added static connectors to combined config yaml

client/internal/auth/auth.go

@@ -221,7 +221,6 @@ func (a *Auth) getPKCEFlow(client *mgm.GrpcClient) (*PKCEAuthorizationFlow, erro
 	config := &PKCEAuthProviderConfig{
 		Audience:              protoConfig.GetAudience(),
 		ClientID:              protoConfig.GetClientID(),
-		ClientSecret:          protoConfig.GetClientSecret(), //nolint:staticcheck
 		TokenEndpoint:         protoConfig.GetTokenEndpoint(),
 		AuthorizationEndpoint: protoConfig.GetAuthorizationEndpoint(),
 		Scope:                 protoConfig.GetScope(),
@@ -266,7 +265,6 @@ func (a *Auth) getDeviceFlow(client *mgm.GrpcClient) (*DeviceAuthorizationFlow,
 	config := &DeviceAuthProviderConfig{
 		Audience:           protoConfig.GetAudience(),
 		ClientID:           protoConfig.GetClientID(),
-		ClientSecret:       protoConfig.GetClientSecret(), //nolint:staticcheck
 		Domain:             protoConfig.Domain,
 		TokenEndpoint:      protoConfig.GetTokenEndpoint(),
 		DeviceAuthEndpoint: protoConfig.GetDeviceAuthEndpoint(),

client/internal/auth/device_flow.go

@@ -29,8 +29,6 @@ var _ OAuthFlow = &DeviceAuthorizationFlow{}
 type DeviceAuthProviderConfig struct {
 	// ClientID An IDP application client id
 	ClientID string
-	// ClientSecret An IDP application client secret
-	ClientSecret string
 	// Domain An IDP API domain
 	// Deprecated. Use OIDCConfigEndpoint instead
 	Domain string

client/internal/auth/pkce_flow.go

@@ -38,8 +38,6 @@ const (
 type PKCEAuthProviderConfig struct {
 	// ClientID An IDP application client id
 	ClientID string
-	// ClientSecret An IDP application client secret
-	ClientSecret string
 	// Audience An Audience for to authorization validation
 	Audience string
 	// TokenEndpoint is the endpoint of an IDP manager where clients can obtain access token
@@ -111,8 +109,7 @@ func NewPKCEAuthorizationFlow(config PKCEAuthProviderConfig) (*PKCEAuthorization
 	}
 
 	cfg := &oauth2.Config{
-		ClientID:     config.ClientID,
-		ClientSecret: config.ClientSecret,
+		ClientID: config.ClientID,
 		Endpoint: oauth2.Endpoint{
 			AuthURL:  config.AuthorizationEndpoint,
 			TokenURL: config.TokenEndpoint,

client/internal/connect.go

@@ -44,10 +44,6 @@ import (
 	"github.com/netbirdio/netbird/version"
 )
 
-// androidRunOverride is set on Android to inject mobile dependencies
-// when using embed.Client (which calls Run() with empty MobileDependency).
-var androidRunOverride func(c *ConnectClient, runningChan chan struct{}, logPath string) error
-
 type ConnectClient struct {
 	ctx            context.Context
 	config         *profilemanager.Config
@@ -80,9 +76,6 @@ func (c *ConnectClient) SetUpdateManager(um *updater.Manager) {
 
 // Run with main logic.
 func (c *ConnectClient) Run(runningChan chan struct{}, logPath string) error {
-	if androidRunOverride != nil {
-		return androidRunOverride(c, runningChan, logPath)
-	}
 	return c.run(MobileDependency{}, runningChan, logPath)
 }
 

client/internal/connect_android_default.go

@@ -1,73 +0,0 @@
-//go:build android
-
-package internal
-
-import (
-	"net/netip"
-
-	"github.com/netbirdio/netbird/client/internal/dns"
-	"github.com/netbirdio/netbird/client/internal/listener"
-	"github.com/netbirdio/netbird/client/internal/stdnet"
-)
-
-// noopIFaceDiscover is a stub ExternalIFaceDiscover for embed.Client on Android.
-// It returns an empty interface list, which means ICE P2P candidates won't be
-// discovered — connections will fall back to relay. Applications that need P2P
-// should provide a real implementation via runOnAndroidEmbed that uses
-// Android's ConnectivityManager to enumerate network interfaces.
-type noopIFaceDiscover struct{}
-
-func (noopIFaceDiscover) IFaces() (string, error) {
-	// Return empty JSON array — no local interfaces advertised for ICE.
-	// This is intentional: without Android's ConnectivityManager, we cannot
-	// reliably enumerate interfaces (netlink is restricted on Android 11+).
-	// Relay connections still work; only P2P hole-punching is disabled.
-	return "[]", nil
-}
-
-// noopNetworkChangeListener is a stub for embed.Client on Android.
-// Network change events are ignored since the embed client manages its own
-// reconnection logic via the engine's built-in retry mechanism.
-type noopNetworkChangeListener struct{}
-
-func (noopNetworkChangeListener) OnNetworkChanged(string) {
-	// No-op: embed.Client relies on the engine's internal reconnection
-	// logic rather than OS-level network change notifications.
-}
-
-func (noopNetworkChangeListener) SetInterfaceIP(string) {
-	// No-op: in netstack mode, the overlay IP is managed by the userspace
-	// network stack, not by OS-level interface configuration.
-}
-
-// noopDnsReadyListener is a stub for embed.Client on Android.
-// DNS readiness notifications are not needed in netstack/embed mode
-// since system DNS is disabled and DNS resolution happens externally.
-type noopDnsReadyListener struct{}
-
-func (noopDnsReadyListener) OnReady() {
-	// No-op: embed.Client does not need DNS readiness notifications.
-	// System DNS is disabled in netstack mode.
-}
-
-var _ stdnet.ExternalIFaceDiscover = noopIFaceDiscover{}
-var _ listener.NetworkChangeListener = noopNetworkChangeListener{}
-var _ dns.ReadyListener = noopDnsReadyListener{}
-
-func init() {
-	// Wire up the default override so embed.Client.Start() works on Android
-	// with netstack mode. Provides complete no-op stubs for all mobile
-	// dependencies so the engine's existing Android code paths work unchanged.
-	// Applications that need P2P ICE or real DNS should replace this by
-	// setting androidRunOverride before calling Start().
-	androidRunOverride = func(c *ConnectClient, runningChan chan struct{}, logPath string) error {
-		return c.runOnAndroidEmbed(
-			noopIFaceDiscover{},
-			noopNetworkChangeListener{},
-			[]netip.AddrPort{},
-			noopDnsReadyListener{},
-			runningChan,
-			logPath,
-		)
-	}
-}

client/internal/connect_android_embed.go

@@ -1,32 +0,0 @@
-//go:build android
-
-package internal
-
-import (
-	"net/netip"
-
-	"github.com/netbirdio/netbird/client/internal/dns"
-	"github.com/netbirdio/netbird/client/internal/listener"
-	"github.com/netbirdio/netbird/client/internal/stdnet"
-)
-
-// runOnAndroidEmbed is like RunOnAndroid but accepts a runningChan
-// so embed.Client.Start() can detect when the engine is ready.
-// It provides complete MobileDependency so the engine's existing
-// Android code paths work unchanged.
-func (c *ConnectClient) runOnAndroidEmbed(
-	iFaceDiscover stdnet.ExternalIFaceDiscover,
-	networkChangeListener listener.NetworkChangeListener,
-	dnsAddresses []netip.AddrPort,
-	dnsReadyListener dns.ReadyListener,
-	runningChan chan struct{},
-	logPath string,
-) error {
-	mobileDependency := MobileDependency{
-		IFaceDiscover:         iFaceDiscover,
-		NetworkChangeListener: networkChangeListener,
-		HostDNSAddresses:      dnsAddresses,
-		DnsReadyListener:      dnsReadyListener,
-	}
-	return c.run(mobileDependency, runningChan, logPath)
-}

combined/cmd/config.go

@@ -14,6 +14,7 @@ import (
 	log "github.com/sirupsen/logrus"
 	"gopkg.in/yaml.v3"
 
+	"github.com/netbirdio/netbird/idp/dex"
 	"github.com/netbirdio/netbird/management/server/idp"
 	"github.com/netbirdio/netbird/management/server/types"
 	"github.com/netbirdio/netbird/util"
@@ -140,6 +141,7 @@ type AuthConfig struct {
 	DashboardRedirectURIs []string          `yaml:"dashboardRedirectURIs"`
 	CLIRedirectURIs       []string          `yaml:"cliRedirectURIs"`
 	Owner                 *AuthOwnerConfig  `yaml:"owner,omitempty"`
+	StaticConnectors      []dex.Connector   `yaml:"staticConnectors,omitempty"`
 }
 
 // AuthStorageConfig contains auth storage settings
@@ -592,6 +594,7 @@ func (c *CombinedConfig) buildEmbeddedIdPConfig(mgmt ManagementConfig) (*idp.Emb
 		},
 		DashboardRedirectURIs: mgmt.Auth.DashboardRedirectURIs,
 		CLIRedirectURIs:       mgmt.Auth.CLIRedirectURIs,
+		StaticConnectors:      mgmt.Auth.StaticConnectors,
 	}
 
 	if mgmt.Auth.Owner != nil && mgmt.Auth.Owner.Email != "" {

idp/dex/config.go

@@ -163,10 +163,10 @@ func (p *Password) UnmarshalYAML(node *yaml.Node) error {
 
 // Connector is a connector configuration that can unmarshal YAML dynamically.
 type Connector struct {
-	Type   string                 `yaml:"type" json:"type"`
-	Name   string                 `yaml:"name" json:"name"`
-	ID     string                 `yaml:"id" json:"id"`
-	Config map[string]interface{} `yaml:"config" json:"config"`
+	Type   string         `yaml:"type" json:"type"`
+	Name   string         `yaml:"name" json:"name"`
+	ID     string         `yaml:"id" json:"id"`
+	Config map[string]any `yaml:"config" json:"config"`
 }
 
 // ToStorageConnector converts a Connector to storage.Connector type.

infrastructure_files/getting-started.sh

@@ -532,14 +532,13 @@ render_docker_compose_traefik_builtin() {
     traefik_dynamic_volume="      - ./traefik-dynamic.yaml:/etc/traefik/dynamic.yaml:ro"
     proxy_service="
   # NetBird Proxy - exposes internal resources to the internet
-  # Uses host network so it can listen on arbitrary ports for TCP/UDP services
   proxy:
     image: $NETBIRD_PROXY_IMAGE
     container_name: netbird-proxy
     ports:
     - 51820:51820/udp
     restart: unless-stopped
-    network_mode: host
+    networks: [netbird]
     depends_on:
       - netbird-server
     env_file:
@@ -647,7 +646,6 @@ $traefik_dynamic_volume
     networks: [netbird]
     ports:
       - '$NETBIRD_STUN_PORT:$NETBIRD_STUN_PORT/udp'
-$(if [[ "$ENABLE_PROXY" == "true" ]]; then echo "      - '$MANAGEMENT_HOST_PORT:80'"; fi)
     volumes:
       - netbird_data:/var/lib/netbird
       - ./config.yaml:/etc/netbird/config.yaml
@@ -768,8 +766,8 @@ render_proxy_env() {
   cat <<EOF
 # NetBird Proxy Configuration
 NB_PROXY_DEBUG_LOGS=false
-# Proxy runs in host network mode for L4 port binding, connect to management via localhost
-NB_PROXY_MANAGEMENT_ADDRESS=http://localhost:$MANAGEMENT_HOST_PORT
+# Use internal Docker network to connect to management (avoids hairpin NAT issues)
+NB_PROXY_MANAGEMENT_ADDRESS=http://netbird-server:80
 # Allow insecure gRPC connection to management (required for internal Docker network)
 NB_PROXY_ALLOW_INSECURE=true
 # Public URL where this proxy is reachable (used for cluster registration)
@@ -1156,16 +1154,7 @@ print_builtin_traefik_instructions() {
   echo "  - $NETBIRD_STUN_PORT/udp   (STUN - required for NAT traversal)"
   if [[ "$ENABLE_PROXY" == "true" ]]; then
     echo "  - 51820/udp (WIREGUARD - (optional) for P2P proxy connections)"
-  fi
-  echo ""
-  echo "This setup is ideal for homelabs and smaller organization deployments."
-  echo "For enterprise environments requiring high availability and advanced integrations,"
-  echo "consider a commercial on-prem license or scaling your open source deployment:"
-  echo ""
-  echo "  Commercial license: https://netbird.io/pricing#on-prem"
-  echo "  Scaling guide:      https://docs.netbird.io/scaling-your-self-hosted-deployment"
-  echo ""
-  if [[ "$ENABLE_PROXY" == "true" ]]; then
+    echo ""
     echo "NetBird Proxy:"
     echo "  The proxy service is enabled and running."
     echo "  Any domain NOT matching $NETBIRD_DOMAIN will be passed through to the proxy."

management/internals/modules/reverseproxy/service/manager/manager.go

@@ -288,8 +288,6 @@ func (m *Manager) validateSubdomainRequirement(ctx context.Context, domain, clus
 }
 
 func (m *Manager) persistNewService(ctx context.Context, accountID string, svc *service.Service) error {
-	customPorts := m.clusterCustomPorts(ctx, svc)
-
 	return m.store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
 		if svc.Domain != "" {
 			if err := m.checkDomainAvailable(ctx, transaction, svc.Domain, ""); err != nil {
@@ -297,7 +295,7 @@ func (m *Manager) persistNewService(ctx context.Context, accountID string, svc *
 			}
 		}
 
-		if err := m.ensureL4Port(ctx, transaction, svc, customPorts); err != nil {
+		if err := m.ensureL4Port(ctx, transaction, svc); err != nil {
 			return err
 		}
 
@@ -317,23 +315,12 @@ func (m *Manager) persistNewService(ctx context.Context, accountID string, svc *
 	})
 }
 
-// clusterCustomPorts queries whether the cluster supports custom ports.
-// Must be called before entering a transaction: the underlying query uses
-// the main DB handle, which deadlocks when called inside a transaction
-// that already holds the connection.
-func (m *Manager) clusterCustomPorts(ctx context.Context, svc *service.Service) *bool {
-	if !service.IsL4Protocol(svc.Mode) {
-		return nil
-	}
-	return m.capabilities.ClusterSupportsCustomPorts(ctx, svc.ProxyCluster)
-}
-
 // ensureL4Port auto-assigns a listen port when needed and validates cluster support.
-// customPorts must be pre-computed via clusterCustomPorts before entering a transaction.
-func (m *Manager) ensureL4Port(ctx context.Context, tx store.Store, svc *service.Service, customPorts *bool) error {
+func (m *Manager) ensureL4Port(ctx context.Context, tx store.Store, svc *service.Service) error {
 	if !service.IsL4Protocol(svc.Mode) {
 		return nil
 	}
+	customPorts := m.capabilities.ClusterSupportsCustomPorts(ctx, svc.ProxyCluster)
 	if service.IsPortBasedProtocol(svc.Mode) && svc.ListenPort > 0 && (customPorts == nil || !*customPorts) {
 		if svc.Source != service.SourceEphemeral {
 			return status.Errorf(status.InvalidArgument, "custom ports not supported on cluster %s", svc.ProxyCluster)
@@ -417,14 +404,12 @@ func (m *Manager) assignPort(ctx context.Context, tx store.Store, cluster string
 // The count and exists queries use FOR UPDATE locking to serialize concurrent creates
 // for the same peer, preventing the per-peer limit from being bypassed.
 func (m *Manager) persistNewEphemeralService(ctx context.Context, accountID, peerID string, svc *service.Service) error {
-	customPorts := m.clusterCustomPorts(ctx, svc)
-
 	return m.store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
 		if err := m.validateEphemeralPreconditions(ctx, transaction, accountID, peerID, svc); err != nil {
 			return err
 		}
 
-		if err := m.ensureL4Port(ctx, transaction, svc, customPorts); err != nil {
+		if err := m.ensureL4Port(ctx, transaction, svc); err != nil {
 			return err
 		}
 
@@ -527,49 +512,16 @@ type serviceUpdateInfo struct {
 }
 
 func (m *Manager) persistServiceUpdate(ctx context.Context, accountID string, service *service.Service) (*serviceUpdateInfo, error) {
-	effectiveCluster, err := m.resolveEffectiveCluster(ctx, accountID, service)
-	if err != nil {
-		return nil, err
-	}
-
-	svcForCaps := *service
-	svcForCaps.ProxyCluster = effectiveCluster
-	customPorts := m.clusterCustomPorts(ctx, &svcForCaps)
-
 	var updateInfo serviceUpdateInfo
 
-	err = m.store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
-		return m.executeServiceUpdate(ctx, transaction, accountID, service, &updateInfo, customPorts)
+	err := m.store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
+		return m.executeServiceUpdate(ctx, transaction, accountID, service, &updateInfo)
 	})
 
 	return &updateInfo, err
 }
 
-// resolveEffectiveCluster determines the cluster that will be used after the update.
-// It reads the existing service without locking and derives the new cluster if the domain changed.
-func (m *Manager) resolveEffectiveCluster(ctx context.Context, accountID string, svc *service.Service) (string, error) {
-	existing, err := m.store.GetServiceByID(ctx, store.LockingStrengthNone, accountID, svc.ID)
-	if err != nil {
-		return "", err
-	}
-
-	if existing.Domain == svc.Domain {
-		return existing.ProxyCluster, nil
-	}
-
-	if m.clusterDeriver != nil {
-		derived, err := m.clusterDeriver.DeriveClusterFromDomain(ctx, accountID, svc.Domain)
-		if err != nil {
-			log.WithError(err).Warnf("could not derive cluster from domain %s", svc.Domain)
-		} else {
-			return derived, nil
-		}
-	}
-
-	return existing.ProxyCluster, nil
-}
-
-func (m *Manager) executeServiceUpdate(ctx context.Context, transaction store.Store, accountID string, service *service.Service, updateInfo *serviceUpdateInfo, customPorts *bool) error {
+func (m *Manager) executeServiceUpdate(ctx context.Context, transaction store.Store, accountID string, service *service.Service, updateInfo *serviceUpdateInfo) error {
 	existingService, err := transaction.GetServiceByID(ctx, store.LockingStrengthUpdate, accountID, service.ID)
 	if err != nil {
 		return err
@@ -606,7 +558,7 @@ func (m *Manager) executeServiceUpdate(ctx context.Context, transaction store.St
 	m.preserveListenPort(service, existingService)
 	updateInfo.serviceEnabledChanged = existingService.Enabled != service.Enabled
 
-	if err := m.ensureL4Port(ctx, transaction, service, customPorts); err != nil {
+	if err := m.ensureL4Port(ctx, transaction, service); err != nil {
 		return err
 	}
 	if err := m.checkPortConflict(ctx, transaction, service); err != nil {

management/internals/modules/reverseproxy/service/service.go

@@ -787,11 +787,6 @@ func (s *Service) validateHTTPTargets() error {
 }
 
 func (s *Service) validateL4Target(target *Target) error {
-	// L4 services have a single target; per-target disable is meaningless
-	// (use the service-level Enabled flag instead). Force it on so that
-	// buildPathMappings always includes the target in the proto.
-	target.Enabled = true
-
 	if target.Port == 0 {
 		return errors.New("target port is required for L4 services")
 	}

management/internals/shared/grpc/server.go

@@ -966,7 +966,6 @@ func (s *Server) GetDeviceAuthorizationFlow(ctx context.Context, req *proto.Encr
 			Provider: proto.DeviceAuthorizationFlowProvider(provider),
 			ProviderConfig: &proto.ProviderConfig{
 				ClientID:           s.config.DeviceAuthorizationFlow.ProviderConfig.ClientID,
-				ClientSecret:       s.config.DeviceAuthorizationFlow.ProviderConfig.ClientSecret,
 				Domain:             s.config.DeviceAuthorizationFlow.ProviderConfig.Domain,
 				Audience:           s.config.DeviceAuthorizationFlow.ProviderConfig.Audience,
 				DeviceAuthEndpoint: s.config.DeviceAuthorizationFlow.ProviderConfig.DeviceAuthEndpoint,
@@ -1037,7 +1036,6 @@ func (s *Server) GetPKCEAuthorizationFlow(ctx context.Context, req *proto.Encryp
 			ProviderConfig: &proto.ProviderConfig{
 				Audience:              s.config.PKCEAuthorizationFlow.ProviderConfig.Audience,
 				ClientID:              s.config.PKCEAuthorizationFlow.ProviderConfig.ClientID,
-				ClientSecret:          s.config.PKCEAuthorizationFlow.ProviderConfig.ClientSecret,
 				TokenEndpoint:         s.config.PKCEAuthorizationFlow.ProviderConfig.TokenEndpoint,
 				AuthorizationEndpoint: s.config.PKCEAuthorizationFlow.ProviderConfig.AuthorizationEndpoint,
 				Scope:                 s.config.PKCEAuthorizationFlow.ProviderConfig.Scope,

management/server/instance/manager.go

@@ -64,19 +64,10 @@ type Manager interface {
 	GetVersionInfo(ctx context.Context) (*VersionInfo, error)
 }
 
-type instanceStore interface {
-	GetAccountsCounter(ctx context.Context) (int64, error)
-}
-
-type embeddedIdP interface {
-	CreateUserWithPassword(ctx context.Context, email, password, name string) (*idp.UserData, error)
-	GetAllAccounts(ctx context.Context) (map[string][]*idp.UserData, error)
-}
-
 // DefaultManager is the default implementation of Manager.
 type DefaultManager struct {
-	store              instanceStore
-	embeddedIdpManager embeddedIdP
+	store              store.Store
+	embeddedIdpManager *idp.EmbeddedIdPManager
 
 	setupRequired bool
 	setupMu       sync.RWMutex
@@ -91,18 +82,18 @@ type DefaultManager struct {
 // NewManager creates a new instance manager.
 // If idpManager is not an EmbeddedIdPManager, setup-related operations will return appropriate defaults.
 func NewManager(ctx context.Context, store store.Store, idpManager idp.Manager) (Manager, error) {
-	embeddedIdp, ok := idpManager.(*idp.EmbeddedIdPManager)
+	embeddedIdp, _ := idpManager.(*idp.EmbeddedIdPManager)
 
 	m := &DefaultManager{
-		store:         store,
-		setupRequired: false,
+		store:              store,
+		embeddedIdpManager: embeddedIdp,
+		setupRequired:      false,
 		httpClient: &http.Client{
 			Timeout: httpTimeout,
 		},
 	}
 
-	if ok && embeddedIdp != nil {
-		m.embeddedIdpManager = embeddedIdp
+	if embeddedIdp != nil {
 		err := m.loadSetupRequired(ctx)
 		if err != nil {
 			return nil, err
@@ -152,27 +143,20 @@ func (m *DefaultManager) IsSetupRequired(_ context.Context) (bool, error) {
 // CreateOwnerUser creates the initial owner user in the embedded IDP.
 func (m *DefaultManager) CreateOwnerUser(ctx context.Context, email, password, name string) (*idp.UserData, error) {
 
-	if m.embeddedIdpManager == nil {
-		return nil, errors.New("embedded IDP is not enabled")
-	}
-
 	if err := m.validateSetupInfo(email, password, name); err != nil {
 		return nil, err
 	}
 
-	m.setupMu.Lock()
-	defer m.setupMu.Unlock()
-
-	if !m.setupRequired {
-		return nil, status.Errorf(status.PreconditionFailed, "setup already completed")
+	if m.embeddedIdpManager == nil {
+		return nil, errors.New("embedded IDP is not enabled")
 	}
 
-	if err := m.checkSetupRequiredFromDB(ctx); err != nil {
-		var sErr *status.Error
-		if errors.As(err, &sErr) && sErr.Type() == status.PreconditionFailed {
-			m.setupRequired = false
-		}
-		return nil, err
+	m.setupMu.RLock()
+	setupRequired := m.setupRequired
+	m.setupMu.RUnlock()
+
+	if !setupRequired {
+		return nil, status.Errorf(status.PreconditionFailed, "setup already completed")
 	}
 
 	userData, err := m.embeddedIdpManager.CreateUserWithPassword(ctx, email, password, name)
@@ -180,33 +164,15 @@ func (m *DefaultManager) CreateOwnerUser(ctx context.Context, email, password, n
 		return nil, fmt.Errorf("failed to create user in embedded IdP: %w", err)
 	}
 
+	m.setupMu.Lock()
 	m.setupRequired = false
+	m.setupMu.Unlock()
 
 	log.WithContext(ctx).Infof("created owner user %s in embedded IdP", email)
 
 	return userData, nil
 }
 
-func (m *DefaultManager) checkSetupRequiredFromDB(ctx context.Context) error {
-	numAccounts, err := m.store.GetAccountsCounter(ctx)
-	if err != nil {
-		return fmt.Errorf("failed to check accounts: %w", err)
-	}
-	if numAccounts > 0 {
-		return status.Errorf(status.PreconditionFailed, "setup already completed")
-	}
-
-	users, err := m.embeddedIdpManager.GetAllAccounts(ctx)
-	if err != nil {
-		return fmt.Errorf("failed to check IdP users: %w", err)
-	}
-	if len(users) > 0 {
-		return status.Errorf(status.PreconditionFailed, "setup already completed")
-	}
-
-	return nil
-}
-
 func (m *DefaultManager) validateSetupInfo(email, password, name string) error {
 	if email == "" {
 		return status.Errorf(status.InvalidArgument, "email is required")
@@ -223,9 +189,6 @@ func (m *DefaultManager) validateSetupInfo(email, password, name string) error {
 	if len(password) < 8 {
 		return status.Errorf(status.InvalidArgument, "password must be at least 8 characters")
 	}
-	if len(password) > 72 {
-		return status.Errorf(status.InvalidArgument, "password must be at most 72 characters")
-	}
 	return nil
 }
 

management/server/instance/manager_test.go

@@ -3,12 +3,7 @@ package instance
 import (
 	"context"
 	"errors"
-	"fmt"
-	"net/http"
-	"sync"
-	"sync/atomic"
 	"testing"
-	"time"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -16,215 +11,173 @@ import (
 	"github.com/netbirdio/netbird/management/server/idp"
 )
 
-type mockIdP struct {
-	mu              sync.Mutex
-	createUserFunc  func(ctx context.Context, email, password, name string) (*idp.UserData, error)
-	users           map[string][]*idp.UserData
-	getAllAccountsErr error
-}
-
-func (m *mockIdP) CreateUserWithPassword(ctx context.Context, email, password, name string) (*idp.UserData, error) {
-	if m.createUserFunc != nil {
-		return m.createUserFunc(ctx, email, password, name)
-	}
-	return &idp.UserData{ID: "test-user-id", Email: email, Name: name}, nil
-}
-
-func (m *mockIdP) GetAllAccounts(_ context.Context) (map[string][]*idp.UserData, error) {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	if m.getAllAccountsErr != nil {
-		return nil, m.getAllAccountsErr
-	}
-	return m.users, nil
-}
-
+// mockStore implements a minimal store.Store for testing
 type mockStore struct {
 	accountsCount int64
 	err           error
 }
 
-func (m *mockStore) GetAccountsCounter(_ context.Context) (int64, error) {
+func (m *mockStore) GetAccountsCounter(ctx context.Context) (int64, error) {
 	if m.err != nil {
 		return 0, m.err
 	}
 	return m.accountsCount, nil
 }
 
-func newTestManager(idpMock *mockIdP, storeMock *mockStore) *DefaultManager {
-	return &DefaultManager{
-		store:              storeMock,
-		embeddedIdpManager: idpMock,
-		setupRequired:      true,
-		httpClient:         &http.Client{Timeout: httpTimeout},
+// mockEmbeddedIdPManager wraps the real EmbeddedIdPManager for testing
+type mockEmbeddedIdPManager struct {
+	createUserFunc func(ctx context.Context, email, password, name string) (*idp.UserData, error)
+}
+
+func (m *mockEmbeddedIdPManager) CreateUserWithPassword(ctx context.Context, email, password, name string) (*idp.UserData, error) {
+	if m.createUserFunc != nil {
+		return m.createUserFunc(ctx, email, password, name)
 	}
+	return &idp.UserData{
+		ID:    "test-user-id",
+		Email: email,
+		Name:  name,
+	}, nil
+}
+
+// testManager is a test implementation that accepts our mock types
+type testManager struct {
+	store              *mockStore
+	embeddedIdpManager *mockEmbeddedIdPManager
+}
+
+func (m *testManager) IsSetupRequired(ctx context.Context) (bool, error) {
+	if m.embeddedIdpManager == nil {
+		return false, nil
+	}
+
+	count, err := m.store.GetAccountsCounter(ctx)
+	if err != nil {
+		return false, err
+	}
+
+	return count == 0, nil
+}
+
+func (m *testManager) CreateOwnerUser(ctx context.Context, email, password, name string) (*idp.UserData, error) {
+	if m.embeddedIdpManager == nil {
+		return nil, errors.New("embedded IDP is not enabled")
+	}
+
+	return m.embeddedIdpManager.CreateUserWithPassword(ctx, email, password, name)
+}
+
+func TestIsSetupRequired_EmbeddedIdPDisabled(t *testing.T) {
+	manager := &testManager{
+		store:              &mockStore{accountsCount: 0},
+		embeddedIdpManager: nil, // No embedded IDP
+	}
+
+	required, err := manager.IsSetupRequired(context.Background())
+	require.NoError(t, err)
+	assert.False(t, required, "setup should not be required when embedded IDP is disabled")
+}
+
+func TestIsSetupRequired_NoAccounts(t *testing.T) {
+	manager := &testManager{
+		store:              &mockStore{accountsCount: 0},
+		embeddedIdpManager: &mockEmbeddedIdPManager{},
+	}
+
+	required, err := manager.IsSetupRequired(context.Background())
+	require.NoError(t, err)
+	assert.True(t, required, "setup should be required when no accounts exist")
+}
+
+func TestIsSetupRequired_AccountsExist(t *testing.T) {
+	manager := &testManager{
+		store:              &mockStore{accountsCount: 1},
+		embeddedIdpManager: &mockEmbeddedIdPManager{},
+	}
+
+	required, err := manager.IsSetupRequired(context.Background())
+	require.NoError(t, err)
+	assert.False(t, required, "setup should not be required when accounts exist")
+}
+
+func TestIsSetupRequired_MultipleAccounts(t *testing.T) {
+	manager := &testManager{
+		store:              &mockStore{accountsCount: 5},
+		embeddedIdpManager: &mockEmbeddedIdPManager{},
+	}
+
+	required, err := manager.IsSetupRequired(context.Background())
+	require.NoError(t, err)
+	assert.False(t, required, "setup should not be required when multiple accounts exist")
+}
+
+func TestIsSetupRequired_StoreError(t *testing.T) {
+	manager := &testManager{
+		store:              &mockStore{err: errors.New("database error")},
+		embeddedIdpManager: &mockEmbeddedIdPManager{},
+	}
+
+	_, err := manager.IsSetupRequired(context.Background())
+	assert.Error(t, err, "should return error when store fails")
 }
 
 func TestCreateOwnerUser_Success(t *testing.T) {
-	idpMock := &mockIdP{}
-	mgr := newTestManager(idpMock, &mockStore{})
+	expectedEmail := "admin@example.com"
+	expectedName := "Admin User"
+	expectedPassword := "securepassword123"
 
-	userData, err := mgr.CreateOwnerUser(context.Background(), "admin@example.com", "password123", "Admin")
+	manager := &testManager{
+		store: &mockStore{accountsCount: 0},
+		embeddedIdpManager: &mockEmbeddedIdPManager{
+			createUserFunc: func(ctx context.Context, email, password, name string) (*idp.UserData, error) {
+				assert.Equal(t, expectedEmail, email)
+				assert.Equal(t, expectedPassword, password)
+				assert.Equal(t, expectedName, name)
+				return &idp.UserData{
+					ID:    "created-user-id",
+					Email: email,
+					Name:  name,
+				}, nil
+			},
+		},
+	}
+
+	userData, err := manager.CreateOwnerUser(context.Background(), expectedEmail, expectedPassword, expectedName)
 	require.NoError(t, err)
-	assert.Equal(t, "admin@example.com", userData.Email)
-
-	_, err = mgr.CreateOwnerUser(context.Background(), "admin2@example.com", "password123", "Admin2")
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "setup already completed")
-}
-
-func TestCreateOwnerUser_SetupAlreadyCompleted(t *testing.T) {
-	mgr := newTestManager(&mockIdP{}, &mockStore{})
-	mgr.setupRequired = false
-
-	_, err := mgr.CreateOwnerUser(context.Background(), "admin@example.com", "password123", "Admin")
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "setup already completed")
+	assert.Equal(t, "created-user-id", userData.ID)
+	assert.Equal(t, expectedEmail, userData.Email)
+	assert.Equal(t, expectedName, userData.Name)
 }
 
 func TestCreateOwnerUser_EmbeddedIdPDisabled(t *testing.T) {
-	mgr := &DefaultManager{setupRequired: true}
+	manager := &testManager{
+		store:              &mockStore{accountsCount: 0},
+		embeddedIdpManager: nil,
+	}
 
-	_, err := mgr.CreateOwnerUser(context.Background(), "admin@example.com", "password123", "Admin")
-	require.Error(t, err)
+	_, err := manager.CreateOwnerUser(context.Background(), "admin@example.com", "password123", "Admin")
+	assert.Error(t, err, "should return error when embedded IDP is disabled")
 	assert.Contains(t, err.Error(), "embedded IDP is not enabled")
 }
 
 func TestCreateOwnerUser_IdPError(t *testing.T) {
-	idpMock := &mockIdP{
-		createUserFunc: func(_ context.Context, _, _, _ string) (*idp.UserData, error) {
-			return nil, errors.New("provider error")
+	manager := &testManager{
+		store: &mockStore{accountsCount: 0},
+		embeddedIdpManager: &mockEmbeddedIdPManager{
+			createUserFunc: func(ctx context.Context, email, password, name string) (*idp.UserData, error) {
+				return nil, errors.New("user already exists")
+			},
 		},
 	}
-	mgr := newTestManager(idpMock, &mockStore{})
 
-	_, err := mgr.CreateOwnerUser(context.Background(), "admin@example.com", "password123", "Admin")
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "provider error")
-
-	required, _ := mgr.IsSetupRequired(context.Background())
-	assert.True(t, required, "setup should still be required after IdP error")
-}
-
-func TestCreateOwnerUser_TransientDBError_DoesNotBlockSetup(t *testing.T) {
-	mgr := newTestManager(&mockIdP{}, &mockStore{err: errors.New("connection refused")})
-
-	_, err := mgr.CreateOwnerUser(context.Background(), "admin@example.com", "password123", "Admin")
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "connection refused")
-
-	required, _ := mgr.IsSetupRequired(context.Background())
-	assert.True(t, required, "setup should still be required after transient DB error")
-
-	mgr.store = &mockStore{}
-	userData, err := mgr.CreateOwnerUser(context.Background(), "admin@example.com", "password123", "Admin")
-	require.NoError(t, err)
-	assert.Equal(t, "admin@example.com", userData.Email)
-}
-
-func TestCreateOwnerUser_TransientIdPError_DoesNotBlockSetup(t *testing.T) {
-	idpMock := &mockIdP{getAllAccountsErr: errors.New("connection reset")}
-	mgr := newTestManager(idpMock, &mockStore{})
-
-	_, err := mgr.CreateOwnerUser(context.Background(), "admin@example.com", "password123", "Admin")
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "connection reset")
-
-	required, _ := mgr.IsSetupRequired(context.Background())
-	assert.True(t, required, "setup should still be required after transient IdP error")
-
-	idpMock.getAllAccountsErr = nil
-	userData, err := mgr.CreateOwnerUser(context.Background(), "admin@example.com", "password123", "Admin")
-	require.NoError(t, err)
-	assert.Equal(t, "admin@example.com", userData.Email)
-}
-
-func TestCreateOwnerUser_DBCheckBlocksConcurrent(t *testing.T) {
-	idpMock := &mockIdP{
-		users: map[string][]*idp.UserData{
-			"acc1": {{ID: "existing-user"}},
-		},
-	}
-	mgr := newTestManager(idpMock, &mockStore{})
-
-	_, err := mgr.CreateOwnerUser(context.Background(), "admin@example.com", "password123", "Admin")
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "setup already completed")
-}
-
-func TestCreateOwnerUser_DBCheckBlocksWhenAccountsExist(t *testing.T) {
-	mgr := newTestManager(&mockIdP{}, &mockStore{accountsCount: 1})
-
-	_, err := mgr.CreateOwnerUser(context.Background(), "admin@example.com", "password123", "Admin")
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "setup already completed")
-}
-
-func TestCreateOwnerUser_ConcurrentRequests(t *testing.T) {
-	var idpCallCount atomic.Int32
-	var successCount atomic.Int32
-	var failCount atomic.Int32
-
-	idpMock := &mockIdP{
-		createUserFunc: func(_ context.Context, email, _, _ string) (*idp.UserData, error) {
-			idpCallCount.Add(1)
-			time.Sleep(50 * time.Millisecond)
-			return &idp.UserData{ID: "user-1", Email: email, Name: "Owner"}, nil
-		},
-	}
-	mgr := newTestManager(idpMock, &mockStore{})
-
-	var wg sync.WaitGroup
-	for i := range 10 {
-		wg.Add(1)
-		go func(idx int) {
-			defer wg.Done()
-			_, err := mgr.CreateOwnerUser(
-				context.Background(),
-				fmt.Sprintf("owner%d@example.com", idx),
-				"password1234",
-				fmt.Sprintf("Owner%d", idx),
-			)
-			if err != nil {
-				failCount.Add(1)
-			} else {
-				successCount.Add(1)
-			}
-		}(i)
-	}
-	wg.Wait()
-
-	assert.Equal(t, int32(1), successCount.Load(), "exactly one concurrent setup request should succeed")
-	assert.Equal(t, int32(9), failCount.Load(), "remaining concurrent requests should fail")
-	assert.Equal(t, int32(1), idpCallCount.Load(), "IdP CreateUser should be called exactly once")
-}
-
-func TestIsSetupRequired_EmbeddedIdPDisabled(t *testing.T) {
-	mgr := &DefaultManager{}
-
-	required, err := mgr.IsSetupRequired(context.Background())
-	require.NoError(t, err)
-	assert.False(t, required)
-}
-
-func TestIsSetupRequired_ReturnsFlag(t *testing.T) {
-	mgr := newTestManager(&mockIdP{}, &mockStore{})
-
-	required, err := mgr.IsSetupRequired(context.Background())
-	require.NoError(t, err)
-	assert.True(t, required)
-
-	mgr.setupMu.Lock()
-	mgr.setupRequired = false
-	mgr.setupMu.Unlock()
-
-	required, err = mgr.IsSetupRequired(context.Background())
-	require.NoError(t, err)
-	assert.False(t, required)
+	_, err := manager.CreateOwnerUser(context.Background(), "admin@example.com", "password123", "Admin")
+	assert.Error(t, err, "should return error when IDP fails")
 }
 
 func TestDefaultManager_ValidateSetupRequest(t *testing.T) {
-	manager := &DefaultManager{setupRequired: true}
+	manager := &DefaultManager{
+		setupRequired: true,
+	}
 
 	tests := []struct {
 		name        string
@@ -235,10 +188,11 @@ func TestDefaultManager_ValidateSetupRequest(t *testing.T) {
 		errorMsg    string
 	}{
 		{
-			name:     "valid request",
-			email:    "admin@example.com",
-			password: "password123",
-			userName: "Admin User",
+			name:        "valid request",
+			email:       "admin@example.com",
+			password:    "password123",
+			userName:    "Admin User",
+			expectError: false,
 		},
 		{
 			name:        "empty email",
@@ -281,24 +235,11 @@ func TestDefaultManager_ValidateSetupRequest(t *testing.T) {
 			errorMsg:    "password must be at least 8 characters",
 		},
 		{
-			name:     "password exactly 8 characters",
-			email:    "admin@example.com",
-			password: "12345678",
-			userName: "Admin User",
-		},
-		{
-			name:     "password exactly 72 characters",
-			email:    "admin@example.com",
-			password: "aaaaaaaabbbbbbbbccccccccddddddddeeeeeeeeffffffffgggggggghhhhhhhhiiiiiiii",
-			userName: "Admin User",
-		},
-		{
-			name:        "password too long",
+			name:        "password exactly 8 characters",
 			email:       "admin@example.com",
-			password:    "aaaaaaaabbbbbbbbccccccccddddddddeeeeeeeeffffffffgggggggghhhhhhhhiiiiiiiij",
+			password:    "12345678",
 			userName:    "Admin User",
-			expectError: true,
-			errorMsg:    "password must be at most 72 characters",
+			expectError: false,
 		},
 	}
 
@@ -314,3 +255,14 @@ func TestDefaultManager_ValidateSetupRequest(t *testing.T) {
 		})
 	}
 }
+
+func TestDefaultManager_CreateOwnerUser_SetupAlreadyCompleted(t *testing.T) {
+	manager := &DefaultManager{
+		setupRequired:      false,
+		embeddedIdpManager: &idp.EmbeddedIdPManager{},
+	}
+
+	_, err := manager.CreateOwnerUser(context.Background(), "admin@example.com", "password123", "Admin")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "setup already completed")
+}

management/server/user.go

@@ -780,15 +780,9 @@ func (am *DefaultAccountManager) processUserUpdate(ctx context.Context, transact
 	updatedUser.Role = update.Role
 	updatedUser.Blocked = update.Blocked
 	updatedUser.AutoGroups = update.AutoGroups
-	// these fields can't be set via API, only via direct call to the method
+	// these two fields can't be set via API, only via direct call to the method
 	updatedUser.Issued = update.Issued
 	updatedUser.IntegrationReference = update.IntegrationReference
-	if update.Name != "" {
-		updatedUser.Name = update.Name
-	}
-	if update.Email != "" {
-		updatedUser.Email = update.Email
-	}
 
 	var transferredOwnerRole bool
 	result, err := handleOwnerRoleTransfer(ctx, transaction, initiatorUser, update)

shared/management/client/client_test.go

@@ -545,8 +545,7 @@ func Test_GetPKCEAuthorizationFlow(t *testing.T) {
 
 	expectedFlowInfo := &mgmtProto.PKCEAuthorizationFlow{
 		ProviderConfig: &mgmtProto.ProviderConfig{
-			ClientID:     "client",
-			ClientSecret: "secret",
+			ClientID: "client",
 		},
 	}
 
@@ -569,5 +568,4 @@ func Test_GetPKCEAuthorizationFlow(t *testing.T) {
 	}
 
 	assert.Equal(t, expectedFlowInfo.ProviderConfig.ClientID, flowInfo.ProviderConfig.ClientID, "provider configured client ID should match")
-	assert.Equal(t, expectedFlowInfo.ProviderConfig.ClientSecret, flowInfo.ProviderConfig.ClientSecret, "provider configured client secret should match") //nolint:staticcheck
 }

shared/management/http/api/openapi.yml

@@ -4414,9 +4414,6 @@ components:
           items:
             type: string
           example: [ "Users" ]
-        connector_id:
-          type: string
-          description: DEX connector ID for embedded IDP setups
     IntegrationEnabled:
       type: object
       properties:

shared/management/http/api/types.gen.go

@@ -1492,9 +1492,6 @@ type AzureIntegration struct {
 	// ClientId Azure AD application (client) ID
 	ClientId string `json:"client_id"`
 
-	// ConnectorId DEX connector ID for embedded IDP setups
-	ConnectorId *string `json:"connector_id,omitempty"`
-
 	// Enabled Whether the integration is enabled
 	Enabled bool `json:"enabled"`
 
@@ -1635,9 +1632,6 @@ type CreateAzureIntegrationRequest struct {
 	// ClientSecret Base64-encoded Azure AD client secret
 	ClientSecret string `json:"client_secret"`
 
-	// ConnectorId DEX connector ID for embedded IDP setups
-	ConnectorId *string `json:"connector_id,omitempty"`
-
 	// GroupPrefixes List of start_with string patterns for groups to sync
 	GroupPrefixes *[]string `json:"group_prefixes,omitempty"`
 
@@ -1659,9 +1653,6 @@ type CreateAzureIntegrationRequestHost string
 
 // CreateGoogleIntegrationRequest defines model for CreateGoogleIntegrationRequest.
 type CreateGoogleIntegrationRequest struct {
-	// ConnectorId DEX connector ID for embedded IDP setups
-	ConnectorId *string `json:"connector_id,omitempty"`
-
 	// CustomerId Customer ID from Google Workspace Account Settings
 	CustomerId string `json:"customer_id"`
 
@@ -1698,9 +1689,6 @@ type CreateOktaScimIntegrationRequest struct {
 	// ConnectionName The Okta enterprise connection name on Auth0
 	ConnectionName string `json:"connection_name"`
 
-	// ConnectorId DEX connector ID for embedded IDP setups
-	ConnectorId *string `json:"connector_id,omitempty"`
-
 	// GroupPrefixes List of start_with string patterns for groups to sync
 	GroupPrefixes *[]string `json:"group_prefixes,omitempty"`
 
@@ -1710,9 +1698,6 @@ type CreateOktaScimIntegrationRequest struct {
 
 // CreateScimIntegrationRequest defines model for CreateScimIntegrationRequest.
 type CreateScimIntegrationRequest struct {
-	// ConnectorId DEX connector ID for embedded IDP setups
-	ConnectorId *string `json:"connector_id,omitempty"`
-
 	// GroupPrefixes List of start_with string patterns for groups to sync
 	GroupPrefixes *[]string `json:"group_prefixes,omitempty"`
 
@@ -2169,9 +2154,6 @@ type GetTenantsResponse = []TenantResponse
 
 // GoogleIntegration defines model for GoogleIntegration.
 type GoogleIntegration struct {
-	// ConnectorId DEX connector ID for embedded IDP setups
-	ConnectorId *string `json:"connector_id,omitempty"`
-
 	// CustomerId Customer ID from Google Workspace
 	CustomerId string `json:"customer_id"`
 
@@ -2520,9 +2502,6 @@ type IntegrationResponsePlatform string
 
 // IntegrationSyncFilters defines model for IntegrationSyncFilters.
 type IntegrationSyncFilters struct {
-	// ConnectorId DEX connector ID for embedded IDP setups
-	ConnectorId *string `json:"connector_id,omitempty"`
-
 	// GroupPrefixes List of start_with string patterns for groups to sync
 	GroupPrefixes *[]string `json:"group_prefixes,omitempty"`
 
@@ -3015,9 +2994,6 @@ type OktaScimIntegration struct {
 	// AuthToken SCIM API token (full on creation/regeneration, masked on retrieval)
 	AuthToken string `json:"auth_token"`
 
-	// ConnectorId DEX connector ID for embedded IDP setups
-	ConnectorId *string `json:"connector_id,omitempty"`
-
 	// Enabled Whether the integration is enabled
 	Enabled bool `json:"enabled"`
 
@@ -3888,9 +3864,6 @@ type ScimIntegration struct {
 	// AuthToken SCIM API token (full on creation, masked otherwise)
 	AuthToken string `json:"auth_token"`
 
-	// ConnectorId DEX connector ID for embedded IDP setups
-	ConnectorId *string `json:"connector_id,omitempty"`
-
 	// Enabled Whether the integration is enabled
 	Enabled bool `json:"enabled"`
 
@@ -4368,9 +4341,6 @@ type UpdateAzureIntegrationRequest struct {
 	// ClientSecret Base64-encoded Azure AD client secret
 	ClientSecret *string `json:"client_secret,omitempty"`
 
-	// ConnectorId DEX connector ID for embedded IDP setups
-	ConnectorId *string `json:"connector_id,omitempty"`
-
 	// Enabled Whether the integration is enabled
 	Enabled *bool `json:"enabled,omitempty"`
 
@@ -4389,9 +4359,6 @@ type UpdateAzureIntegrationRequest struct {
 
 // UpdateGoogleIntegrationRequest defines model for UpdateGoogleIntegrationRequest.
 type UpdateGoogleIntegrationRequest struct {
-	// ConnectorId DEX connector ID for embedded IDP setups
-	ConnectorId *string `json:"connector_id,omitempty"`
-
 	// CustomerId Customer ID from Google Workspace Account Settings
 	CustomerId *string `json:"customer_id,omitempty"`
 
@@ -4413,9 +4380,6 @@ type UpdateGoogleIntegrationRequest struct {
 
 // UpdateOktaScimIntegrationRequest defines model for UpdateOktaScimIntegrationRequest.
 type UpdateOktaScimIntegrationRequest struct {
-	// ConnectorId DEX connector ID for embedded IDP setups
-	ConnectorId *string `json:"connector_id,omitempty"`
-
 	// Enabled Whether the integration is enabled
 	Enabled *bool `json:"enabled,omitempty"`
 
@@ -4428,9 +4392,6 @@ type UpdateOktaScimIntegrationRequest struct {
 
 // UpdateScimIntegrationRequest defines model for UpdateScimIntegrationRequest.
 type UpdateScimIntegrationRequest struct {
-	// ConnectorId DEX connector ID for embedded IDP setups
-	ConnectorId *string `json:"connector_id,omitempty"`
-
 	// Enabled Whether the integration is enabled
 	Enabled *bool `json:"enabled,omitempty"`