Multi-IdP Login Page Audit

When the panel is taller than the window, the error banner is squeezed into 70px. The "Login" heading is drawn over its top and the Username field covers its last line. Seen with all 34 configs at 1440×900 and 1366×768, whenever the banner wraps past about three lines (long backend errors, or a custom login error plus any error).

• .login-messages--hasContent { min-height: 70px } replaces the flex item's default min-height: auto, so the panel's flex column is free to shrink it to 70px.
• The container is align-items: center, so the clipped banner overflows evenly upward and downward.
• Fix: flex-shrink: 0 on .login-messages. It belongs with #19025, which touches the same container.

Clicking the link expands the list and also moves the form to the first other option in sort order. That option then leaves the list. Picking from the list collapses it again. The same config therefore renders in two different layouts depending on how the user reached it, and with two configs the page bounces between them.

• showProviderList is hasProviderList && (!isCredentialForm || listExpanded), so the list is only hidden for LDAP and local.
• expandProviderList() changes selectedProviderId and clears "Remember my choice". selectProvider() sets listExpanded = false.
• The form above changes only its button label ("Log in with openldap-2"), so the switch is easy to miss. The user can sign in against a server they never chose.
• The only way to see "openldap-2, list hidden" is for openldap-2 to be the remembered choice.
• Suggested direction: let expanding reveal the list without changing the selection, and keep the list open after a pick, as it already is for SSO.

With two SSO configs, the list is visible from the start and stays put after a pick; the button above names the chosen config. With two LDAP configs, the list is hidden behind a link and the layout changes as described above. Both share one component and one list design, so users moving between them see two different interaction models.

With one external provider and local, "Choose a different provider" calls toggleLocal(), a straight swap with no list. For SSO the panel visibly changes from one button to a form. For LDAP it goes from one username/password form to another. Only the button label changes, plus the local form's "Show" toggle and "Remember Username".

• Name the destination instead, e.g. "Log in with ActiveDirectory", mirroring "Log in as a local user". Keep "Choose a different provider" for when there is a list.
• Give credential forms something besides the button label that says which provider they belong to.

The form gets mt-30 only when there is no message. With any banner, the form loses that margin and the banner's own 5px margin is the only gap. This applies to every message and every provider type: the SSO button, the LDAP form and the local form all sit 5px under the banner.

• Focus. An open LDAP form focuses the "Log in with …" button, not Username (mixins/login.js focuses $refs.btn). The local form focuses Username.
• Password field. Local uses Password with a Show toggle; LDAP uses a plain LabeledInput type="password". Only local offers "Remember Username".
• Names. Second configs show their raw id (activedirectory-2, okta-2). /v1-public/authproviders does not return description even when the authconfig has one (checked by setting it on github-2), so the list's description line never appears for external providers.
• First login. The bootstrap-password box spans the whole panel (about 660px) instead of the 362px column, and gets no top margin when a banner shows.
• Hover after expanding. The row under the pointer is highlighted once the list opens beneath it, which reads as a selection in screenshots.

• An enabled googleOauthConfig whose credential has no redirect_uris makes /v1-public/authproviders return 500, so the login page fails for every provider. Only reachable by editing the authconfig directly; the UI form validates the credential.
• Disabling a config resets it: LDAP servers and the Google credential are cleared, and the webhook then refuses to re-enable LDAP without servers.
• The page has no warning or info banners. "All permutations" here means the success and error variants plus the first-login box.