chore: move the go code into a subfolder

2025-08-12 10:49:25 +00:00 · 2025-08-05 15:20:32 -07:00
parent 4ad22ba456
commit cd2921de26
2978 changed files with 373 additions and 300 deletions
--- a/apps/api/internal/repository/idp/apple.go
+++ b/apps/api/internal/repository/idp/apple.go
@@ -0,0 +1,161 @@
+package idp
+
+import (
+	"github.com/zitadel/zitadel/internal/crypto"
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+type AppleIDPAddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ID         string              `json:"id"`
+	Name       string              `json:"name,omitempty"`
+	ClientID   string              `json:"clientId"`
+	TeamID     string              `json:"teamId"`
+	KeyID      string              `json:"keyId"`
+	PrivateKey *crypto.CryptoValue `json:"privateKey"`
+	Scopes     []string            `json:"scopes,omitempty"`
+	Options
+}
+
+func NewAppleIDPAddedEvent(
+	base *eventstore.BaseEvent,
+	id,
+	name,
+	clientID,
+	teamID,
+	keyID string,
+	privateKey *crypto.CryptoValue,
+	scopes []string,
+	options Options,
+) *AppleIDPAddedEvent {
+	return &AppleIDPAddedEvent{
+		BaseEvent:  *base,
+		ID:         id,
+		Name:       name,
+		ClientID:   clientID,
+		TeamID:     teamID,
+		KeyID:      keyID,
+		PrivateKey: privateKey,
+		Scopes:     scopes,
+		Options:    options,
+	}
+}
+
+func (e *AppleIDPAddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *AppleIDPAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func AppleIDPAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &AppleIDPAddedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-Beqss", "unable to unmarshal event")
+	}
+
+	return e, nil
+}
+
+type AppleIDPChangedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ID         string              `json:"id"`
+	Name       *string             `json:"name,omitempty"`
+	ClientID   *string             `json:"clientId,omitempty"`
+	TeamID     *string             `json:"teamId,omitempty"`
+	KeyID      *string             `json:"keyId,omitempty"`
+	PrivateKey *crypto.CryptoValue `json:"privateKey,omitempty"`
+	Scopes     []string            `json:"scopes,omitempty"`
+	OptionChanges
+}
+
+func NewAppleIDPChangedEvent(
+	base *eventstore.BaseEvent,
+	id string,
+	changes []AppleIDPChanges,
+) (*AppleIDPChangedEvent, error) {
+	if len(changes) == 0 {
+		return nil, zerrors.ThrowPreconditionFailed(nil, "IDP-SF3h2", "Errors.NoChangesFound")
+	}
+	changedEvent := &AppleIDPChangedEvent{
+		BaseEvent: *base,
+		ID:        id,
+	}
+	for _, change := range changes {
+		change(changedEvent)
+	}
+	return changedEvent, nil
+}
+
+type AppleIDPChanges func(*AppleIDPChangedEvent)
+
+func ChangeAppleName(name string) func(*AppleIDPChangedEvent) {
+	return func(e *AppleIDPChangedEvent) {
+		e.Name = &name
+	}
+}
+
+func ChangeAppleClientID(clientID string) func(*AppleIDPChangedEvent) {
+	return func(e *AppleIDPChangedEvent) {
+		e.ClientID = &clientID
+	}
+}
+
+func ChangeAppleTeamID(teamID string) func(*AppleIDPChangedEvent) {
+	return func(e *AppleIDPChangedEvent) {
+		e.TeamID = &teamID
+	}
+}
+
+func ChangeAppleKeyID(keyID string) func(*AppleIDPChangedEvent) {
+	return func(e *AppleIDPChangedEvent) {
+		e.KeyID = &keyID
+	}
+}
+
+func ChangeApplePrivateKey(privateKey *crypto.CryptoValue) func(*AppleIDPChangedEvent) {
+	return func(e *AppleIDPChangedEvent) {
+		e.PrivateKey = privateKey
+	}
+}
+
+func ChangeAppleScopes(scopes []string) func(*AppleIDPChangedEvent) {
+	return func(e *AppleIDPChangedEvent) {
+		e.Scopes = scopes
+	}
+}
+
+func ChangeAppleOptions(options OptionChanges) func(*AppleIDPChangedEvent) {
+	return func(e *AppleIDPChangedEvent) {
+		e.OptionChanges = options
+	}
+}
+
+func (e *AppleIDPChangedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *AppleIDPChangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func AppleIDPChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &AppleIDPChangedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-NBe1s", "unable to unmarshal event")
+	}
+
+	return e, nil
+}
--- a/apps/api/internal/repository/idp/azuread.go
+++ b/apps/api/internal/repository/idp/azuread.go
@@ -0,0 +1,161 @@
+package idp
+
+import (
+	"github.com/zitadel/zitadel/internal/crypto"
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+type AzureADIDPAddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ID              string              `json:"id"`
+	Name            string              `json:"name,omitempty"`
+	ClientID        string              `json:"client_id,omitempty"`
+	ClientSecret    *crypto.CryptoValue `json:"client_secret,omitempty"`
+	Scopes          []string            `json:"scopes,omitempty"`
+	Tenant          string              `json:"tenant,omitempty"`
+	IsEmailVerified bool                `json:"isEmailVerified,omitempty"`
+	Options
+}
+
+func NewAzureADIDPAddedEvent(
+	base *eventstore.BaseEvent,
+	id,
+	name,
+	clientID string,
+	clientSecret *crypto.CryptoValue,
+	scopes []string,
+	tenant string,
+	isEmailVerified bool,
+	options Options,
+) *AzureADIDPAddedEvent {
+	return &AzureADIDPAddedEvent{
+		BaseEvent:       *base,
+		ID:              id,
+		Name:            name,
+		ClientID:        clientID,
+		ClientSecret:    clientSecret,
+		Scopes:          scopes,
+		Tenant:          tenant,
+		IsEmailVerified: isEmailVerified,
+		Options:         options,
+	}
+}
+
+func (e *AzureADIDPAddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *AzureADIDPAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func AzureADIDPAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &AzureADIDPAddedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-Grh2g", "unable to unmarshal event")
+	}
+
+	return e, nil
+}
+
+type AzureADIDPChangedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ID              string              `json:"id"`
+	Name            *string             `json:"name,omitempty"`
+	ClientID        *string             `json:"client_id,omitempty"`
+	ClientSecret    *crypto.CryptoValue `json:"client_secret,omitempty"`
+	Scopes          []string            `json:"scopes,omitempty"`
+	Tenant          *string             `json:"tenant,omitempty"`
+	IsEmailVerified *bool               `json:"isEmailVerified,omitempty"`
+	OptionChanges
+}
+
+func NewAzureADIDPChangedEvent(
+	base *eventstore.BaseEvent,
+	id string,
+	changes []AzureADIDPChanges,
+) (*AzureADIDPChangedEvent, error) {
+	if len(changes) == 0 {
+		return nil, zerrors.ThrowPreconditionFailed(nil, "IDP-BH3dl", "Errors.NoChangesFound")
+	}
+	changedEvent := &AzureADIDPChangedEvent{
+		BaseEvent: *base,
+		ID:        id,
+	}
+	for _, change := range changes {
+		change(changedEvent)
+	}
+	return changedEvent, nil
+}
+
+type AzureADIDPChanges func(*AzureADIDPChangedEvent)
+
+func ChangeAzureADName(name string) func(*AzureADIDPChangedEvent) {
+	return func(e *AzureADIDPChangedEvent) {
+		e.Name = &name
+	}
+}
+
+func ChangeAzureADClientID(clientID string) func(*AzureADIDPChangedEvent) {
+	return func(e *AzureADIDPChangedEvent) {
+		e.ClientID = &clientID
+	}
+}
+
+func ChangeAzureADClientSecret(clientSecret *crypto.CryptoValue) func(*AzureADIDPChangedEvent) {
+	return func(e *AzureADIDPChangedEvent) {
+		e.ClientSecret = clientSecret
+	}
+}
+
+func ChangeAzureADOptions(options OptionChanges) func(*AzureADIDPChangedEvent) {
+	return func(e *AzureADIDPChangedEvent) {
+		e.OptionChanges = options
+	}
+}
+
+func ChangeAzureADScopes(scopes []string) func(*AzureADIDPChangedEvent) {
+	return func(e *AzureADIDPChangedEvent) {
+		e.Scopes = scopes
+	}
+}
+
+func ChangeAzureADTenant(tenant string) func(*AzureADIDPChangedEvent) {
+	return func(e *AzureADIDPChangedEvent) {
+		e.Tenant = &tenant
+	}
+}
+
+func ChangeAzureADIsEmailVerified(isEmailVerified bool) func(*AzureADIDPChangedEvent) {
+	return func(e *AzureADIDPChangedEvent) {
+		e.IsEmailVerified = &isEmailVerified
+	}
+}
+
+func (e *AzureADIDPChangedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *AzureADIDPChangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func AzureADIDPChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &AzureADIDPChangedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-D3gjzh", "unable to unmarshal event")
+	}
+
+	return e, nil
+}
--- a/apps/api/internal/repository/idp/github.go
+++ b/apps/api/internal/repository/idp/github.go
@@ -0,0 +1,303 @@
+package idp
+
+import (
+	"github.com/zitadel/zitadel/internal/crypto"
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+type GitHubIDPAddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ID           string              `json:"id"`
+	Name         string              `json:"name,omitempty"`
+	ClientID     string              `json:"clientId,omitempty"`
+	ClientSecret *crypto.CryptoValue `json:"clientSecret,omitempty"`
+	Scopes       []string            `json:"scopes,omitempty"`
+	Options
+}
+
+func NewGitHubIDPAddedEvent(
+	base *eventstore.BaseEvent,
+	id,
+	name,
+	clientID string,
+	clientSecret *crypto.CryptoValue,
+	scopes []string,
+	options Options,
+) *GitHubIDPAddedEvent {
+	return &GitHubIDPAddedEvent{
+		BaseEvent:    *base,
+		ID:           id,
+		Name:         name,
+		ClientID:     clientID,
+		ClientSecret: clientSecret,
+		Scopes:       scopes,
+		Options:      options,
+	}
+}
+
+func (e *GitHubIDPAddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *GitHubIDPAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func GitHubIDPAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &GitHubIDPAddedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-sdfs3", "unable to unmarshal event")
+	}
+
+	return e, nil
+}
+
+type GitHubIDPChangedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ID           string              `json:"id"`
+	Name         *string             `json:"name,omitempty"`
+	ClientID     *string             `json:"clientId,omitempty"`
+	ClientSecret *crypto.CryptoValue `json:"clientSecret,omitempty"`
+	Scopes       []string            `json:"scopes,omitempty"`
+	OptionChanges
+}
+
+func NewGitHubIDPChangedEvent(
+	base *eventstore.BaseEvent,
+	id string,
+	changes []GitHubIDPChanges,
+) (*GitHubIDPChangedEvent, error) {
+	if len(changes) == 0 {
+		return nil, zerrors.ThrowPreconditionFailed(nil, "IDP-BH3dl", "Errors.NoChangesFound")
+	}
+	changedEvent := &GitHubIDPChangedEvent{
+		BaseEvent: *base,
+		ID:        id,
+	}
+	for _, change := range changes {
+		change(changedEvent)
+	}
+	return changedEvent, nil
+}
+
+type GitHubIDPChanges func(*GitHubIDPChangedEvent)
+
+func ChangeGitHubName(name string) func(*GitHubIDPChangedEvent) {
+	return func(e *GitHubIDPChangedEvent) {
+		e.Name = &name
+	}
+}
+func ChangeGitHubClientID(clientID string) func(*GitHubIDPChangedEvent) {
+	return func(e *GitHubIDPChangedEvent) {
+		e.ClientID = &clientID
+	}
+}
+
+func ChangeGitHubClientSecret(clientSecret *crypto.CryptoValue) func(*GitHubIDPChangedEvent) {
+	return func(e *GitHubIDPChangedEvent) {
+		e.ClientSecret = clientSecret
+	}
+}
+
+func ChangeGitHubOptions(options OptionChanges) func(*GitHubIDPChangedEvent) {
+	return func(e *GitHubIDPChangedEvent) {
+		e.OptionChanges = options
+	}
+}
+
+func ChangeGitHubScopes(scopes []string) func(*GitHubIDPChangedEvent) {
+	return func(e *GitHubIDPChangedEvent) {
+		e.Scopes = scopes
+	}
+}
+
+func (e *GitHubIDPChangedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *GitHubIDPChangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func GitHubIDPChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &GitHubIDPChangedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-Sfrth", "unable to unmarshal event")
+	}
+
+	return e, nil
+}
+
+type GitHubEnterpriseIDPAddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ID                    string              `json:"id"`
+	Name                  string              `json:"name,omitempty"`
+	ClientID              string              `json:"clientId,omitempty"`
+	ClientSecret          *crypto.CryptoValue `json:"clientSecret,omitempty"`
+	AuthorizationEndpoint string              `json:"authorizationEndpoint,omitempty"`
+	TokenEndpoint         string              `json:"tokenEndpoint,omitempty"`
+	UserEndpoint          string              `json:"userEndpoint,omitempty"`
+	Scopes                []string            `json:"scopes,omitempty"`
+	Options
+}
+
+func NewGitHubEnterpriseIDPAddedEvent(
+	base *eventstore.BaseEvent,
+	id,
+	name,
+	clientID string,
+	clientSecret *crypto.CryptoValue,
+	authorizationEndpoint,
+	tokenEndpoint,
+	userEndpoint string,
+	scopes []string,
+	options Options,
+) *GitHubEnterpriseIDPAddedEvent {
+	return &GitHubEnterpriseIDPAddedEvent{
+		*base,
+		id,
+		name,
+		clientID,
+		clientSecret,
+		authorizationEndpoint,
+		tokenEndpoint,
+		userEndpoint,
+		scopes,
+		options,
+	}
+}
+
+func (e *GitHubEnterpriseIDPAddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *GitHubEnterpriseIDPAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func GitHubEnterpriseIDPAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &GitHubEnterpriseIDPAddedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-sdfs3", "unable to unmarshal event")
+	}
+
+	return e, nil
+}
+
+type GitHubEnterpriseIDPChangedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ID                    string              `json:"id"`
+	Name                  *string             `json:"name,omitempty"`
+	ClientID              *string             `json:"clientId,omitempty"`
+	ClientSecret          *crypto.CryptoValue `json:"clientSecret,omitempty"`
+	AuthorizationEndpoint *string             `json:"authorizationEndpoint,omitempty"`
+	TokenEndpoint         *string             `json:"tokenEndpoint,omitempty"`
+	UserEndpoint          *string             `json:"userEndpoint,omitempty"`
+	Scopes                []string            `json:"scopes,omitempty"`
+	OptionChanges
+}
+
+func NewGitHubEnterpriseIDPChangedEvent(
+	base *eventstore.BaseEvent,
+	id string,
+	changes []GitHubEnterpriseIDPChanges,
+) (*GitHubEnterpriseIDPChangedEvent, error) {
+	if len(changes) == 0 {
+		return nil, zerrors.ThrowPreconditionFailed(nil, "IDP-JHKs9", "Errors.NoChangesFound")
+	}
+	changedEvent := &GitHubEnterpriseIDPChangedEvent{
+		BaseEvent: *base,
+		ID:        id,
+	}
+	for _, change := range changes {
+		change(changedEvent)
+	}
+	return changedEvent, nil
+}
+
+type GitHubEnterpriseIDPChanges func(*GitHubEnterpriseIDPChangedEvent)
+
+func ChangeGitHubEnterpriseName(name string) func(*GitHubEnterpriseIDPChangedEvent) {
+	return func(e *GitHubEnterpriseIDPChangedEvent) {
+		e.Name = &name
+	}
+}
+func ChangeGitHubEnterpriseClientID(clientID string) func(*GitHubEnterpriseIDPChangedEvent) {
+	return func(e *GitHubEnterpriseIDPChangedEvent) {
+		e.ClientID = &clientID
+	}
+}
+
+func ChangeGitHubEnterpriseClientSecret(clientSecret *crypto.CryptoValue) func(*GitHubEnterpriseIDPChangedEvent) {
+	return func(e *GitHubEnterpriseIDPChangedEvent) {
+		e.ClientSecret = clientSecret
+	}
+}
+
+func ChangeGitHubEnterpriseOptions(options OptionChanges) func(*GitHubEnterpriseIDPChangedEvent) {
+	return func(e *GitHubEnterpriseIDPChangedEvent) {
+		e.OptionChanges = options
+	}
+}
+
+func ChangeGitHubEnterpriseAuthorizationEndpoint(authorizationEndpoint string) func(*GitHubEnterpriseIDPChangedEvent) {
+	return func(e *GitHubEnterpriseIDPChangedEvent) {
+		e.AuthorizationEndpoint = &authorizationEndpoint
+	}
+}
+
+func ChangeGitHubEnterpriseTokenEndpoint(tokenEndpoint string) func(*GitHubEnterpriseIDPChangedEvent) {
+	return func(e *GitHubEnterpriseIDPChangedEvent) {
+		e.TokenEndpoint = &tokenEndpoint
+	}
+}
+
+func ChangeGitHubEnterpriseUserEndpoint(userEndpoint string) func(*GitHubEnterpriseIDPChangedEvent) {
+	return func(e *GitHubEnterpriseIDPChangedEvent) {
+		e.UserEndpoint = &userEndpoint
+	}
+}
+
+func ChangeGitHubEnterpriseScopes(scopes []string) func(*GitHubEnterpriseIDPChangedEvent) {
+	return func(e *GitHubEnterpriseIDPChangedEvent) {
+		e.Scopes = scopes
+	}
+}
+
+func (e *GitHubEnterpriseIDPChangedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *GitHubEnterpriseIDPChangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func GitHubEnterpriseIDPChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &GitHubEnterpriseIDPChangedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-ASf3r", "unable to unmarshal event")
+	}
+
+	return e, nil
+}
--- a/apps/api/internal/repository/idp/gitlab.go
+++ b/apps/api/internal/repository/idp/gitlab.go
@@ -0,0 +1,285 @@
+package idp
+
+import (
+	"github.com/zitadel/zitadel/internal/crypto"
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+type GitLabIDPAddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ID           string              `json:"id"`
+	Name         string              `json:"name,omitempty"`
+	ClientID     string              `json:"client_id"`
+	ClientSecret *crypto.CryptoValue `json:"client_secret"`
+	Scopes       []string            `json:"scopes,omitempty"`
+	Options
+}
+
+func NewGitLabIDPAddedEvent(
+	base *eventstore.BaseEvent,
+	id,
+	name,
+	clientID string,
+	clientSecret *crypto.CryptoValue,
+	scopes []string,
+	options Options,
+) *GitLabIDPAddedEvent {
+	return &GitLabIDPAddedEvent{
+		BaseEvent:    *base,
+		ID:           id,
+		Name:         name,
+		ClientID:     clientID,
+		ClientSecret: clientSecret,
+		Scopes:       scopes,
+		Options:      options,
+	}
+}
+
+func (e *GitLabIDPAddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *GitLabIDPAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func GitLabIDPAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &GitLabIDPAddedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-KLewio", "unable to unmarshal event")
+	}
+
+	return e, nil
+}
+
+type GitLabIDPChangedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ID           string              `json:"id"`
+	Name         *string             `json:"name,omitempty"`
+	ClientID     *string             `json:"client_id,omitempty"`
+	ClientSecret *crypto.CryptoValue `json:"client_secret,omitempty"`
+	Scopes       []string            `json:"scopes,omitempty"`
+	OptionChanges
+}
+
+func NewGitLabIDPChangedEvent(
+	base *eventstore.BaseEvent,
+	id string,
+	changes []GitLabIDPChanges,
+) (*GitLabIDPChangedEvent, error) {
+	if len(changes) == 0 {
+		return nil, zerrors.ThrowPreconditionFailed(nil, "IDP-K2gje", "Errors.NoChangesFound")
+	}
+	changedEvent := &GitLabIDPChangedEvent{
+		BaseEvent: *base,
+		ID:        id,
+	}
+	for _, change := range changes {
+		change(changedEvent)
+	}
+	return changedEvent, nil
+}
+
+type GitLabIDPChanges func(*GitLabIDPChangedEvent)
+
+func ChangeGitLabName(name string) func(*GitLabIDPChangedEvent) {
+	return func(e *GitLabIDPChangedEvent) {
+		e.Name = &name
+	}
+}
+
+func ChangeGitLabClientID(clientID string) func(*GitLabIDPChangedEvent) {
+	return func(e *GitLabIDPChangedEvent) {
+		e.ClientID = &clientID
+	}
+}
+
+func ChangeGitLabClientSecret(clientSecret *crypto.CryptoValue) func(*GitLabIDPChangedEvent) {
+	return func(e *GitLabIDPChangedEvent) {
+		e.ClientSecret = clientSecret
+	}
+}
+
+func ChangeGitLabScopes(scopes []string) func(*GitLabIDPChangedEvent) {
+	return func(e *GitLabIDPChangedEvent) {
+		e.Scopes = scopes
+	}
+}
+
+func ChangeGitLabOptions(options OptionChanges) func(*GitLabIDPChangedEvent) {
+	return func(e *GitLabIDPChangedEvent) {
+		e.OptionChanges = options
+	}
+}
+
+func (e *GitLabIDPChangedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *GitLabIDPChangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func GitLabIDPChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &GitLabIDPChangedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-Sfhjk", "unable to unmarshal event")
+	}
+
+	return e, nil
+}
+
+type GitLabSelfHostedIDPAddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ID           string              `json:"id"`
+	Name         string              `json:"name"`
+	Issuer       string              `json:"issuer"`
+	ClientID     string              `json:"client_id"`
+	ClientSecret *crypto.CryptoValue `json:"client_secret"`
+	Scopes       []string            `json:"scopes,omitempty"`
+	Options
+}
+
+func NewGitLabSelfHostedIDPAddedEvent(
+	base *eventstore.BaseEvent,
+	id,
+	name,
+	issuer,
+	clientID string,
+	clientSecret *crypto.CryptoValue,
+	scopes []string,
+	options Options,
+) *GitLabSelfHostedIDPAddedEvent {
+	return &GitLabSelfHostedIDPAddedEvent{
+		BaseEvent:    *base,
+		ID:           id,
+		Name:         name,
+		Issuer:       issuer,
+		ClientID:     clientID,
+		ClientSecret: clientSecret,
+		Scopes:       scopes,
+		Options:      options,
+	}
+}
+
+func (e *GitLabSelfHostedIDPAddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *GitLabSelfHostedIDPAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func GitLabSelfHostedIDPAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &GitLabSelfHostedIDPAddedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-S1efv", "unable to unmarshal event")
+	}
+
+	return e, nil
+}
+
+type GitLabSelfHostedIDPChangedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ID           string              `json:"id"`
+	Name         *string             `json:"name,omitempty"`
+	Issuer       *string             `json:"issuer,omitempty"`
+	ClientID     *string             `json:"client_id,omitempty"`
+	ClientSecret *crypto.CryptoValue `json:"client_secret,omitempty"`
+	Scopes       []string            `json:"scopes,omitempty"`
+	OptionChanges
+}
+
+func NewGitLabSelfHostedIDPChangedEvent(
+	base *eventstore.BaseEvent,
+	id string,
+	changes []GitLabSelfHostedIDPChanges,
+) (*GitLabSelfHostedIDPChangedEvent, error) {
+	if len(changes) == 0 {
+		return nil, zerrors.ThrowPreconditionFailed(nil, "IDP-Dghj6", "Errors.NoChangesFound")
+	}
+	changedEvent := &GitLabSelfHostedIDPChangedEvent{
+		BaseEvent: *base,
+		ID:        id,
+	}
+	for _, change := range changes {
+		change(changedEvent)
+	}
+	return changedEvent, nil
+}
+
+type GitLabSelfHostedIDPChanges func(*GitLabSelfHostedIDPChangedEvent)
+
+func ChangeGitLabSelfHostedName(name string) func(*GitLabSelfHostedIDPChangedEvent) {
+	return func(e *GitLabSelfHostedIDPChangedEvent) {
+		e.Name = &name
+	}
+}
+
+func ChangeGitLabSelfHostedIssuer(issuer string) func(*GitLabSelfHostedIDPChangedEvent) {
+	return func(e *GitLabSelfHostedIDPChangedEvent) {
+		e.Issuer = &issuer
+	}
+}
+
+func ChangeGitLabSelfHostedClientID(clientID string) func(*GitLabSelfHostedIDPChangedEvent) {
+	return func(e *GitLabSelfHostedIDPChangedEvent) {
+		e.ClientID = &clientID
+	}
+}
+
+func ChangeGitLabSelfHostedClientSecret(clientSecret *crypto.CryptoValue) func(*GitLabSelfHostedIDPChangedEvent) {
+	return func(e *GitLabSelfHostedIDPChangedEvent) {
+		e.ClientSecret = clientSecret
+	}
+}
+
+func ChangeGitLabSelfHostedScopes(scopes []string) func(*GitLabSelfHostedIDPChangedEvent) {
+	return func(e *GitLabSelfHostedIDPChangedEvent) {
+		e.Scopes = scopes
+	}
+}
+
+func ChangeGitLabSelfHostedOptions(options OptionChanges) func(*GitLabSelfHostedIDPChangedEvent) {
+	return func(e *GitLabSelfHostedIDPChangedEvent) {
+		e.OptionChanges = options
+	}
+}
+
+func (e *GitLabSelfHostedIDPChangedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *GitLabSelfHostedIDPChangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func GitLabSelfHostedIDPChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &GitLabSelfHostedIDPChangedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-SFrhj", "unable to unmarshal event")
+	}
+
+	return e, nil
+}
--- a/apps/api/internal/repository/idp/google.go
+++ b/apps/api/internal/repository/idp/google.go
@@ -0,0 +1,140 @@
+package idp
+
+import (
+	"github.com/zitadel/zitadel/internal/crypto"
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+type GoogleIDPAddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ID           string              `json:"id"`
+	Name         string              `json:"name,omitempty"`
+	ClientID     string              `json:"clientId"`
+	ClientSecret *crypto.CryptoValue `json:"clientSecret"`
+	Scopes       []string            `json:"scopes,omitempty"`
+	Options
+}
+
+func NewGoogleIDPAddedEvent(
+	base *eventstore.BaseEvent,
+	id,
+	name,
+	clientID string,
+	clientSecret *crypto.CryptoValue,
+	scopes []string,
+	options Options,
+) *GoogleIDPAddedEvent {
+	return &GoogleIDPAddedEvent{
+		BaseEvent:    *base,
+		ID:           id,
+		Name:         name,
+		ClientID:     clientID,
+		ClientSecret: clientSecret,
+		Scopes:       scopes,
+		Options:      options,
+	}
+}
+
+func (e *GoogleIDPAddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *GoogleIDPAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func GoogleIDPAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &GoogleIDPAddedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-SAff1", "unable to unmarshal event")
+	}
+
+	return e, nil
+}
+
+type GoogleIDPChangedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ID           string              `json:"id"`
+	Name         *string             `json:"name,omitempty"`
+	ClientID     *string             `json:"clientId,omitempty"`
+	ClientSecret *crypto.CryptoValue `json:"clientSecret,omitempty"`
+	Scopes       []string            `json:"scopes,omitempty"`
+	OptionChanges
+}
+
+func NewGoogleIDPChangedEvent(
+	base *eventstore.BaseEvent,
+	id string,
+	changes []GoogleIDPChanges,
+) (*GoogleIDPChangedEvent, error) {
+	if len(changes) == 0 {
+		return nil, zerrors.ThrowPreconditionFailed(nil, "IDP-Dg3qs", "Errors.NoChangesFound")
+	}
+	changedEvent := &GoogleIDPChangedEvent{
+		BaseEvent: *base,
+		ID:        id,
+	}
+	for _, change := range changes {
+		change(changedEvent)
+	}
+	return changedEvent, nil
+}
+
+type GoogleIDPChanges func(*GoogleIDPChangedEvent)
+
+func ChangeGoogleName(name string) func(*GoogleIDPChangedEvent) {
+	return func(e *GoogleIDPChangedEvent) {
+		e.Name = &name
+	}
+}
+func ChangeGoogleClientID(clientID string) func(*GoogleIDPChangedEvent) {
+	return func(e *GoogleIDPChangedEvent) {
+		e.ClientID = &clientID
+	}
+}
+
+func ChangeGoogleClientSecret(clientSecret *crypto.CryptoValue) func(*GoogleIDPChangedEvent) {
+	return func(e *GoogleIDPChangedEvent) {
+		e.ClientSecret = clientSecret
+	}
+}
+
+func ChangeGoogleScopes(scopes []string) func(*GoogleIDPChangedEvent) {
+	return func(e *GoogleIDPChangedEvent) {
+		e.Scopes = scopes
+	}
+}
+
+func ChangeGoogleOptions(options OptionChanges) func(*GoogleIDPChangedEvent) {
+	return func(e *GoogleIDPChangedEvent) {
+		e.OptionChanges = options
+	}
+}
+
+func (e *GoogleIDPChangedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *GoogleIDPChangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func GoogleIDPChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &GoogleIDPChangedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-SF3t2", "unable to unmarshal event")
+	}
+
+	return e, nil
+}
--- a/apps/api/internal/repository/idp/idp.go
+++ b/apps/api/internal/repository/idp/idp.go
@@ -0,0 +1,102 @@
+package idp
+
+import (
+	"github.com/zitadel/zitadel/internal/domain"
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+type Options struct {
+	IsCreationAllowed bool                     `json:"isCreationAllowed,omitempty"`
+	IsLinkingAllowed  bool                     `json:"isLinkingAllowed,omitempty"`
+	IsAutoCreation    bool                     `json:"isAutoCreation,omitempty"`
+	IsAutoUpdate      bool                     `json:"isAutoUpdate,omitempty"`
+	AutoLinkingOption domain.AutoLinkingOption `json:"autoLinkingOption,omitempty"`
+}
+
+type OptionChanges struct {
+	IsCreationAllowed *bool                     `json:"isCreationAllowed,omitempty"`
+	IsLinkingAllowed  *bool                     `json:"isLinkingAllowed,omitempty"`
+	IsAutoCreation    *bool                     `json:"isAutoCreation,omitempty"`
+	IsAutoUpdate      *bool                     `json:"isAutoUpdate,omitempty"`
+	AutoLinkingOption *domain.AutoLinkingOption `json:"autoLinkingOption,omitempty"`
+}
+
+func (o *Options) Changes(options Options) OptionChanges {
+	opts := OptionChanges{}
+	if o.IsCreationAllowed != options.IsCreationAllowed {
+		opts.IsCreationAllowed = &options.IsCreationAllowed
+	}
+	if o.IsLinkingAllowed != options.IsLinkingAllowed {
+		opts.IsLinkingAllowed = &options.IsLinkingAllowed
+	}
+	if o.IsAutoCreation != options.IsAutoCreation {
+		opts.IsAutoCreation = &options.IsAutoCreation
+	}
+	if o.IsAutoUpdate != options.IsAutoUpdate {
+		opts.IsAutoUpdate = &options.IsAutoUpdate
+	}
+	if o.AutoLinkingOption != options.AutoLinkingOption {
+		opts.AutoLinkingOption = &options.AutoLinkingOption
+	}
+	return opts
+}
+
+func (o *Options) ReduceChanges(changes OptionChanges) {
+	if changes.IsCreationAllowed != nil {
+		o.IsCreationAllowed = *changes.IsCreationAllowed
+	}
+	if changes.IsLinkingAllowed != nil {
+		o.IsLinkingAllowed = *changes.IsLinkingAllowed
+	}
+	if changes.IsAutoCreation != nil {
+		o.IsAutoCreation = *changes.IsAutoCreation
+	}
+	if changes.IsAutoUpdate != nil {
+		o.IsAutoUpdate = *changes.IsAutoUpdate
+	}
+	if changes.AutoLinkingOption != nil {
+		o.AutoLinkingOption = *changes.AutoLinkingOption
+	}
+}
+
+func (o *OptionChanges) IsZero() bool {
+	return o.IsCreationAllowed == nil && o.IsLinkingAllowed == nil && o.IsAutoCreation == nil && o.IsAutoUpdate == nil && o.AutoLinkingOption == nil
+}
+
+type RemovedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ID string `json:"id"`
+}
+
+func NewRemovedEvent(
+	base *eventstore.BaseEvent,
+	id string,
+) *RemovedEvent {
+	return &RemovedEvent{
+		BaseEvent: *base,
+		ID:        id,
+	}
+}
+
+func (e *RemovedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *RemovedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func RemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &RemovedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-plSD2", "unable to unmarshal event")
+	}
+
+	return e, nil
+}
--- a/apps/api/internal/repository/idp/jwt.go
+++ b/apps/api/internal/repository/idp/jwt.go
@@ -0,0 +1,150 @@
+package idp
+
+import (
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+type JWTIDPAddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ID           string `json:"id"`
+	Name         string `json:"name,omitempty"`
+	Issuer       string `json:"issuer,omitempty"`
+	JWTEndpoint  string `json:"jwtEndpoint,omitempty"`
+	KeysEndpoint string `json:"keysEndpoint,omitempty"`
+	HeaderName   string `json:"headerName,omitempty"`
+	Options
+}
+
+func NewJWTIDPAddedEvent(
+	base *eventstore.BaseEvent,
+	id,
+	name,
+	issuer,
+	jwtEndpoint,
+	keysEndpoint,
+	headerName string,
+	options Options,
+) *JWTIDPAddedEvent {
+	return &JWTIDPAddedEvent{
+		BaseEvent:    *base,
+		ID:           id,
+		Name:         name,
+		Issuer:       issuer,
+		JWTEndpoint:  jwtEndpoint,
+		KeysEndpoint: keysEndpoint,
+		HeaderName:   headerName,
+		Options:      options,
+	}
+}
+
+func (e *JWTIDPAddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *JWTIDPAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func JWTIDPAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &JWTIDPAddedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-Et1dq", "unable to unmarshal event")
+	}
+
+	return e, nil
+}
+
+type JWTIDPChangedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ID           string  `json:"id"`
+	Name         *string `json:"name,omitempty"`
+	Issuer       *string `json:"issuer,omitempty"`
+	JWTEndpoint  *string `json:"jwtEndpoint,omitempty"`
+	KeysEndpoint *string `json:"keysEndpoint,omitempty"`
+	HeaderName   *string `json:"headerName,omitempty"`
+	OptionChanges
+}
+
+func NewJWTIDPChangedEvent(
+	base *eventstore.BaseEvent,
+	id string,
+	changes []JWTIDPChanges,
+) (*JWTIDPChangedEvent, error) {
+	if len(changes) == 0 {
+		return nil, zerrors.ThrowPreconditionFailed(nil, "IDP-BH3dl", "Errors.NoChangesFound")
+	}
+	changedEvent := &JWTIDPChangedEvent{
+		BaseEvent: *base,
+		ID:        id,
+	}
+	for _, change := range changes {
+		change(changedEvent)
+	}
+	return changedEvent, nil
+}
+
+type JWTIDPChanges func(*JWTIDPChangedEvent)
+
+func ChangeJWTName(name string) func(*JWTIDPChangedEvent) {
+	return func(e *JWTIDPChangedEvent) {
+		e.Name = &name
+	}
+}
+
+func ChangeJWTIssuer(issuer string) func(*JWTIDPChangedEvent) {
+	return func(e *JWTIDPChangedEvent) {
+		e.Issuer = &issuer
+	}
+}
+
+func ChangeJWTEndpoint(jwtEndpoint string) func(*JWTIDPChangedEvent) {
+	return func(e *JWTIDPChangedEvent) {
+		e.JWTEndpoint = &jwtEndpoint
+	}
+}
+
+func ChangeJWTKeysEndpoint(keysEndpoint string) func(*JWTIDPChangedEvent) {
+	return func(e *JWTIDPChangedEvent) {
+		e.KeysEndpoint = &keysEndpoint
+	}
+}
+
+func ChangeJWTHeaderName(headerName string) func(*JWTIDPChangedEvent) {
+	return func(e *JWTIDPChangedEvent) {
+		e.HeaderName = &headerName
+	}
+}
+
+func ChangeJWTOptions(options OptionChanges) func(*JWTIDPChangedEvent) {
+	return func(e *JWTIDPChangedEvent) {
+		e.OptionChanges = options
+	}
+}
+
+func (e *JWTIDPChangedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *JWTIDPChangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func JWTIDPChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &JWTIDPChangedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-D3gjzh", "unable to unmarshal event")
+	}
+
+	return e, nil
+}
--- a/apps/api/internal/repository/idp/ldap.go
+++ b/apps/api/internal/repository/idp/ldap.go
@@ -0,0 +1,359 @@
+package idp
+
+import (
+	"time"
+
+	"github.com/zitadel/zitadel/internal/crypto"
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+type LDAPIDPAddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ID                string              `json:"id"`
+	Name              string              `json:"name"`
+	Servers           []string            `json:"servers"`
+	StartTLS          bool                `json:"startTLS"`
+	BaseDN            string              `json:"baseDN"`
+	BindDN            string              `json:"bindDN"`
+	BindPassword      *crypto.CryptoValue `json:"bindPassword"`
+	UserBase          string              `json:"userBase"`
+	UserObjectClasses []string            `json:"userObjectClasses"`
+	UserFilters       []string            `json:"userFilters"`
+	Timeout           time.Duration       `json:"timeout"`
+	RootCA            []byte              `json:"rootCA"`
+
+	LDAPAttributes
+	Options
+}
+
+type LDAPAttributes struct {
+	IDAttribute                string `json:"idAttribute,omitempty"`
+	FirstNameAttribute         string `json:"firstNameAttribute,omitempty"`
+	LastNameAttribute          string `json:"lastNameAttribute,omitempty"`
+	DisplayNameAttribute       string `json:"displayNameAttribute,omitempty"`
+	NickNameAttribute          string `json:"nickNameAttribute,omitempty"`
+	PreferredUsernameAttribute string `json:"preferredUsernameAttribute,omitempty"`
+	EmailAttribute             string `json:"emailAttribute,omitempty"`
+	EmailVerifiedAttribute     string `json:"emailVerifiedAttribute,omitempty"`
+	PhoneAttribute             string `json:"phoneAttribute,omitempty"`
+	PhoneVerifiedAttribute     string `json:"phoneVerifiedAttribute,omitempty"`
+	PreferredLanguageAttribute string `json:"preferredLanguageAttribute,omitempty"`
+	AvatarURLAttribute         string `json:"avatarURLAttribute,omitempty"`
+	ProfileAttribute           string `json:"profileAttribute,omitempty"`
+}
+
+func (o *LDAPAttributes) Changes(attributes LDAPAttributes) LDAPAttributeChanges {
+	attrs := LDAPAttributeChanges{}
+	if o.IDAttribute != attributes.IDAttribute {
+		attrs.IDAttribute = &attributes.IDAttribute
+	}
+	if o.FirstNameAttribute != attributes.FirstNameAttribute {
+		attrs.FirstNameAttribute = &attributes.FirstNameAttribute
+	}
+	if o.LastNameAttribute != attributes.LastNameAttribute {
+		attrs.LastNameAttribute = &attributes.LastNameAttribute
+	}
+	if o.DisplayNameAttribute != attributes.DisplayNameAttribute {
+		attrs.DisplayNameAttribute = &attributes.DisplayNameAttribute
+	}
+	if o.NickNameAttribute != attributes.NickNameAttribute {
+		attrs.NickNameAttribute = &attributes.NickNameAttribute
+	}
+	if o.PreferredUsernameAttribute != attributes.PreferredUsernameAttribute {
+		attrs.PreferredUsernameAttribute = &attributes.PreferredUsernameAttribute
+	}
+	if o.EmailAttribute != attributes.EmailAttribute {
+		attrs.EmailAttribute = &attributes.EmailAttribute
+	}
+	if o.EmailVerifiedAttribute != attributes.EmailVerifiedAttribute {
+		attrs.EmailVerifiedAttribute = &attributes.EmailVerifiedAttribute
+	}
+	if o.PhoneAttribute != attributes.PhoneAttribute {
+		attrs.PhoneAttribute = &attributes.PhoneAttribute
+	}
+	if o.PhoneVerifiedAttribute != attributes.PhoneVerifiedAttribute {
+		attrs.PhoneVerifiedAttribute = &attributes.PhoneVerifiedAttribute
+	}
+	if o.PreferredLanguageAttribute != attributes.PreferredLanguageAttribute {
+		attrs.PreferredLanguageAttribute = &attributes.PreferredLanguageAttribute
+	}
+	if o.AvatarURLAttribute != attributes.AvatarURLAttribute {
+		attrs.AvatarURLAttribute = &attributes.AvatarURLAttribute
+	}
+	if o.ProfileAttribute != attributes.ProfileAttribute {
+		attrs.ProfileAttribute = &attributes.ProfileAttribute
+	}
+	return attrs
+}
+
+func (o *LDAPAttributes) ReduceChanges(changes LDAPAttributeChanges) {
+	if changes.IDAttribute != nil {
+		o.IDAttribute = *changes.IDAttribute
+	}
+	if changes.FirstNameAttribute != nil {
+		o.FirstNameAttribute = *changes.FirstNameAttribute
+	}
+	if changes.LastNameAttribute != nil {
+		o.LastNameAttribute = *changes.LastNameAttribute
+	}
+	if changes.DisplayNameAttribute != nil {
+		o.DisplayNameAttribute = *changes.DisplayNameAttribute
+	}
+	if changes.NickNameAttribute != nil {
+		o.NickNameAttribute = *changes.NickNameAttribute
+	}
+	if changes.PreferredUsernameAttribute != nil {
+		o.PreferredUsernameAttribute = *changes.PreferredUsernameAttribute
+	}
+	if changes.EmailAttribute != nil {
+		o.EmailAttribute = *changes.EmailAttribute
+	}
+	if changes.EmailVerifiedAttribute != nil {
+		o.EmailVerifiedAttribute = *changes.EmailVerifiedAttribute
+	}
+	if changes.PhoneAttribute != nil {
+		o.PhoneAttribute = *changes.PhoneAttribute
+	}
+	if changes.PhoneVerifiedAttribute != nil {
+		o.PhoneVerifiedAttribute = *changes.PhoneVerifiedAttribute
+	}
+	if changes.PreferredLanguageAttribute != nil {
+		o.PreferredLanguageAttribute = *changes.PreferredLanguageAttribute
+	}
+	if changes.AvatarURLAttribute != nil {
+		o.AvatarURLAttribute = *changes.AvatarURLAttribute
+	}
+	if changes.ProfileAttribute != nil {
+		o.ProfileAttribute = *changes.ProfileAttribute
+	}
+}
+
+func NewLDAPIDPAddedEvent(
+	base *eventstore.BaseEvent,
+	id string,
+	name string,
+	servers []string,
+	startTLS bool,
+	baseDN string,
+	bindDN string,
+	bindPassword *crypto.CryptoValue,
+	userBase string,
+	userObjectClasses []string,
+	userFilters []string,
+	timeout time.Duration,
+	rootCA []byte,
+	attributes LDAPAttributes,
+	options Options,
+) *LDAPIDPAddedEvent {
+	return &LDAPIDPAddedEvent{
+		BaseEvent:         *base,
+		ID:                id,
+		Name:              name,
+		Servers:           servers,
+		StartTLS:          startTLS,
+		BaseDN:            baseDN,
+		BindDN:            bindDN,
+		BindPassword:      bindPassword,
+		UserBase:          userBase,
+		UserObjectClasses: userObjectClasses,
+		UserFilters:       userFilters,
+		Timeout:           timeout,
+		RootCA:            rootCA,
+		LDAPAttributes:    attributes,
+		Options:           options,
+	}
+}
+
+func (e *LDAPIDPAddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *LDAPIDPAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func LDAPIDPAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &LDAPIDPAddedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-Dgh42", "unable to unmarshal event")
+	}
+
+	return e, nil
+}
+
+type LDAPIDPChangedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ID                string              `json:"id"`
+	Name              *string             `json:"name,omitempty"`
+	Servers           []string            `json:"servers,omitempty"`
+	StartTLS          *bool               `json:"startTLS,omitempty"`
+	BaseDN            *string             `json:"baseDN,omitempty"`
+	BindDN            *string             `json:"bindDN,omitempty"`
+	BindPassword      *crypto.CryptoValue `json:"bindPassword,omitempty"`
+	UserBase          *string             `json:"userBase,omitempty"`
+	UserObjectClasses []string            `json:"userObjectClasses,omitempty"`
+	UserFilters       []string            `json:"userFilters,omitempty"`
+	Timeout           *time.Duration      `json:"timeout,omitempty"`
+	RootCA            []byte              `json:"rootCA,omitempty"`
+
+	LDAPAttributeChanges
+	OptionChanges
+}
+
+type LDAPAttributeChanges struct {
+	IDAttribute                *string `json:"idAttribute,omitempty"`
+	FirstNameAttribute         *string `json:"firstNameAttribute,omitempty"`
+	LastNameAttribute          *string `json:"lastNameAttribute,omitempty"`
+	DisplayNameAttribute       *string `json:"displayNameAttribute,omitempty"`
+	NickNameAttribute          *string `json:"nickNameAttribute,omitempty"`
+	PreferredUsernameAttribute *string `json:"preferredUsernameAttribute,omitempty"`
+	EmailAttribute             *string `json:"emailAttribute,omitempty"`
+	EmailVerifiedAttribute     *string `json:"emailVerifiedAttribute,omitempty"`
+	PhoneAttribute             *string `json:"phoneAttribute,omitempty"`
+	PhoneVerifiedAttribute     *string `json:"phoneVerifiedAttribute,omitempty"`
+	PreferredLanguageAttribute *string `json:"preferredLanguageAttribute,omitempty"`
+	AvatarURLAttribute         *string `json:"avatarURLAttribute,omitempty"`
+	ProfileAttribute           *string `json:"profileAttribute,omitempty"`
+}
+
+func (o LDAPAttributeChanges) IsZero() bool {
+	return o.IDAttribute == nil &&
+		o.FirstNameAttribute == nil &&
+		o.LastNameAttribute == nil &&
+		o.DisplayNameAttribute == nil &&
+		o.NickNameAttribute == nil &&
+		o.PreferredUsernameAttribute == nil &&
+		o.EmailAttribute == nil &&
+		o.EmailVerifiedAttribute == nil &&
+		o.PhoneAttribute == nil &&
+		o.PhoneVerifiedAttribute == nil &&
+		o.PreferredLanguageAttribute == nil &&
+		o.AvatarURLAttribute == nil &&
+		o.ProfileAttribute == nil
+}
+
+func NewLDAPIDPChangedEvent(
+	base *eventstore.BaseEvent,
+	id string,
+	changes []LDAPIDPChanges,
+) (*LDAPIDPChangedEvent, error) {
+	if len(changes) == 0 {
+		return nil, zerrors.ThrowPreconditionFailed(nil, "IDP-SDf3f", "Errors.NoChangesFound")
+	}
+	changedEvent := &LDAPIDPChangedEvent{
+		BaseEvent: *base,
+		ID:        id,
+	}
+	for _, change := range changes {
+		change(changedEvent)
+	}
+	return changedEvent, nil
+}
+
+type LDAPIDPChanges func(*LDAPIDPChangedEvent)
+
+func ChangeLDAPName(name string) func(*LDAPIDPChangedEvent) {
+	return func(e *LDAPIDPChangedEvent) {
+		e.Name = &name
+	}
+}
+
+func ChangeLDAPServers(servers []string) func(*LDAPIDPChangedEvent) {
+	return func(e *LDAPIDPChangedEvent) {
+		e.Servers = servers
+	}
+}
+
+func ChangeLDAPStartTLS(startTls bool) func(*LDAPIDPChangedEvent) {
+	return func(e *LDAPIDPChangedEvent) {
+		e.StartTLS = &startTls
+	}
+}
+
+func ChangeLDAPBaseDN(baseDN string) func(*LDAPIDPChangedEvent) {
+	return func(e *LDAPIDPChangedEvent) {
+		e.BaseDN = &baseDN
+	}
+}
+
+func ChangeLDAPBindDN(bindDN string) func(*LDAPIDPChangedEvent) {
+	return func(e *LDAPIDPChangedEvent) {
+		e.BindDN = &bindDN
+	}
+}
+
+func ChangeLDAPBindPassword(password *crypto.CryptoValue) func(*LDAPIDPChangedEvent) {
+	return func(e *LDAPIDPChangedEvent) {
+		e.BindPassword = password
+	}
+}
+
+func ChangeLDAPUserBase(userBase string) func(*LDAPIDPChangedEvent) {
+	return func(e *LDAPIDPChangedEvent) {
+		e.UserBase = &userBase
+	}
+}
+
+func ChangeLDAPUserObjectClasses(objectClasses []string) func(*LDAPIDPChangedEvent) {
+	return func(e *LDAPIDPChangedEvent) {
+		e.UserObjectClasses = objectClasses
+	}
+}
+
+func ChangeLDAPUserFilters(userFilters []string) func(*LDAPIDPChangedEvent) {
+	return func(e *LDAPIDPChangedEvent) {
+		e.UserFilters = userFilters
+	}
+}
+
+func ChangeLDAPTimeout(timeout time.Duration) func(*LDAPIDPChangedEvent) {
+	return func(e *LDAPIDPChangedEvent) {
+		e.Timeout = &timeout
+	}
+}
+
+func ChangeLDAPRootCA(rootCA []byte) func(*LDAPIDPChangedEvent) {
+	return func(e *LDAPIDPChangedEvent) {
+		e.RootCA = rootCA
+	}
+}
+
+func ChangeLDAPAttributes(attributes LDAPAttributeChanges) func(*LDAPIDPChangedEvent) {
+	return func(e *LDAPIDPChangedEvent) {
+		e.LDAPAttributeChanges = attributes
+	}
+}
+
+func ChangeLDAPOptions(options OptionChanges) func(*LDAPIDPChangedEvent) {
+	return func(e *LDAPIDPChangedEvent) {
+		e.OptionChanges = options
+	}
+}
+
+func (e *LDAPIDPChangedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *LDAPIDPChangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func LDAPIDPChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &LDAPIDPChangedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-Sfth3", "unable to unmarshal event")
+	}
+
+	return e, nil
+}
--- a/apps/api/internal/repository/idp/oauth.go
+++ b/apps/api/internal/repository/idp/oauth.go
@@ -0,0 +1,190 @@
+package idp
+
+import (
+	"github.com/zitadel/zitadel/internal/crypto"
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+type OAuthIDPAddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ID                    string              `json:"id"`
+	Name                  string              `json:"name,omitempty"`
+	ClientID              string              `json:"clientId,omitempty"`
+	ClientSecret          *crypto.CryptoValue `json:"clientSecret,omitempty"`
+	AuthorizationEndpoint string              `json:"authorizationEndpoint,omitempty"`
+	TokenEndpoint         string              `json:"tokenEndpoint,omitempty"`
+	UserEndpoint          string              `json:"userEndpoint,omitempty"`
+	Scopes                []string            `json:"scopes,omitempty"`
+	IDAttribute           string              `json:"idAttribute,omitempty"`
+	UsePKCE               bool                `json:"usePKCE,omitempty"`
+	Options
+}
+
+func NewOAuthIDPAddedEvent(
+	base *eventstore.BaseEvent,
+	id,
+	name,
+	clientID string,
+	clientSecret *crypto.CryptoValue,
+	authorizationEndpoint,
+	tokenEndpoint,
+	userEndpoint,
+	idAttribute string,
+	scopes []string,
+	usePKCE bool,
+	options Options,
+) *OAuthIDPAddedEvent {
+	return &OAuthIDPAddedEvent{
+		BaseEvent:             *base,
+		ID:                    id,
+		Name:                  name,
+		ClientID:              clientID,
+		ClientSecret:          clientSecret,
+		AuthorizationEndpoint: authorizationEndpoint,
+		TokenEndpoint:         tokenEndpoint,
+		UserEndpoint:          userEndpoint,
+		Scopes:                scopes,
+		IDAttribute:           idAttribute,
+		UsePKCE:               usePKCE,
+		Options:               options,
+	}
+}
+
+func (e *OAuthIDPAddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *OAuthIDPAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func OAuthIDPAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &OAuthIDPAddedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-Et1dq", "unable to unmarshal event")
+	}
+
+	return e, nil
+}
+
+type OAuthIDPChangedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ID                    string              `json:"id"`
+	Name                  *string             `json:"name,omitempty"`
+	ClientID              *string             `json:"clientId,omitempty"`
+	ClientSecret          *crypto.CryptoValue `json:"clientSecret,omitempty"`
+	AuthorizationEndpoint *string             `json:"authorizationEndpoint,omitempty"`
+	TokenEndpoint         *string             `json:"tokenEndpoint,omitempty"`
+	UserEndpoint          *string             `json:"userEndpoint,omitempty"`
+	Scopes                []string            `json:"scopes,omitempty"`
+	IDAttribute           *string             `json:"idAttribute,omitempty"`
+	UsePKCE               *bool               `json:"usePKCE,omitempty"`
+	OptionChanges
+}
+
+func NewOAuthIDPChangedEvent(
+	base *eventstore.BaseEvent,
+	id string,
+	changes []OAuthIDPChanges,
+) (*OAuthIDPChangedEvent, error) {
+	if len(changes) == 0 {
+		return nil, zerrors.ThrowPreconditionFailed(nil, "IDP-BH3dl", "Errors.NoChangesFound")
+	}
+	changedEvent := &OAuthIDPChangedEvent{
+		BaseEvent: *base,
+		ID:        id,
+	}
+	for _, change := range changes {
+		change(changedEvent)
+	}
+	return changedEvent, nil
+}
+
+type OAuthIDPChanges func(*OAuthIDPChangedEvent)
+
+func ChangeOAuthName(name string) func(*OAuthIDPChangedEvent) {
+	return func(e *OAuthIDPChangedEvent) {
+		e.Name = &name
+	}
+}
+func ChangeOAuthClientID(clientID string) func(*OAuthIDPChangedEvent) {
+	return func(e *OAuthIDPChangedEvent) {
+		e.ClientID = &clientID
+	}
+}
+
+func ChangeOAuthClientSecret(clientSecret *crypto.CryptoValue) func(*OAuthIDPChangedEvent) {
+	return func(e *OAuthIDPChangedEvent) {
+		e.ClientSecret = clientSecret
+	}
+}
+
+func ChangeOAuthOptions(options OptionChanges) func(*OAuthIDPChangedEvent) {
+	return func(e *OAuthIDPChangedEvent) {
+		e.OptionChanges = options
+	}
+}
+
+func ChangeOAuthAuthorizationEndpoint(authorizationEndpoint string) func(*OAuthIDPChangedEvent) {
+	return func(e *OAuthIDPChangedEvent) {
+		e.AuthorizationEndpoint = &authorizationEndpoint
+	}
+}
+
+func ChangeOAuthTokenEndpoint(tokenEndpoint string) func(*OAuthIDPChangedEvent) {
+	return func(e *OAuthIDPChangedEvent) {
+		e.TokenEndpoint = &tokenEndpoint
+	}
+}
+
+func ChangeOAuthUserEndpoint(userEndpoint string) func(*OAuthIDPChangedEvent) {
+	return func(e *OAuthIDPChangedEvent) {
+		e.UserEndpoint = &userEndpoint
+	}
+}
+
+func ChangeOAuthScopes(scopes []string) func(*OAuthIDPChangedEvent) {
+	return func(e *OAuthIDPChangedEvent) {
+		e.Scopes = scopes
+	}
+}
+
+func ChangeOAuthIDAttribute(idAttribute string) func(*OAuthIDPChangedEvent) {
+	return func(e *OAuthIDPChangedEvent) {
+		e.IDAttribute = &idAttribute
+	}
+}
+
+func ChangeOAuthUsePKCE(usePKCE bool) func(*OAuthIDPChangedEvent) {
+	return func(e *OAuthIDPChangedEvent) {
+		e.UsePKCE = &usePKCE
+	}
+}
+
+func (e *OAuthIDPChangedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *OAuthIDPChangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func OAuthIDPChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &OAuthIDPChangedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-SAf3gw", "unable to unmarshal event")
+	}
+
+	return e, nil
+}
--- a/apps/api/internal/repository/idp/oidc.go
+++ b/apps/api/internal/repository/idp/oidc.go
@@ -0,0 +1,260 @@
+package idp
+
+import (
+	"github.com/zitadel/zitadel/internal/crypto"
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+type OIDCIDPAddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ID               string              `json:"id"`
+	Name             string              `json:"name"`
+	Issuer           string              `json:"issuer"`
+	ClientID         string              `json:"clientId"`
+	ClientSecret     *crypto.CryptoValue `json:"clientSecret"`
+	Scopes           []string            `json:"scopes,omitempty"`
+	IsIDTokenMapping bool                `json:"idTokenMapping,omitempty"`
+	UsePKCE          bool                `json:"usePKCE,omitempty"`
+	Options
+}
+
+func NewOIDCIDPAddedEvent(
+	base *eventstore.BaseEvent,
+	id,
+	name,
+	issuer,
+	clientID string,
+	clientSecret *crypto.CryptoValue,
+	scopes []string,
+	isIDTokenMapping, usePKCE bool,
+	options Options,
+) *OIDCIDPAddedEvent {
+	return &OIDCIDPAddedEvent{
+		BaseEvent:        *base,
+		ID:               id,
+		Name:             name,
+		Issuer:           issuer,
+		ClientID:         clientID,
+		ClientSecret:     clientSecret,
+		Scopes:           scopes,
+		IsIDTokenMapping: isIDTokenMapping,
+		UsePKCE:          usePKCE,
+		Options:          options,
+	}
+}
+
+func (e *OIDCIDPAddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *OIDCIDPAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func OIDCIDPAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &OIDCIDPAddedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-Et1dq", "unable to unmarshal event")
+	}
+
+	return e, nil
+}
+
+type OIDCIDPChangedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ID               string              `json:"id"`
+	Name             *string             `json:"name,omitempty"`
+	Issuer           *string             `json:"issuer,omitempty"`
+	ClientID         *string             `json:"clientId,omitempty"`
+	ClientSecret     *crypto.CryptoValue `json:"clientSecret,omitempty"`
+	Scopes           []string            `json:"scopes,omitempty"`
+	IsIDTokenMapping *bool               `json:"idTokenMapping,omitempty"`
+	UsePKCE          *bool               `json:"usePKCE,omitempty"`
+	OptionChanges
+}
+
+func NewOIDCIDPChangedEvent(
+	base *eventstore.BaseEvent,
+	id string,
+	changes []OIDCIDPChanges,
+) (*OIDCIDPChangedEvent, error) {
+	if len(changes) == 0 {
+		return nil, zerrors.ThrowPreconditionFailed(nil, "IDP-BH3dl", "Errors.NoChangesFound")
+	}
+	changedEvent := &OIDCIDPChangedEvent{
+		BaseEvent: *base,
+		ID:        id,
+	}
+	for _, change := range changes {
+		change(changedEvent)
+	}
+	return changedEvent, nil
+}
+
+type OIDCIDPChanges func(*OIDCIDPChangedEvent)
+
+func ChangeOIDCName(name string) func(*OIDCIDPChangedEvent) {
+	return func(e *OIDCIDPChangedEvent) {
+		e.Name = &name
+	}
+}
+
+func ChangeOIDCIssuer(issuer string) func(*OIDCIDPChangedEvent) {
+	return func(e *OIDCIDPChangedEvent) {
+		e.Issuer = &issuer
+	}
+}
+
+func ChangeOIDCClientID(clientID string) func(*OIDCIDPChangedEvent) {
+	return func(e *OIDCIDPChangedEvent) {
+		e.ClientID = &clientID
+	}
+}
+
+func ChangeOIDCClientSecret(clientSecret *crypto.CryptoValue) func(*OIDCIDPChangedEvent) {
+	return func(e *OIDCIDPChangedEvent) {
+		e.ClientSecret = clientSecret
+	}
+}
+
+func ChangeOIDCOptions(options OptionChanges) func(*OIDCIDPChangedEvent) {
+	return func(e *OIDCIDPChangedEvent) {
+		e.OptionChanges = options
+	}
+}
+
+func ChangeOIDCScopes(scopes []string) func(*OIDCIDPChangedEvent) {
+	return func(e *OIDCIDPChangedEvent) {
+		e.Scopes = scopes
+	}
+}
+
+func ChangeOIDCIsIDTokenMapping(idTokenMapping bool) func(*OIDCIDPChangedEvent) {
+	return func(e *OIDCIDPChangedEvent) {
+		e.IsIDTokenMapping = &idTokenMapping
+	}
+}
+
+func ChangeOIDCUsePKCE(usePKCE bool) func(*OIDCIDPChangedEvent) {
+	return func(e *OIDCIDPChangedEvent) {
+		e.UsePKCE = &usePKCE
+	}
+}
+
+func (e *OIDCIDPChangedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *OIDCIDPChangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func OIDCIDPChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &OIDCIDPChangedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-D3gjzh", "unable to unmarshal event")
+	}
+
+	return e, nil
+}
+
+type OIDCIDPMigratedAzureADEvent struct {
+	AzureADIDPAddedEvent
+}
+
+func NewOIDCIDPMigratedAzureADEvent(
+	base *eventstore.BaseEvent,
+	id,
+	name,
+	clientID string,
+	clientSecret *crypto.CryptoValue,
+	scopes []string,
+	tenant string,
+	isEmailVerified bool,
+	options Options,
+) *OIDCIDPMigratedAzureADEvent {
+	return &OIDCIDPMigratedAzureADEvent{
+		AzureADIDPAddedEvent: AzureADIDPAddedEvent{
+			BaseEvent:       *base,
+			ID:              id,
+			Name:            name,
+			ClientID:        clientID,
+			ClientSecret:    clientSecret,
+			Scopes:          scopes,
+			Tenant:          tenant,
+			IsEmailVerified: isEmailVerified,
+			Options:         options,
+		},
+	}
+}
+
+func (e *OIDCIDPMigratedAzureADEvent) Data() interface{} {
+	return e
+}
+
+func (e *OIDCIDPMigratedAzureADEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func OIDCIDPMigratedAzureADEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := AzureADIDPAddedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &OIDCIDPMigratedAzureADEvent{AzureADIDPAddedEvent: *e.(*AzureADIDPAddedEvent)}, nil
+}
+
+type OIDCIDPMigratedGoogleEvent struct {
+	GoogleIDPAddedEvent
+}
+
+func NewOIDCIDPMigratedGoogleEvent(
+	base *eventstore.BaseEvent,
+	id,
+	name,
+	clientID string,
+	clientSecret *crypto.CryptoValue,
+	scopes []string,
+	options Options,
+) *OIDCIDPMigratedGoogleEvent {
+	return &OIDCIDPMigratedGoogleEvent{
+		GoogleIDPAddedEvent: GoogleIDPAddedEvent{
+			BaseEvent:    *base,
+			ID:           id,
+			Name:         name,
+			ClientID:     clientID,
+			ClientSecret: clientSecret,
+			Scopes:       scopes,
+			Options:      options,
+		},
+	}
+}
+
+func (e *OIDCIDPMigratedGoogleEvent) Data() interface{} {
+	return e
+}
+
+func (e *OIDCIDPMigratedGoogleEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func OIDCIDPMigratedGoogleEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := GoogleIDPAddedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &OIDCIDPMigratedGoogleEvent{GoogleIDPAddedEvent: *e.(*GoogleIDPAddedEvent)}, nil
+}
--- a/apps/api/internal/repository/idp/saml.go
+++ b/apps/api/internal/repository/idp/saml.go
@@ -0,0 +1,192 @@
+package idp
+
+import (
+	"github.com/zitadel/zitadel/internal/crypto"
+	"github.com/zitadel/zitadel/internal/domain"
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+type SAMLIDPAddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ID                            string                   `json:"id"`
+	Name                          string                   `json:"name,omitempty"`
+	Metadata                      []byte                   `json:"metadata,omitempty"`
+	Key                           *crypto.CryptoValue      `json:"key,omitempty"`
+	Certificate                   []byte                   `json:"certificate,omitempty"`
+	Binding                       string                   `json:"binding,omitempty"`
+	WithSignedRequest             bool                     `json:"withSignedRequest,omitempty"`
+	NameIDFormat                  *domain.SAMLNameIDFormat `json:"nameIDFormat,omitempty"`
+	TransientMappingAttributeName string                   `json:"transientMappingAttributeName,omitempty"`
+	FederatedLogoutEnabled        bool                     `json:"federatedLogoutEnabled,omitempty"`
+	Options
+}
+
+func NewSAMLIDPAddedEvent(
+	base *eventstore.BaseEvent,
+	id,
+	name string,
+	metadata []byte,
+	key *crypto.CryptoValue,
+	certificate []byte,
+	binding string,
+	withSignedRequest bool,
+	nameIDFormat *domain.SAMLNameIDFormat,
+	transientMappingAttributeName string,
+	federatedLogoutEnabled bool,
+	options Options,
+) *SAMLIDPAddedEvent {
+	return &SAMLIDPAddedEvent{
+		BaseEvent:                     *base,
+		ID:                            id,
+		Name:                          name,
+		Metadata:                      metadata,
+		Key:                           key,
+		Certificate:                   certificate,
+		Binding:                       binding,
+		WithSignedRequest:             withSignedRequest,
+		NameIDFormat:                  nameIDFormat,
+		TransientMappingAttributeName: transientMappingAttributeName,
+		FederatedLogoutEnabled:        federatedLogoutEnabled,
+		Options:                       options,
+	}
+}
+
+func (e *SAMLIDPAddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *SAMLIDPAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func SAMLIDPAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &SAMLIDPAddedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-v9uajo3k71", "unable to unmarshal event")
+	}
+
+	return e, nil
+}
+
+type SAMLIDPChangedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ID                            string                   `json:"id"`
+	Name                          *string                  `json:"name,omitempty"`
+	Metadata                      []byte                   `json:"metadata,omitempty"`
+	Key                           *crypto.CryptoValue      `json:"key,omitempty"`
+	Certificate                   []byte                   `json:"certificate,omitempty"`
+	Binding                       *string                  `json:"binding,omitempty"`
+	WithSignedRequest             *bool                    `json:"withSignedRequest,omitempty"`
+	NameIDFormat                  *domain.SAMLNameIDFormat `json:"nameIDFormat,omitempty"`
+	TransientMappingAttributeName *string                  `json:"transientMappingAttributeName,omitempty"`
+	FederatedLogoutEnabled        *bool                    `json:"federatedLogoutEnabled,omitempty"`
+	OptionChanges
+}
+
+func NewSAMLIDPChangedEvent(
+	base *eventstore.BaseEvent,
+	id string,
+	changes []SAMLIDPChanges,
+) (*SAMLIDPChangedEvent, error) {
+	if len(changes) == 0 {
+		return nil, zerrors.ThrowPreconditionFailed(nil, "IDP-cz6mnf860t", "Errors.NoChangesFound")
+	}
+	changedEvent := &SAMLIDPChangedEvent{
+		BaseEvent: *base,
+		ID:        id,
+	}
+	for _, change := range changes {
+		change(changedEvent)
+	}
+	return changedEvent, nil
+}
+
+type SAMLIDPChanges func(*SAMLIDPChangedEvent)
+
+func ChangeSAMLName(name string) func(*SAMLIDPChangedEvent) {
+	return func(e *SAMLIDPChangedEvent) {
+		e.Name = &name
+	}
+}
+
+func ChangeSAMLMetadata(metadata []byte) func(*SAMLIDPChangedEvent) {
+	return func(e *SAMLIDPChangedEvent) {
+		e.Metadata = metadata
+	}
+}
+
+func ChangeSAMLKey(key *crypto.CryptoValue) func(*SAMLIDPChangedEvent) {
+	return func(e *SAMLIDPChangedEvent) {
+		e.Key = key
+	}
+}
+
+func ChangeSAMLCertificate(certificate []byte) func(*SAMLIDPChangedEvent) {
+	return func(e *SAMLIDPChangedEvent) {
+		e.Certificate = certificate
+	}
+}
+
+func ChangeSAMLBinding(binding string) func(*SAMLIDPChangedEvent) {
+	return func(e *SAMLIDPChangedEvent) {
+		e.Binding = &binding
+	}
+}
+
+func ChangeSAMLWithSignedRequest(withSignedRequest bool) func(*SAMLIDPChangedEvent) {
+	return func(e *SAMLIDPChangedEvent) {
+		e.WithSignedRequest = &withSignedRequest
+	}
+}
+
+func ChangeSAMLNameIDFormat(nameIDFormat *domain.SAMLNameIDFormat) func(*SAMLIDPChangedEvent) {
+	return func(e *SAMLIDPChangedEvent) {
+		e.NameIDFormat = nameIDFormat
+	}
+}
+
+func ChangeSAMLTransientMappingAttributeName(name string) func(*SAMLIDPChangedEvent) {
+	return func(e *SAMLIDPChangedEvent) {
+		e.TransientMappingAttributeName = &name
+	}
+}
+
+func ChangeSAMLFederatedLogoutEnabled(federatedLogoutEnabled bool) func(*SAMLIDPChangedEvent) {
+	return func(e *SAMLIDPChangedEvent) {
+		e.FederatedLogoutEnabled = &federatedLogoutEnabled
+	}
+}
+
+func ChangeSAMLOptions(options OptionChanges) func(*SAMLIDPChangedEvent) {
+	return func(e *SAMLIDPChangedEvent) {
+		e.OptionChanges = options
+	}
+}
+
+func (e *SAMLIDPChangedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *SAMLIDPChangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func SAMLIDPChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &SAMLIDPChangedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IDP-w1t1824tw5", "unable to unmarshal event")
+	}
+
+	return e, nil
+}