ts:55
 #: src/pages/sources/SourcesListPage.ts:53
-#: src/pages/stages/prompt/PromptForm.ts:97
+#: src/pages/stages/prompt/PromptForm.ts:102
 #: src/pages/stages/prompt/PromptListPage.ts:48
 msgid "Type"
 msgstr ""
@@ -3743,11 +3743,11 @@ msgstr ""
 msgid "Upstream host that the requests are forwarded to."
 msgstr ""
 
-#: src/pages/stages/email/EmailStageForm.ts:96
+#: src/pages/stages/email/EmailStageForm.ts:97
 msgid "Use SSL"
 msgstr ""
 
-#: src/pages/stages/email/EmailStageForm.ts:88
+#: src/pages/stages/email/EmailStageForm.ts:89
 msgid "Use TLS"
 msgstr ""
 
@@ -3759,7 +3759,7 @@ msgstr ""
 msgid "Use a security key to prove your identity."
 msgstr ""
 
-#: src/pages/stages/email/EmailStageForm.ts:139
+#: src/pages/stages/email/EmailStageForm.ts:140
 msgid "Use global settings"
 msgstr ""
 
@@ -3813,7 +3813,7 @@ msgid "User events"
 msgstr ""
 
 #: src/pages/stages/authenticator_validate/AuthenticatorValidateStageForm.ts:99
-#: src/pages/stages/identification/IdentificationStageForm.ts:74
+#: src/pages/stages/identification/IdentificationStageForm.ts:72
 msgid "User fields"
 msgstr ""
 
@@ -3840,7 +3840,7 @@ msgid "User's avatar"
 msgstr ""
 
 #: src/pages/user-settings/UserDetailsPage.ts:68
-#: src/pages/users/UserForm.ts:58
+#: src/pages/users/UserForm.ts:63
 msgid "User's display name."
 msgstr ""
 
@@ -3857,14 +3857,14 @@ msgid "Userinfo URL"
 msgstr ""
 
 #: src/flows/stages/identification/IdentificationStage.ts:150
-#: src/pages/stages/identification/IdentificationStageForm.ts:78
+#: src/pages/stages/identification/IdentificationStageForm.ts:76
 #: src/pages/user-settings/UserDetailsPage.ts:57
-#: src/pages/users/UserForm.ts:47
+#: src/pages/users/UserForm.ts:52
 #: src/pages/users/UserViewPage.ts:84
 msgid "Username"
 msgstr ""
 
-#: src/pages/stages/prompt/PromptForm.ts:48
+#: src/pages/stages/prompt/PromptForm.ts:53
 msgid "Username: Same as Text input, but checks for and prevents duplicate usernames."
 msgstr ""
 
@@ -3898,11 +3898,11 @@ msgstr ""
 msgid "Validate SSL Certificates of upstream servers."
 msgstr ""
 
-#: src/pages/stages/password/PasswordStageForm.ts:60
+#: src/pages/stages/password/PasswordStageForm.ts:58
 msgid "Validate the user's password against the selected backend(s)."
 msgstr ""
 
-#: src/pages/stages/prompt/PromptStageForm.ts:103
+#: src/pages/stages/prompt/PromptStageForm.ts:101
 msgid "Validation Policies"
 msgstr ""
 
@@ -3914,7 +3914,7 @@ msgstr ""
 msgid "Verification Certificate"
 msgstr ""
 
-#: src/pages/stages/email/EmailStageForm.ts:119
+#: src/pages/stages/email/EmailStageForm.ts:120
 msgid "Verify the user's email address by sending them a one-time-link. Can also be used for recovery to verify the user's authenticity."
 msgstr ""
 
@@ -3979,19 +3979,19 @@ msgstr ""
 msgid "Webhook URL"
 msgstr ""
 
-#: src/pages/stages/identification/IdentificationStageForm.ts:103
+#: src/pages/stages/identification/IdentificationStageForm.ts:101
 msgid "When a valid username/email has been entered, and this option is enabled, the user's username and avatar will be shown. Otherwise, the text that the user entered will be shown."
 msgstr ""
 
-#: src/pages/stages/email/EmailStageForm.ts:142
+#: src/pages/stages/email/EmailStageForm.ts:143
 msgid "When enabled, global Email connection settings will be used and connection settings below will be ignored."
 msgstr ""
 
-#: src/pages/stages/invitation/InvitationForm.ts:66
+#: src/pages/stages/invitation/InvitationForm.ts:71
 msgid "When enabled, the invitation will be deleted after usage."
 msgstr ""
 
-#: src/pages/stages/identification/IdentificationStageForm.ts:94
+#: src/pages/stages/identification/IdentificationStageForm.ts:92
 msgid "When enabled, user fields are matched regardless of their casing."
 msgstr ""
 
@@ -4000,12 +4000,12 @@ msgid "When selected, incoming assertion's Signatures will be validated against
 msgstr ""
 
 #: src/pages/policies/dummy/DummyPolicyForm.ts:67
-#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:70
-#: src/pages/policies/expiry/ExpiryPolicyForm.ts:69
-#: src/pages/policies/expression/ExpressionPolicyForm.ts:70
-#: src/pages/policies/hibp/HaveIBeenPwnedPolicyForm.ts:70
-#: src/pages/policies/password/PasswordPolicyForm.ts:69
-#: src/pages/policies/reputation/ReputationPolicyForm.ts:69
+#: src/pages/policies/event_matcher/EventMatcherPolicyForm.ts:68
+#: src/pages/policies/expiry/ExpiryPolicyForm.ts:67
+#: src/pages/policies/expression/ExpressionPolicyForm.ts:68
+#: src/pages/policies/hibp/HaveIBeenPwnedPolicyForm.ts:68
+#: src/pages/policies/password/PasswordPolicyForm.ts:67
+#: src/pages/policies/reputation/ReputationPolicyForm.ts:67
 msgid "When this option is enabled, all executions of this policy will be logged. By default, only execution errors are logged."
 msgstr ""
 
@@ -4021,7 +4021,7 @@ msgstr ""
 msgid "Workers"
 msgstr ""
 
-#: src/pages/stages/user_write/UserWriteStageForm.ts:51
+#: src/pages/stages/user_write/UserWriteStageForm.ts:49
 msgid ""
 "Write any data from the flow's context's 'prompt_data' to the currently pending user. If no user\n"
 "is pending, a new user is created, and data is written to them."
@@ -4048,11 +4048,11 @@ msgstr ""
 msgid "You're currently impersonating {0}."
 msgstr ""
 
-#: src/pages/stages/password/PasswordStageForm.ts:79
+#: src/pages/stages/password/PasswordStageForm.ts:77
 msgid "authentik Builtin Database"
 msgstr ""
 
-#: src/pages/stages/password/PasswordStageForm.ts:82
+#: src/pages/stages/password/PasswordStageForm.ts:80
 msgid "authentik LDAP Backend"
 msgstr ""
 
@@ -4065,11 +4065,11 @@ msgstr ""
 msgid "{0}"
 msgstr ""
 
-#: src/pages/stages/prompt/PromptStageForm.ts:82
+#: src/pages/stages/prompt/PromptStageForm.ts:80
 msgid "{0} (\"{1}\", of type {2})"
 msgstr ""
 
-#: src/pages/stages/prompt/PromptStageForm.ts:115
+#: src/pages/stages/prompt/PromptStageForm.ts:113
 msgid "{0} ({1})"
 msgstr ""
 
diff --git a/web/src/pages/policies/BoundPoliciesList.ts b/web/src/pages/policies/BoundPoliciesList.ts
index 2e6d90409..a7a9bf21a 100644
--- a/web/src/pages/policies/BoundPoliciesList.ts
+++ b/web/src/pages/policies/BoundPoliciesList.ts
@@ -102,7 +102,7 @@ export class BoundPoliciesList extends Table<PolicyBinding> {
                 <span slot="header">
                     ${t`Update User`}
                 </span>
-                <ak-user-form slot="form" .user=${item.userObj}>
+                <ak-user-form slot="form" .instancePk=${item.userObj?.pk}>
                 </ak-user-form>
                 <button slot="trigger" class="pf-c-button pf-m-secondary">
                     ${t`Edit User`}
diff --git a/web/src/pages/stages/invitation/InvitationForm.ts b/web/src/pages/stages/invitation/InvitationForm.ts
index 4ccbca9bf..76b3065ce 100644
--- a/web/src/pages/stages/invitation/InvitationForm.ts
+++ b/web/src/pages/stages/invitation/InvitationForm.ts
@@ -1,22 +1,25 @@
 import { Invitation, StagesApi } from "authentik-api";
 import { t } from "@lingui/macro";
-import { customElement, property } from "lit-element";
+import { customElement } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../../api/Config";
-import { Form } from "../../../elements/forms/Form";
 import "../../../elements/forms/HorizontalFormElement";
 import "../../../elements/CodeMirror";
 import YAML from "yaml";
 import { first } from "../../../utils";
+import { ModelForm } from "../../../elements/forms/ModelForm";
 
 @customElement("ak-invitation-form")
-export class InvitationForm extends Form<Invitation> {
+export class InvitationForm extends ModelForm<Invitation, string> {
 
-    @property({attribute: false})
-    invitation?: Invitation;
+    loadInstance(pk: string): Promise<Invitation> {
+        return new StagesApi(DEFAULT_CONFIG).stagesInvitationInvitationsRead({
+            inviteUuid: pk,
+        });
+    }
 
     getSuccessMessage(): string {
-        if (this.invitation) {
+        if (this.instance) {
             return t`Successfully updated invitation.`;
         } else {
             return t`Successfully created invitation.`;
@@ -24,9 +27,9 @@ export class InvitationForm extends Form<Invitation> {
     }
 
     send = (data: Invitation): Promise<Invitation> => {
-        if (this.invitation) {
+        if (this.instance) {
             return new StagesApi(DEFAULT_CONFIG).stagesInvitationInvitationsUpdate({
-                inviteUuid: this.invitation.pk || "",
+                inviteUuid: this.instance.pk || "",
                 data: data
             });
         } else {
@@ -47,13 +50,13 @@ export class InvitationForm extends Form<Invitation> {
             <ak-form-element-horizontal
                 label=${t`Attributes`}
                 name="fixedData">
-                <ak-codemirror mode="yaml" value="${YAML.stringify(first(this.invitation?.fixedData, {}))}">
+                <ak-codemirror mode="yaml" value="${YAML.stringify(first(this.instance?.fixedData, {}))}">
                 </ak-codemirror>
                 <p class="pf-c-form__helper-text">${t`Optional data which is loaded into the flow's 'prompt_data' context variable. YAML or JSON.`}</p>
             </ak-form-element-horizontal>
             <ak-form-element-horizontal name="singleUse">
                 <div class="pf-c-check">
-                    <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.invitation?.singleUse, true)}>
+                    <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.instance?.singleUse, true)}>
                     <label class="pf-c-check__label">
                         ${t`Single use`}
                     </label>
diff --git a/web/src/pages/stages/prompt/PromptForm.ts b/web/src/pages/stages/prompt/PromptForm.ts
index db68fe6cf..fab889bee 100644
--- a/web/src/pages/stages/prompt/PromptForm.ts
+++ b/web/src/pages/stages/prompt/PromptForm.ts
@@ -1,21 +1,24 @@
 import { Prompt, PromptTypeEnum, StagesApi } from "authentik-api";
 import { t } from "@lingui/macro";
-import { customElement, property } from "lit-element";
+import { customElement } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../../api/Config";
-import { Form } from "../../../elements/forms/Form";
 import { ifDefined } from "lit-html/directives/if-defined";
 import "../../../elements/forms/HorizontalFormElement";
 import { first } from "../../../utils";
+import { ModelForm } from "../../../elements/forms/ModelForm";
 
 @customElement("ak-prompt-form")
-export class PromptForm extends Form<Prompt> {
+export class PromptForm extends ModelForm<Prompt, string> {
 
-    @property({attribute: false})
-    prompt?: Prompt;
+    loadInstance(pk: string): Promise<Prompt> {
+        return new StagesApi(DEFAULT_CONFIG).stagesPromptPromptsRead({
+            promptUuid: pk
+        });
+    }
 
     getSuccessMessage(): string {
-        if (this.prompt) {
+        if (this.instance) {
             return t`Successfully updated prompt.`;
         } else {
             return t`Successfully created prompt.`;
@@ -23,9 +26,9 @@ export class PromptForm extends Form<Prompt> {
     }
 
     send = (data: Prompt): Promise<Prompt> => {
-        if (this.prompt) {
+        if (this.instance) {
             return new StagesApi(DEFAULT_CONFIG).stagesPromptPromptsUpdate({
-                promptUuid: this.prompt.pk || "",
+                promptUuid: this.instance.pk || "",
                 data: data
             });
         } else {
@@ -37,37 +40,37 @@ export class PromptForm extends Form<Prompt> {
 
     renderTypes(): TemplateResult {
         return html`
-            <option value=${PromptTypeEnum.Text} ?selected=${this.prompt?.type === PromptTypeEnum.Text}>
+            <option value=${PromptTypeEnum.Text} ?selected=${this.instance?.type === PromptTypeEnum.Text}>
                 ${t`Text: Simple Text input`}
             </option>
-            <option value=${PromptTypeEnum.Username} ?selected=${this.prompt?.type === PromptTypeEnum.Username}>
+            <option value=${PromptTypeEnum.Username} ?selected=${this.instance?.type === PromptTypeEnum.Username}>
                 ${t`Username: Same as Text input, but checks for and prevents duplicate usernames.`}
             </option>
-            <option value=${PromptTypeEnum.Email} ?selected=${this.prompt?.type === PromptTypeEnum.Email}>
+            <option value=${PromptTypeEnum.Email} ?selected=${this.instance?.type === PromptTypeEnum.Email}>
                 ${t`Email: Text field with Email type.`}
             </option>
-            <option value=${PromptTypeEnum.Password} ?selected=${this.prompt?.type === PromptTypeEnum.Password}>
+            <option value=${PromptTypeEnum.Password} ?selected=${this.instance?.type === PromptTypeEnum.Password}>
                 ${t`Password: Masked input, password is validated against sources. Policies still have to be applied to this Stage. If two of these are used in the same stage, they are ensured to be identical.`}
             </option>
-            <option value=${PromptTypeEnum.Number} ?selected=${this.prompt?.type === PromptTypeEnum.Number}>
+            <option value=${PromptTypeEnum.Number} ?selected=${this.instance?.type === PromptTypeEnum.Number}>
                 ${t`Number`}
             </option>
-            <option value=${PromptTypeEnum.Checkbox} ?selected=${this.prompt?.type === PromptTypeEnum.Checkbox}>
+            <option value=${PromptTypeEnum.Checkbox} ?selected=${this.instance?.type === PromptTypeEnum.Checkbox}>
                 ${t`Checkbox`}
             </option>
-            <option value=${PromptTypeEnum.Date} ?selected=${this.prompt?.type === PromptTypeEnum.Date}>
+            <option value=${PromptTypeEnum.Date} ?selected=${this.instance?.type === PromptTypeEnum.Date}>
                 ${t`Date`}
             </option>
-            <option value=${PromptTypeEnum.DateTime} ?selected=${this.prompt?.type === PromptTypeEnum.DateTime}>
+            <option value=${PromptTypeEnum.DateTime} ?selected=${this.instance?.type === PromptTypeEnum.DateTime}>
                 ${t`Date Time`}
             </option>
-            <option value=${PromptTypeEnum.Separator} ?selected=${this.prompt?.type === PromptTypeEnum.Separator}>
+            <option value=${PromptTypeEnum.Separator} ?selected=${this.instance?.type === PromptTypeEnum.Separator}>
                 ${t`Separator: Static Separator Line`}
             </option>
-            <option value=${PromptTypeEnum.Hidden} ?selected=${this.prompt?.type === PromptTypeEnum.Hidden}>
+            <option value=${PromptTypeEnum.Hidden} ?selected=${this.instance?.type === PromptTypeEnum.Hidden}>
                 ${t`Hidden: Hidden field, can be used to insert data into form.`}
             </option>
-            <option value=${PromptTypeEnum.Static} ?selected=${this.prompt?.type === PromptTypeEnum.Static}>
+            <option value=${PromptTypeEnum.Static} ?selected=${this.instance?.type === PromptTypeEnum.Static}>
                 ${t`Static: Static value, displayed as-is.`}
             </option>
         `;
@@ -79,14 +82,14 @@ export class PromptForm extends Form<Prompt> {
                 label=${t`Field Key`}
                 ?required=${true}
                 name="fieldKey">
-                <input type="text" value="${ifDefined(this.prompt?.fieldKey)}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.fieldKey)}" class="pf-c-form-control" required>
                 <p class="pf-c-form__helper-text">${t`Name of the form field, also used to store the value.`}</p>
             </ak-form-element-horizontal>
             <ak-form-element-horizontal
                 label=${t`Label`}
                 ?required=${true}
                 name="label">
-                <input type="text" value="${ifDefined(this.prompt?.label)}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.label)}" class="pf-c-form-control" required>
                 <p class="pf-c-form__helper-text">${t`Label shown next to/above the prompt.`}</p>
             </ak-form-element-horizontal>
             <ak-form-element-horizontal
@@ -99,7 +102,7 @@ export class PromptForm extends Form<Prompt> {
             </ak-form-element-horizontal>
             <ak-form-element-horizontal name="required">
                 <div class="pf-c-check">
-                    <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.prompt?.required, false)}>
+                    <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.instance?.required, false)}>
                     <label class="pf-c-check__label">
                         ${t`Required`}
                     </label>
@@ -108,14 +111,14 @@ export class PromptForm extends Form<Prompt> {
             <ak-form-element-horizontal
                 label=${t`Placeholder`}
                 name="placeholder">
-                <input type="text" value="${ifDefined(this.prompt?.placeholder)}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.placeholder)}" class="pf-c-form-control" required>
                 <p class="pf-c-form__helper-text">${t`Optionally pre-fill the input value`}</p>
             </ak-form-element-horizontal>
             <ak-form-element-horizontal
                 label=${t`Order`}
                 ?required=${true}
                 name="order">
-                <input type="number" value="${ifDefined(this.prompt?.order)}" class="pf-c-form-control" required>
+                <input type="number" value="${ifDefined(this.instance?.order)}" class="pf-c-form-control" required>
             </ak-form-element-horizontal>
         </form>`;
     }
diff --git a/web/src/pages/stages/prompt/PromptListPage.ts b/web/src/pages/stages/prompt/PromptListPage.ts
index 8d7bf6a46..5cdf6af94 100644
--- a/web/src/pages/stages/prompt/PromptListPage.ts
+++ b/web/src/pages/stages/prompt/PromptListPage.ts
@@ -68,7 +68,7 @@ export class PromptListPage extends TablePage<Prompt> {
                 <span slot="header">
                     ${t`Update Prompt`}
                 </span>
-                <ak-prompt-form slot="form" .prompt=${item}>
+                <ak-prompt-form slot="form" .instancePk=${item.pk}>
                 </ak-prompt-form>
                 <button slot="trigger" class="pf-c-button pf-m-secondary">
                     ${t`Edit`}
diff --git a/web/src/pages/user-settings/tokens/UserTokenForm.ts b/web/src/pages/user-settings/tokens/UserTokenForm.ts
index 25878f84a..8fad96109 100644
--- a/web/src/pages/user-settings/tokens/UserTokenForm.ts
+++ b/web/src/pages/user-settings/tokens/UserTokenForm.ts
@@ -1,20 +1,23 @@
 import { CoreApi, Token } from "authentik-api";
 import { t } from "@lingui/macro";
-import { customElement, property } from "lit-element";
+import { customElement } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../../api/Config";
-import { Form } from "../../../elements/forms/Form";
 import { ifDefined } from "lit-html/directives/if-defined";
 import "../../../elements/forms/HorizontalFormElement";
+import { ModelForm } from "../../../elements/forms/ModelForm";
 
 @customElement("ak-user-token-form")
-export class UserTokenForm extends Form<Token> {
+export class UserTokenForm extends ModelForm<Token, string> {
 
-    @property({attribute: false})
-    token?: Token;
+    loadInstance(pk: string): Promise<Token> {
+        return new CoreApi(DEFAULT_CONFIG).coreTokensRead({
+            identifier: pk
+        });
+    }
 
     getSuccessMessage(): string {
-        if (this.token) {
+        if (this.instance) {
             return t`Successfully updated token.`;
         } else {
             return t`Successfully created token.`;
@@ -22,9 +25,9 @@ export class UserTokenForm extends Form<Token> {
     }
 
     send = (data: Token): Promise<Token> => {
-        if (this.token) {
+        if (this.instance) {
             return new CoreApi(DEFAULT_CONFIG).coreTokensUpdate({
-                identifier: this.token.identifier,
+                identifier: this.instance.identifier,
                 data: data
             });
         } else {
@@ -40,13 +43,13 @@ export class UserTokenForm extends Form<Token> {
                 label=${t`Identifier`}
                 ?required=${true}
                 name="identifier">
-                <input type="text" value="${ifDefined(this.token?.identifier)}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.identifier)}" class="pf-c-form-control" required>
             </ak-form-element-horizontal>
             <ak-form-element-horizontal
                 label=${t`Description`}
                 ?required=${true}
                 name="description">
-                <input type="text" value="${ifDefined(this.token?.description)}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.description)}" class="pf-c-form-control" required>
             </ak-form-element-horizontal>
         </form>`;
     }
diff --git a/web/src/pages/user-settings/tokens/UserTokenList.ts b/web/src/pages/user-settings/tokens/UserTokenList.ts
index efb9d4233..9cd0ad58a 100644
--- a/web/src/pages/user-settings/tokens/UserTokenList.ts
+++ b/web/src/pages/user-settings/tokens/UserTokenList.ts
@@ -110,7 +110,7 @@ export class UserTokenList extends Table<Token> {
                 <span slot="header">
                     ${t`Update Token`}
                 </span>
-                <ak-user-token-form slot="form" .token=${item}>
+                <ak-user-token-form slot="form" .instancePk=${item.identifier}>
                 </ak-user-token-form>
                 <button slot="trigger" class="pf-c-button pf-m-secondary">
                     ${t`Edit`}
diff --git a/web/src/pages/users/UserForm.ts b/web/src/pages/users/UserForm.ts
index 6c4d179fa..2f5c72761 100644
--- a/web/src/pages/users/UserForm.ts
+++ b/web/src/pages/users/UserForm.ts
@@ -1,23 +1,26 @@
 import { CoreApi, User } from "authentik-api";
 import { t } from "@lingui/macro";
-import { customElement, property } from "lit-element";
+import { customElement } from "lit-element";
 import { html, TemplateResult } from "lit-html";
 import { DEFAULT_CONFIG } from "../../api/Config";
-import { Form } from "../../elements/forms/Form";
 import { ifDefined } from "lit-html/directives/if-defined";
 import "../../elements/forms/HorizontalFormElement";
 import "../../elements/CodeMirror";
 import YAML from "yaml";
 import { first } from "../../utils";
+import { ModelForm } from "../../elements/forms/ModelForm";
 
 @customElement("ak-user-form")
-export class UserForm extends Form<User> {
+export class UserForm extends ModelForm<User, number> {
 
-    @property({ attribute: false })
-    user?: User;
+    loadInstance(pk: number): Promise<User> {
+        return new CoreApi(DEFAULT_CONFIG).coreUsersRead({
+            id: pk
+        });
+    }
 
     getSuccessMessage(): string {
-        if (this.user) {
+        if (this.instance) {
             return t`Successfully updated user.`;
         } else {
             return t`Successfully created user.`;
@@ -25,9 +28,9 @@ export class UserForm extends Form<User> {
     }
 
     send = (data: User): Promise<User> => {
-        if (this.user) {
+        if (this.instance) {
             return new CoreApi(DEFAULT_CONFIG).coreUsersUpdate({
-                id: this.user.pk || 0,
+                id: this.instance.pk || 0,
                 data: data
             });
         } else {
@@ -43,26 +46,26 @@ export class UserForm extends Form<User> {
                 label=${t`Username`}
                 ?required=${true}
                 name="username">
-                <input type="text" value="${ifDefined(this.user?.username)}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.username)}" class="pf-c-form-control" required>
                 <p class="pf-c-form__helper-text">${t`Required. 150 characters or fewer. Letters, digits and @/./+/-/_ only.`}</p>
             </ak-form-element-horizontal>
             <ak-form-element-horizontal
                 label=${t`Name`}
                 ?required=${true}
                 name="name">
-                <input type="text" value="${ifDefined(this.user?.name)}" class="pf-c-form-control" required>
+                <input type="text" value="${ifDefined(this.instance?.name)}" class="pf-c-form-control" required>
                 <p class="pf-c-form__helper-text">${t`User's display name.`}</p>
             </ak-form-element-horizontal>
             <ak-form-element-horizontal
                 label=${t`Email`}
                 ?required=${true}
                 name="email">
-                <input type="email" autocomplete="off" value="${ifDefined(this.user?.email)}" class="pf-c-form-control" required>
+                <input type="email" autocomplete="off" value="${ifDefined(this.instance?.email)}" class="pf-c-form-control" required>
             </ak-form-element-horizontal>
             <ak-form-element-horizontal
                 name="isActive">
                 <div class="pf-c-check">
-                    <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.user?.isActive, true)}>
+                    <input type="checkbox" class="pf-c-check__input" ?checked=${first(this.instance?.isActive, true)}>
                     <label class="pf-c-check__label">
                         ${t`Is active`}
                     </label>
@@ -73,7 +76,7 @@ export class UserForm extends Form<User> {
                 label=${t`Attributes`}
                 ?required=${true}
                 name="attributes">
-                <ak-codemirror mode="yaml" value="${YAML.stringify(first(this.user?.attributes, {}))}">
+                <ak-codemirror mode="yaml" value="${YAML.stringify(first(this.instance?.attributes, {}))}">
                 </ak-codemirror>
                 <p class="pf-c-form__helper-text">${t`Set custom attributes using YAML or JSON.`}</p>
             </ak-form-element-horizontal>
diff --git a/web/src/pages/users/UserListPage.ts b/web/src/pages/users/UserListPage.ts
index 13666a5fe..cbf999fc9 100644
--- a/web/src/pages/users/UserListPage.ts
+++ b/web/src/pages/users/UserListPage.ts
@@ -75,7 +75,7 @@ export class UserListPage extends TablePage<User> {
                 <span slot="header">
                     ${t`Update User`}
                 </span>
-                <ak-user-form slot="form" .user=${item}>
+                <ak-user-form slot="form" .instancePk=${item.pk}>
                 </ak-user-form>
                 <button slot="trigger" class="pf-m-secondary pf-c-button">
                     ${t`Edit`}
diff --git a/web/src/pages/users/UserViewPage.ts b/web/src/pages/users/UserViewPage.ts
index 50a73de75..4f8d64051 100644
--- a/web/src/pages/users/UserViewPage.ts
+++ b/web/src/pages/users/UserViewPage.ts
@@ -144,7 +144,7 @@ export class UserViewPage extends LitElement {
                                     <span slot="header">
                                         ${t`Update User`}
                                     </span>
-                                    <ak-user-form slot="form" .user=${this.user}>
+                                    <ak-user-form slot="form" .instancePk=${this.user.pk}>
                                     </ak-user-form>
                                     <button slot="trigger" class="pf-m-primary pf-c-button">
                                         ${t`Edit`}

From 4352960f8345b4e66e32940e55d8708052a3121a Mon Sep 17 00:00:00 2001
From: Jens Langhammer <jens.langhammer@beryju.org>
Date: Tue, 11 May 2021 13:31:33 +0200
Subject: [PATCH 09/10] web/admin: fix error when updating oauth source

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
---
 web/src/pages/sources/oauth/OAuthSourceForm.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/web/src/pages/sources/oauth/OAuthSourceForm.ts b/web/src/pages/sources/oauth/OAuthSourceForm.ts
index d72ad0632..de7d66630 100644
--- a/web/src/pages/sources/oauth/OAuthSourceForm.ts
+++ b/web/src/pages/sources/oauth/OAuthSourceForm.ts
@@ -42,7 +42,7 @@ export class OAuthSourceForm extends ModelForm<OAuthSource, string> {
 
     send = (data: OAuthSource): Promise<OAuthSource> => {
         if (this.instance) {
-            return new SourcesApi(DEFAULT_CONFIG).sourcesOauthUpdate({
+            return new SourcesApi(DEFAULT_CONFIG).sourcesOauthPartialUpdate({
                 slug: this.instance.slug,
                 data: data
             });

From 124ce80694b286a68ff2c4e7d968ba58690f6d09 Mon Sep 17 00:00:00 2001
From: Jens Langhammer <jens.langhammer@beryju.org>
Date: Tue, 11 May 2021 13:32:28 +0200
Subject: [PATCH 10/10] sources/plex: make plex_token readable from API

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
---
 authentik/sources/plex/api.py | 1 -
 1 file changed, 1 deletion(-)

diff --git a/authentik/sources/plex/api.py b/authentik/sources/plex/api.py
index 800f4112d..d9c351aef 100644
--- a/authentik/sources/plex/api.py
+++ b/authentik/sources/plex/api.py
@@ -34,7 +34,6 @@ class PlexSourceSerializer(SourceSerializer):
             "allow_friends",
             "plex_token",
         ]
-        extra_kwargs = {"plex_token": {"write_only": True}}
 
 
 class PlexTokenRedeemSerializer(PassiveSerializer):