Added support for organization-managed ERI servers

2026-05-20 09:52:14 +00:00 · 2026-05-16 20:26:48 +02:00 · 2026-05-16 20:26:48 +02:00 · e9fa4187fc
commit e9fa4187fc
parent 991a486eae
26 changed files with 582 additions and 21 deletions
--- a/Studio/Dialogs/DataSourceERI_V1Dialog.razor.cs
+++ b/Studio/Dialogs/DataSourceERI_V1Dialog.razor.cs
@ -169,6 +169,7 @@ public partial class DataSourceERI_V1Dialog : MSGComponentBase, ISecretId
            Hostname = cleanedHostname.EndsWith('/') ? cleanedHostname[..^1] : cleanedHostname,
            AuthMethod = this.dataAuthMethod,
            Username = this.dataUsername,
+            UsernamePasswordMode = DataSourceERIUsernamePasswordMode.USER_MANAGED,
            Type = DataSourceType.ERI_V1,
            SecurityPolicy = this.dataSecurityPolicy,
            SelectedRetrievalId = this.dataSelectedRetrievalProcess.Id,
--- a/Studio/Dialogs/Settings/SettingsDialogDataSources.razor
+++ b/Studio/Dialogs/Settings/SettingsDialogDataSources.razor
@ -38,12 +38,21 @@
                <MudTd>
                    <MudStack Row="true" Class="mb-2 mt-2" Wrap="Wrap.Wrap">
                        <MudIconButton Variant="Variant.Filled" Color="Color.Info" Icon="@Icons.Material.Filled.Info" OnClick="() => this.ShowInformation(context)"/>
-                        <MudButton Variant="Variant.Filled" Color="Color.Info" StartIcon="@Icons.Material.Filled.Edit" OnClick="() => this.EditDataSource(context)">
-                            @T("Edit")
-                        </MudButton>
-                        <MudButton Variant="Variant.Filled" Color="Color.Error" StartIcon="@Icons.Material.Filled.Delete" OnClick="() => this.DeleteDataSource(context)">
-                            @T("Delete")
-                        </MudButton>
+                        @if (context.IsEnterpriseConfiguration)
+                        {
+                            <MudTooltip Text="@T("This data source is managed by your organization.")">
+                                <MudIconButton Color="Color.Info" Icon="@Icons.Material.Filled.Business" Disabled="true"/>
+                            </MudTooltip>
+                        }
+                        else
+                        {
+                            <MudButton Variant="Variant.Filled" Color="Color.Info" StartIcon="@Icons.Material.Filled.Edit" OnClick="() => this.EditDataSource(context)">
+                                @T("Edit")
+                            </MudButton>
+                            <MudButton Variant="Variant.Filled" Color="Color.Error" StartIcon="@Icons.Material.Filled.Delete" OnClick="() => this.DeleteDataSource(context)">
+                                @T("Delete")
+                            </MudButton>
+                        }
                    </MudStack>
                </MudTd>
            </RowTemplate>
--- a/Studio/Dialogs/Settings/SettingsDialogDataSources.razor.cs
+++ b/Studio/Dialogs/Settings/SettingsDialogDataSources.razor.cs
@ -89,6 +89,9 @@ public partial class SettingsDialogDataSources : SettingsDialogBase
    
    private async Task EditDataSource(IDataSource dataSource)
    {
+        if (dataSource.IsEnterpriseConfiguration)
+            return;
+
        IDataSource? editedDataSource = null;
        switch (dataSource)
        {
@ -151,6 +154,9 @@ public partial class SettingsDialogDataSources : SettingsDialogBase
    
    private async Task DeleteDataSource(IDataSource dataSource)
    {
+        if (dataSource.IsEnterpriseConfiguration)
+            return;
+
        var dialogParameters = new DialogParameters<ConfirmDialog>
        {
            { x => x.Message, string.Format(T("Are you sure you want to delete the data source '{0}' of type {1}?"), dataSource.Name, dataSource.Type.GetDisplayName()) },
--- a/Studio/Pages/Information.razor
+++ b/Studio/Pages/Information.razor
@ -301,6 +301,7 @@
                    <ThirdPartyComponent Name="PDFium" Developer="Lei Zhang, Tom Sepez, Dan Sinclair, and Foxit, Google, Chromium, Collabora, Ada, DocsCorp, Dropbox, Microsoft, and PSPDFKit Teams & Open Source Community" LicenseName="Apache-2.0" LicenseUrl="https://pdfium.googlesource.com/pdfium/+/refs/heads/main/LICENSE" RepositoryUrl="https://pdfium.googlesource.com/pdfium" UseCase="@T("This library is used to read PDF files. This is necessary, e.g., for using PDFs as a data source for a chat.")"/>
                    <ThirdPartyComponent Name="pdfium-render" Developer="Alastair Carey, Dorian Rudolph & Open Source Community" LicenseName="MIT" LicenseUrl="https://github.com/ajrcarey/pdfium-render/blob/master/LICENSE.md" RepositoryUrl="https://github.com/ajrcarey/pdfium-render" UseCase="@T("This library is used to read PDF files. This is necessary, e.g., for using PDFs as a data source for a chat.")"/>
                    <ThirdPartyComponent Name="sys-locale" Developer="1Password Team, ComplexSpaces & Open Source Community" LicenseName="MIT" LicenseUrl="https://github.com/1Password/sys-locale/blob/main/LICENSE-MIT" RepositoryUrl="https://github.com/1Password/sys-locale" UseCase="@T("This library is used to determine the language of the operating system. This is necessary to set the language of the user interface.")"/>
+                    <ThirdPartyComponent Name="whoami" Developer="Ardaku Systems, Jeryn Aldaron Lau, Chase Johnson & Open Source Community" LicenseName="MIT" LicenseUrl="https://github.com/ardaku/whoami/blob/stable/LICENSE_MIT" RepositoryUrl="https://github.com/ardaku/whoami" UseCase="@T("This library is used by the Rust runtime to read the current user's username, e.g. when an organization-managed ERI server uses the OS username for authentication.")"/>
                    <ThirdPartyComponent Name="sysinfo" Developer="Guillaume Gomez & Open Source Community" LicenseName="MIT" LicenseUrl="https://github.com/GuillaumeGomez/sysinfo/blob/main/LICENSE" RepositoryUrl="https://github.com/GuillaumeGomez/sysinfo" UseCase="@T("This library is used to manage sidecar processes and to ensure that stale or zombie sidecars are detected and terminated.")"/>
                    <ThirdPartyComponent Name="tempfile" Developer="Steven Allen, Ashley Mannix & Open Source Community" LicenseName="MIT" LicenseUrl="https://github.com/Stebalien/tempfile/blob/master/LICENSE-MIT" RepositoryUrl="https://github.com/Stebalien/tempfile" UseCase="@T("This library is used to create temporary folders for saving the certificate and private key for communication with Qdrant.")"/>
                    <ThirdPartyComponent Name="Lua-CSharp" Developer="Yusuke Nakada & Open Source Community" LicenseName="MIT" LicenseUrl="https://github.com/nuskey8/Lua-CSharp/blob/main/LICENSE" RepositoryUrl="https://github.com/nuskey8/Lua-CSharp" UseCase="@T("We use Lua as the language for plugins. Lua-CSharp lets Lua scripts communicate with AI Studio and vice versa. Thank you, Yusuke Nakada, for this great library.")" />
--- a/Studio/Plugins/configuration/plugin.lua
+++ b/Studio/Plugins/configuration/plugin.lua
@ -136,6 +136,54 @@ CONFIG["EMBEDDING_PROVIDERS"] = {}
 --     }
 -- }

+-- ERI v1 data sources for retrieval-augmented generation:
+CONFIG["DATA_SOURCES"] = {}
+
+-- Example: ERI v1 data source with a shared access token.
+-- CONFIG["DATA_SOURCES"][#CONFIG["DATA_SOURCES"]+1] = {
+--     ["Id"] = "00000000-0000-0000-0000-000000000000",
+--     ["Name"] = "<user-friendly data source name>",
+--     ["Type"] = "ERI_V1",
+--     ["Hostname"] = "<https address of the ERI server>",
+--     ["Port"] = 443,
+--     ["AuthMethod"] = "TOKEN",
+--     ["Token"] = "ENC:v1:<base64-encoded encrypted token>",
+--     ["SecurityPolicy"] = "SELF_HOSTED",
+--     ["SelectedRetrievalId"] = "<retrieval process ID from the ERI server>",
+--     ["MaxMatches"] = 10,
+-- }
+
+-- Example: ERI v1 data source with a shared username and password.
+-- CONFIG["DATA_SOURCES"][#CONFIG["DATA_SOURCES"]+1] = {
+--     ["Id"] = "00000000-0000-0000-0000-000000000000",
+--     ["Name"] = "<user-friendly data source name>",
+--     ["Type"] = "ERI_V1",
+--     ["Hostname"] = "<https address of the ERI server>",
+--     ["Port"] = 443,
+--     ["AuthMethod"] = "USERNAME_PASSWORD",
+--     ["UsernamePasswordMode"] = "SHARED_USERNAME_AND_PASSWORD",
+--     ["Username"] = "<shared username>",
+--     ["Password"] = "ENC:v1:<base64-encoded encrypted password>",
+--     ["SecurityPolicy"] = "SELF_HOSTED",
+--     ["SelectedRetrievalId"] = "<retrieval process ID from the ERI server>",
+--     ["MaxMatches"] = 10,
+-- }
+
+-- Example: ERI v1 data source using the user's username and a shared password.
+-- CONFIG["DATA_SOURCES"][#CONFIG["DATA_SOURCES"]+1] = {
+--     ["Id"] = "00000000-0000-0000-0000-000000000000",
+--     ["Name"] = "<user-friendly data source name>",
+--     ["Type"] = "ERI_V1",
+--     ["Hostname"] = "<https address of the ERI server>",
+--     ["Port"] = 443,
+--     ["AuthMethod"] = "USERNAME_PASSWORD",
+--     ["UsernamePasswordMode"] = "OS_USERNAME_SHARED_PASSWORD",
+--     ["Password"] = "ENC:v1:<base64-encoded encrypted password>",
+--     ["SecurityPolicy"] = "SELF_HOSTED",
+--     ["SelectedRetrievalId"] = "<retrieval process ID from the ERI server>",
+--     ["MaxMatches"] = 10,
+-- }
+
 CONFIG["SETTINGS"] = {}

 -- Configure the update check interval:
--- a/Studio/Settings/DataModel/DataSourceERIUsernamePasswordMode.cs
+++ b/Studio/Settings/DataModel/DataSourceERIUsernamePasswordMode.cs
@ -0,0 +1,19 @@
+namespace AIStudio.Settings.DataModel;
+
+public enum DataSourceERIUsernamePasswordMode
+{
+    /// <summary>
+    /// The user manages the username and password locally.
+    /// </summary>
+    USER_MANAGED,
+
+    /// <summary>
+    /// The username and password are shared by all users and provided by configuration.
+    /// </summary>
+    SHARED_USERNAME_AND_PASSWORD,
+
+    /// <summary>
+    /// The username is read from the operating system, and the password is shared by all users.
+    /// </summary>
+    OS_USERNAME_SHARED_PASSWORD,
+}
--- a/Studio/Settings/DataModel/DataSourceERI_V1.cs
+++ b/Studio/Settings/DataModel/DataSourceERI_V1.cs
@ -2,11 +2,15 @@

 using AIStudio.Assistants.ERI;
 using AIStudio.Chat;
+using AIStudio.Tools;
 using AIStudio.Tools.ERIClient;
 using AIStudio.Tools.ERIClient.DataModel;
+using AIStudio.Tools.PluginSystem;
 using AIStudio.Tools.RAG;
 using AIStudio.Tools.Services;

+using Lua;
+
 using ChatThread = AIStudio.Chat.ChatThread;
 using ContentType = AIStudio.Tools.ERIClient.DataModel.ContentType;

@ -17,6 +21,8 @@ namespace AIStudio.Settings.DataModel;
 /// </summary>
 public readonly record struct DataSourceERI_V1 : IERIDataSource
 {
+    private static readonly ILogger<DataSourceERI_V1> LOGGER = Program.LOGGER_FACTORY.CreateLogger<DataSourceERI_V1>();
+
    public DataSourceERI_V1()
    {
    }
@ -45,8 +51,17 @@ public readonly record struct DataSourceERI_V1 : IERIDataSource
    /// <inheritdoc />
    public string Username { get; init; } = string.Empty;

+    /// <inheritdoc />
+    public DataSourceERIUsernamePasswordMode UsernamePasswordMode { get; init; } = DataSourceERIUsernamePasswordMode.USER_MANAGED;
+
    /// <inheritdoc />
    public DataSourceSecurity SecurityPolicy { get; init; } = DataSourceSecurity.NOT_SPECIFIED;
+
+    /// <inheritdoc />
+    public bool IsEnterpriseConfiguration { get; init; }
+
+    /// <inheritdoc />
+    public Guid EnterpriseConfigurationPluginId { get; init; } = Guid.Empty;
    
    /// <inheritdoc />
    public ERIVersion Version { get; init; } = ERIVersion.V1;
@ -82,7 +97,7 @@ public readonly record struct DataSourceERI_V1 : IERIDataSource
                
                Thread = await thread.ToERIChatThread(token),
                MaxMatches = this.MaxMatches,
-                RetrievalProcessId = string.IsNullOrWhiteSpace(this.SelectedRetrievalId) ? null : this.SelectedRetrievalId,
+                RetrievalProcessId = this.SelectedRetrievalId,
                Parameters = null, // The ERI server selects useful default parameters
            };
            
@ -139,4 +154,173 @@ public readonly record struct DataSourceERI_V1 : IERIDataSource
        logger.LogWarning($"Was not able to authenticate with the ERI data source '{this.Name}'. Message: {authResponse.Message}");
        return [];
    }
+
+    public static bool TryParseConfiguration(int idx, LuaTable table, Guid configPluginId, out DataSourceERI_V1 dataSource)
+    {
+        dataSource = default;
+        if (!table.TryGetValue("Id", out var idValue) || !idValue.TryRead<string>(out var idText) || !Guid.TryParse(idText, out var id))
+        {
+            LOGGER.LogWarning($"The configured data source {idx} does not contain a valid ID. The ID must be a valid GUID. (Plugin ID: {configPluginId})");
+            return false;
+        }
+
+        if (!table.TryGetValue("Name", out var nameValue) || !nameValue.TryRead<string>(out var name) || string.IsNullOrWhiteSpace(name))
+        {
+            LOGGER.LogWarning($"The configured data source {idx} does not contain a valid name. (Plugin ID: {configPluginId})");
+            return false;
+        }
+
+        if (!table.TryGetValue("Type", out var typeValue) || !typeValue.TryRead<string>(out var typeText) || !Enum.TryParse<DataSourceType>(typeText, true, out var type) || type is not DataSourceType.ERI_V1)
+        {
+            LOGGER.LogWarning($"The configured data source {idx} does not contain a supported data source type. Only ERI_V1 is supported. (Plugin ID: {configPluginId})");
+            return false;
+        }
+
+        if (!table.TryGetValue("Hostname", out var hostnameValue) || !hostnameValue.TryRead<string>(out var hostname) || string.IsNullOrWhiteSpace(hostname))
+        {
+            LOGGER.LogWarning($"The configured data source {idx} does not contain a valid hostname. (Plugin ID: {configPluginId})");
+            return false;
+        }
+
+        if (!table.TryGetValue("Port", out var portValue) || !portValue.TryRead<int>(out var port) || port is < 1 or > 65535)
+        {
+            LOGGER.LogWarning($"The configured data source {idx} does not contain a valid port. (Plugin ID: {configPluginId})");
+            return false;
+        }
+
+        if (!table.TryGetValue("AuthMethod", out var authMethodValue) || !authMethodValue.TryRead<string>(out var authMethodText) || !Enum.TryParse<AuthMethod>(authMethodText, true, out var authMethod))
+        {
+            LOGGER.LogWarning($"The configured data source {idx} does not contain a valid auth method. (Plugin ID: {configPluginId})");
+            return false;
+        }
+
+        if (!table.TryGetValue("SecurityPolicy", out var securityPolicyValue) || !securityPolicyValue.TryRead<string>(out var securityPolicyText) || !Enum.TryParse<DataSourceSecurity>(securityPolicyText, true, out var securityPolicy))
+        {
+            LOGGER.LogWarning($"The configured data source {idx} does not contain a valid security policy. (Plugin ID: {configPluginId})");
+            return false;
+        }
+
+        if (securityPolicy is DataSourceSecurity.NOT_SPECIFIED)
+        {
+            LOGGER.LogWarning($"The configured data source {idx} must specify a security policy. (Plugin ID: {configPluginId})");
+            return false;
+        }
+
+        if (!table.TryGetValue("SelectedRetrievalId", out var selectedRetrievalIdValue) || !selectedRetrievalIdValue.TryRead<string>(out var selectedRetrievalId) || string.IsNullOrWhiteSpace(selectedRetrievalId))
+        {
+            LOGGER.LogWarning($"The configured data source {idx} must specify a selected retrieval ID. (Plugin ID: {configPluginId})");
+            return false;
+        }
+
+        if (!table.TryGetValue("MaxMatches", out var maxMatchesValue) || !maxMatchesValue.TryRead<int>(out var maxMatches) || maxMatches is < 1 or > ushort.MaxValue)
+        {
+            LOGGER.LogWarning($"The configured data source {idx} does not contain a valid maximum number of matches. (Plugin ID: {configPluginId})");
+            return false;
+        }
+
+        var username = string.Empty;
+        var usernamePasswordMode = DataSourceERIUsernamePasswordMode.USER_MANAGED;
+        if (table.TryGetValue("UsernamePasswordMode", out var usernamePasswordModeValue) && usernamePasswordModeValue.TryRead<string>(out var usernamePasswordModeText))
+        {
+            if (!Enum.TryParse(usernamePasswordModeText, true, out usernamePasswordMode))
+            {
+                LOGGER.LogWarning($"The configured data source {idx} does not contain a valid username/password mode. (Plugin ID: {configPluginId})");
+                return false;
+            }
+
+            if (usernamePasswordMode is DataSourceERIUsernamePasswordMode.USER_MANAGED)
+            {
+                LOGGER.LogWarning($"The configured data source {idx} uses the user-managed username/password mode. This mode is not allowed in configuration plugins. (Plugin ID: {configPluginId})");
+                return false;
+            }
+        }
+
+        if (authMethod is AuthMethod.USERNAME_PASSWORD)
+        {
+            if (!table.TryGetValue("UsernamePasswordMode", out _) || usernamePasswordMode is DataSourceERIUsernamePasswordMode.USER_MANAGED)
+            {
+                LOGGER.LogWarning($"The configured data source {idx} must specify an organization-managed username/password mode. (Plugin ID: {configPluginId})");
+                return false;
+            }
+
+            if (usernamePasswordMode is DataSourceERIUsernamePasswordMode.SHARED_USERNAME_AND_PASSWORD &&
+                (!table.TryGetValue("Username", out var usernameValue) || !usernameValue.TryRead<string>(out username) || string.IsNullOrWhiteSpace(username)))
+            {
+                LOGGER.LogWarning($"The configured data source {idx} must specify a username. (Plugin ID: {configPluginId})");
+                return false;
+            }
+        }
+
+        dataSource = new DataSourceERI_V1
+        {
+            Num = 0,
+            Id = id.ToString(),
+            Name = name,
+            Type = DataSourceType.ERI_V1,
+            Hostname = CleanHostname(hostname),
+            Port = port,
+            AuthMethod = authMethod,
+            Username = username,
+            UsernamePasswordMode = usernamePasswordMode,
+            SecurityPolicy = securityPolicy,
+            Version = ERIVersion.V1,
+            SelectedRetrievalId = selectedRetrievalId,
+            MaxMatches = (ushort)maxMatches,
+            IsEnterpriseConfiguration = true,
+            EnterpriseConfigurationPluginId = configPluginId,
+        };
+
+        return TryQueueEnterpriseSecret(idx, table, configPluginId, dataSource);
+    }
+
+    private static bool TryQueueEnterpriseSecret(int idx, LuaTable table, Guid configPluginId, DataSourceERI_V1 dataSource)
+    {
+        var secretFieldName = dataSource.AuthMethod switch
+        {
+            AuthMethod.TOKEN => "Token",
+            AuthMethod.USERNAME_PASSWORD => "Password",
+            _ => string.Empty,
+        };
+
+        if (string.IsNullOrWhiteSpace(secretFieldName))
+            return true;
+
+        if (!table.TryGetValue(secretFieldName, out var secretValue) || !secretValue.TryRead<string>(out var encryptedSecret) || string.IsNullOrWhiteSpace(encryptedSecret))
+        {
+            LOGGER.LogWarning($"The configured data source {idx} does not contain a valid encrypted {secretFieldName}. (Plugin ID: {configPluginId})");
+            return false;
+        }
+
+        if (!EnterpriseEncryption.IsEncrypted(encryptedSecret))
+        {
+            LOGGER.LogWarning($"The configured data source {idx} contains a plaintext {secretFieldName}. Only encrypted secrets (starting with 'ENC:v1:') are supported. (Plugin ID: {configPluginId})");
+            return false;
+        }
+
+        var encryption = PluginFactory.EnterpriseEncryption;
+        if (encryption?.IsAvailable != true)
+        {
+            LOGGER.LogWarning($"The configured data source {idx} contains an encrypted {secretFieldName}, but no encryption secret is configured. (Plugin ID: {configPluginId})");
+            return false;
+        }
+
+        if (!encryption.TryDecrypt(encryptedSecret, out var decryptedSecret))
+        {
+            LOGGER.LogWarning($"Failed to decrypt the {secretFieldName} for data source {idx}. The encryption secret may be incorrect. (Plugin ID: {configPluginId})");
+            return false;
+        }
+
+        PendingEnterpriseSecrets.Add(new(
+            $"{ISecretId.ENTERPRISE_KEY_PREFIX}::{dataSource.Id}",
+            dataSource.Name,
+            decryptedSecret));
+        LOGGER.LogDebug($"Successfully decrypted the {secretFieldName} for data source {idx}. It will be stored in the OS keyring. (Plugin ID: {configPluginId})");
+        return true;
+    }
+
+    private static string CleanHostname(string hostname)
+    {
+        var cleanedHostname = hostname.Trim();
+        return cleanedHostname.EndsWith('/') ? cleanedHostname[..^1] : cleanedHostname;
+    }
 }
--- a/Studio/Settings/DataModel/DataSourceLocalDirectory.cs
+++ b/Studio/Settings/DataModel/DataSourceLocalDirectory.cs
@ -35,6 +35,12 @@ public readonly record struct DataSourceLocalDirectory : IInternalDataSource
    
    /// <inheritdoc />
    public DataSourceSecurity SecurityPolicy { get; init; } = DataSourceSecurity.NOT_SPECIFIED;
+
+    /// <inheritdoc />
+    public bool IsEnterpriseConfiguration { get; init; }
+
+    /// <inheritdoc />
+    public Guid EnterpriseConfigurationPluginId { get; init; } = Guid.Empty;
    
    /// <inheritdoc />
    public ushort MaxMatches { get; init; } = 10;
--- a/Studio/Settings/DataModel/DataSourceLocalFile.cs
+++ b/Studio/Settings/DataModel/DataSourceLocalFile.cs
@ -35,6 +35,12 @@ public readonly record struct DataSourceLocalFile : IInternalDataSource
    
    /// <inheritdoc />
    public DataSourceSecurity SecurityPolicy { get; init; } = DataSourceSecurity.NOT_SPECIFIED;
+
+    /// <inheritdoc />
+    public bool IsEnterpriseConfiguration { get; init; }
+
+    /// <inheritdoc />
+    public Guid EnterpriseConfigurationPluginId { get; init; } = Guid.Empty;
    
    /// <inheritdoc />
    public ushort MaxMatches { get; init; } = 10;
--- a/Studio/Settings/IDataSource.cs
+++ b/Studio/Settings/IDataSource.cs
@ -2,6 +2,7 @@ using System.Text.Json.Serialization;

 using AIStudio.Chat;
 using AIStudio.Settings.DataModel;
+using AIStudio.Tools.PluginSystem;
 using AIStudio.Tools.RAG;

 namespace AIStudio.Settings;
@ -13,7 +14,7 @@ namespace AIStudio.Settings;
 [JsonDerivedType(typeof(DataSourceLocalDirectory), nameof(DataSourceType.LOCAL_DIRECTORY))]
 [JsonDerivedType(typeof(DataSourceLocalFile), nameof(DataSourceType.LOCAL_FILE))]
 [JsonDerivedType(typeof(DataSourceERI_V1), nameof(DataSourceType.ERI_V1))]
-public interface IDataSource
+public interface IDataSource : IConfigurationObject
 {
    /// <summary>
    /// The number of the data source.
@ -39,6 +40,16 @@ public interface IDataSource
    /// Which data security policy is applied to this data source?
    /// </summary>
    public DataSourceSecurity SecurityPolicy { get; init; }
+
+    /// <summary>
+    /// Is this data source an enterprise configuration?
+    /// </summary>
+    public bool IsEnterpriseConfiguration { get; init; }
+
+    /// <summary>
+    /// The ID of the enterprise configuration plugin.
+    /// </summary>
+    public Guid EnterpriseConfigurationPluginId { get; init; }
    
    /// <summary>
    /// The maximum number of matches to return when retrieving data from the ERI server.
--- a/Studio/Settings/IERIDataSource.cs
+++ b/Studio/Settings/IERIDataSource.cs
@ -24,6 +24,11 @@ public interface IERIDataSource : IExternalDataSource
    /// The username to use for authentication, when the auth. method is USERNAME_PASSWORD.
    /// </summary>
    public string Username { get; init; }
+
+    /// <summary>
+    /// How username/password authentication should obtain the username.
+    /// </summary>
+    public DataSourceERIUsernamePasswordMode UsernamePasswordMode { get; init; }
    
    /// <summary>
    /// The ERI specification to use.
--- a/Studio/Settings/IExternalDataSource.cs
+++ b/Studio/Settings/IExternalDataSource.cs
@ -7,7 +7,7 @@ public interface IExternalDataSource : IDataSource, ISecretId
    #region Implementation of ISecretId

    [JsonIgnore]
-    string ISecretId.SecretId => this.Id;
+    string ISecretId.SecretId => this.IsEnterpriseConfiguration ? $"{ISecretId.ENTERPRISE_KEY_PREFIX}::{this.Id}" : this.Id;

    [JsonIgnore]
    string ISecretId.SecretName => this.Name;
--- a/Studio/Tools/ERIClient/ERIClientV1.cs
+++ b/Studio/Tools/ERIClient/ERIClientV1.cs
@ -2,6 +2,7 @@ using System.Text;
 using System.Text.Json;

 using AIStudio.Settings;
+using AIStudio.Settings.DataModel;
 using AIStudio.Tools.ERIClient.DataModel;
 using AIStudio.Tools.PluginSystem;
 using AIStudio.Tools.Services;
@ -102,6 +103,19 @@ public class ERIClientV1(IERIDataSource dataSource) : ERIClientBase(dataSource),
                    }
            
                case AuthMethod.USERNAME_PASSWORD:
+                    if (this.DataSource.UsernamePasswordMode is DataSourceERIUsernamePasswordMode.OS_USERNAME_SHARED_PASSWORD)
+                    {
+                        username = await rustService.ReadUserName();
+                        if (string.IsNullOrWhiteSpace(username))
+                        {
+                            return new()
+                            {
+                                Successful = false,
+                                Message = TB("Failed to read the user's username from the operating system.")
+                            };
+                        }
+                    }
+
                    string password;
                    if (string.IsNullOrWhiteSpace(temporarySecret))
                    {
--- a/Studio/Tools/PluginSystem/PendingEnterpriseApiKey.cs
+++ b/Studio/Tools/PluginSystem/PendingEnterpriseApiKey.cs
@ -47,3 +47,47 @@ public static class PendingEnterpriseApiKeys
        }
    }
 }
+
+/// <summary>
+/// Represents a pending enterprise secret that needs to be stored in the OS keyring.
+/// </summary>
+/// <param name="SecretId">The secret ID.</param>
+/// <param name="SecretName">The secret name.</param>
+/// <param name="SecretData">The decrypted secret data.</param>
+public sealed record PendingEnterpriseSecret(
+    string SecretId,
+    string SecretName,
+    string SecretData);
+
+/// <summary>
+/// Static container for pending enterprise secrets during plugin loading.
+/// </summary>
+public static class PendingEnterpriseSecrets
+{
+    private static readonly List<PendingEnterpriseSecret> PENDING_SECRETS = [];
+    private static readonly Lock LOCK = new();
+
+    /// <summary>
+    /// Adds a pending enterprise secret to the list.
+    /// </summary>
+    /// <param name="secret">The pending enterprise secret to add.</param>
+    public static void Add(PendingEnterpriseSecret secret)
+    {
+        lock (LOCK)
+            PENDING_SECRETS.Add(secret);
+    }
+
+    /// <summary>
+    /// Gets and clears all pending enterprise secrets.
+    /// </summary>
+    /// <returns>A list of all pending enterprise secrets.</returns>
+    public static IReadOnlyList<PendingEnterpriseSecret> GetAndClear()
+    {
+        lock (LOCK)
+        {
+            var secrets = PENDING_SECRETS.ToList();
+            PENDING_SECRETS.Clear();
+            return secrets;
+        }
+    }
+}
--- a/Studio/Tools/PluginSystem/PluginConfiguration.cs
+++ b/Studio/Tools/PluginSystem/PluginConfiguration.cs
@ -39,12 +39,43 @@ public sealed class PluginConfiguration(bool isInternal, LuaState state, PluginT
        {
            // Store any decrypted API keys from enterprise configuration in the OS keyring:
            await StoreEnterpriseApiKeysAsync();
+            await StoreEnterpriseSecretsAsync();

            await SETTINGS_MANAGER.StoreSettings();
            await MessageBus.INSTANCE.SendMessage<bool>(null, Event.CONFIGURATION_CHANGED);
        }
    }

+    /// <summary>
+    /// Stores any pending enterprise secrets in the OS keyring.
+    /// </summary>
+    private static async Task StoreEnterpriseSecretsAsync()
+    {
+        var pendingSecrets = PendingEnterpriseSecrets.GetAndClear();
+        if (pendingSecrets.Count == 0)
+            return;
+
+        LOG.LogInformation($"Storing {pendingSecrets.Count} enterprise secret(s) in the OS keyring.");
+        var rustService = Program.SERVICE_PROVIDER.GetRequiredService<RustService>();
+        foreach (var pendingSecret in pendingSecrets)
+        {
+            try
+            {
+                var secretId = new TemporarySecretId(pendingSecret.SecretId, pendingSecret.SecretName);
+                var result = await rustService.SetSecret(secretId, pendingSecret.SecretData);
+
+                if (result.Success)
+                    LOG.LogDebug($"Successfully stored enterprise secret for '{pendingSecret.SecretName}' in the OS keyring.");
+                else
+                    LOG.LogWarning($"Failed to store enterprise secret for '{pendingSecret.SecretName}': {result.Issue}");
+            }
+            catch (Exception ex)
+            {
+                LOG.LogError(ex, $"Exception while storing enterprise secret for '{pendingSecret.SecretName}'.");
+            }
+        }
+    }
+
    /// <summary>
    /// Stores any pending enterprise API keys in the OS keyring.
    /// </summary>
@ -152,6 +183,9 @@ public sealed class PluginConfiguration(bool isInternal, LuaState state, PluginT

        // Handle configured chat templates:
        PluginConfigurationObject.TryParse(PluginConfigurationObjectType.CHAT_TEMPLATE, x => x.ChatTemplates, x => x.NextChatTemplateNum, mainTable, this.Id, ref this.configObjects, dryRun);
+
+        // Handle configured data sources:
+        PluginConfigurationObject.TryParseDataSources(mainTable, this.Id, ref this.configObjects, dryRun);
        
        // Handle configured profiles:
        PluginConfigurationObject.TryParse(PluginConfigurationObjectType.PROFILE, x => x.Profiles, x => x.NextProfileNum, mainTable, this.Id, ref this.configObjects, dryRun);
--- a/Studio/Tools/PluginSystem/PluginConfigurationObject.cs
+++ b/Studio/Tools/PluginSystem/PluginConfigurationObject.cs
@ -162,6 +162,87 @@ public sealed record PluginConfigurationObject
        return true;
    }

+    /// <summary>
+    /// Parses configured data sources from a configuration plugin.
+    /// </summary>
+    /// <param name="mainTable">The Lua table containing entries to parse into data sources.</param>
+    /// <param name="configPluginId">The unique identifier of the plugin associated with the data sources.</param>
+    /// <param name="configObjects">The list to populate with the parsed configuration objects.</param>
+    /// <param name="dryRun">Specifies whether to perform the operation as a dry run.</param>
+    /// <returns>True if the table was present and processed; otherwise false.</returns>
+    public static bool TryParseDataSources(
+        LuaTable mainTable,
+        Guid configPluginId,
+        ref List<PluginConfigurationObject> configObjects,
+        bool dryRun)
+    {
+        const string LUA_TABLE_NAME = "DATA_SOURCES";
+        if (!mainTable.TryGetValue(LUA_TABLE_NAME, out var luaValue) || !luaValue.TryRead<LuaTable>(out var luaTable))
+        {
+            LOG.LogWarning("The table '{LuaTableName}' does not exist or is not a valid table (config plugin id: {ConfigPluginId}).", LUA_TABLE_NAME, configPluginId);
+            return false;
+        }
+
+        var storedObjects = SETTINGS_MANAGER.ConfigurationData.DataSources;
+        var numberObjects = luaTable.ArrayLength;
+        ThreadSafeRandom? random = null;
+        for (var i = 1; i <= numberObjects; i++)
+        {
+            var luaObjectTableValue = luaTable[i];
+            if (!luaObjectTableValue.TryRead<LuaTable>(out var luaObjectTable))
+            {
+                LOG.LogWarning("The table '{LuaTableName}' entry at index {Index} is not a valid table (config plugin id: {ConfigPluginId}).", LUA_TABLE_NAME, i, configPluginId);
+                continue;
+            }
+
+            if (!DataSourceERI_V1.TryParseConfiguration(i, luaObjectTable, configPluginId, out var configObject))
+            {
+                LOG.LogWarning("The table '{LuaTableName}' entry at index {Index} does not contain a valid data source (config plugin id: {ConfigPluginId}).", LUA_TABLE_NAME, i, configPluginId);
+                continue;
+            }
+
+            configObjects.Add(new()
+            {
+                ConfigPluginId = configPluginId,
+                Id = Guid.Parse(configObject.Id),
+                Type = PluginConfigurationObjectType.DATA_SOURCE,
+            });
+
+            if (dryRun)
+                continue;
+
+            var objectIndex = storedObjects.FindIndex(t => t.Id == configObject.Id);
+            if (objectIndex > -1)
+            {
+                var existingObject = storedObjects[objectIndex];
+                configObject = configObject with { Num = existingObject.Num };
+                storedObjects[objectIndex] = configObject;
+            }
+            else
+            {
+                if (IncrementDataSourceNum() is { Success: true, UpdatedValue: var nextNum })
+                {
+                    configObject = configObject with { Num = nextNum };
+                    storedObjects.Add(configObject);
+                }
+                else
+                {
+                    random ??= new ThreadSafeRandom();
+                    configObject = configObject with { Num = (uint)random.Next(500_000, 1_000_000) };
+                    storedObjects.Add(configObject);
+                    LOG.LogWarning("The next number for the data source '{ConfigObjectName}' (id={ConfigObjectId}) could not be incremented. Using a random number instead (config plugin id: {ConfigPluginId}).", configObject.Name, configObject.Id, configPluginId);
+                }
+            }
+        }
+
+        return true;
+
+        static IncrementResult<uint> IncrementDataSourceNum()
+        {
+            return ((Expression<Func<Data, uint>>)(x => x.NextDataSourceNum)).TryIncrement(SETTINGS_MANAGER.ConfigurationData, IncrementType.POST);
+        }
+    }
+
    /// <summary>
    /// Cleans up configuration objects of a specified type that are no longer associated with any available plugin.
    /// </summary>
@ -177,7 +258,8 @@ public sealed record PluginConfigurationObject
        Expression<Func<Data, List<TClass>>> configObjectSelection,
        IList<IAvailablePlugin> availablePlugins,
        IList<PluginConfigurationObject> configObjectList,
-        SecretStoreType? secretStoreType = null) where TClass : IConfigurationObject
+        SecretStoreType? secretStoreType = null,
+        bool deleteSecret = false) where TClass : IConfigurationObject
    {
        var configuredObjects = configObjectSelection.Compile()(SETTINGS_MANAGER.ConfigurationData);
        var leftOverObjects = new List<TClass>();
@ -220,7 +302,15 @@ public sealed record PluginConfigurationObject
            configuredObjects.Remove(item);
        
            // Delete the API key from the OS keyring if the removed object has one:
-            if(secretStoreType is not null && item is ISecretId secretId)
+            if(deleteSecret && item is ISecretId regularSecretId)
+            {
+                var deleteResult = await RUST_SERVICE.DeleteSecret(regularSecretId);
+                if (deleteResult.Success)
+                    LOG.LogInformation($"Successfully deleted secret for removed enterprise object '{item.Name}' from the OS keyring.");
+                else
+                    LOG.LogWarning($"Failed to delete secret for removed enterprise object '{item.Name}' from the OS keyring: {deleteResult.Issue}");
+            }
+            else if(secretStoreType is not null && item is ISecretId secretId)
            {
                var deleteResult = await RUST_SERVICE.DeleteAPIKey(secretId, secretStoreType.Value);
                if (deleteResult.Success)
--- a/Studio/Tools/PluginSystem/PluginFactory.Loading.cs
+++ b/Studio/Tools/PluginSystem/PluginFactory.Loading.cs
@ -174,6 +174,10 @@ public static partial class PluginFactory
        if(await PluginConfigurationObject.CleanLeftOverConfigurationObjects(PluginConfigurationObjectType.EMBEDDING_PROVIDER, x => x.EmbeddingProviders, AVAILABLE_PLUGINS, configObjectList, SecretStoreType.EMBEDDING_PROVIDER))
            wasConfigurationChanged = true;

+        // Check data sources:
+        if(await PluginConfigurationObject.CleanLeftOverConfigurationObjects(PluginConfigurationObjectType.DATA_SOURCE, x => x.DataSources, AVAILABLE_PLUGINS, configObjectList, deleteSecret: true))
+            wasConfigurationChanged = true;
+
        // Check chat templates:
        if(await PluginConfigurationObject.CleanLeftOverConfigurationObjects(PluginConfigurationObjectType.CHAT_TEMPLATE, x => x.ChatTemplates, AVAILABLE_PLUGINS, configObjectList))
            wasConfigurationChanged = true;
--- a/Studio/Tools/SecretStoreType.cs
+++ b/Studio/Tools/SecretStoreType.cs
@ -29,4 +29,4 @@ public enum SecretStoreType
    /// Image provider secrets. Uses the "image::" prefix.
    /// </summary>
    IMAGE_PROVIDER,
-}
+}
--- a/Studio/Tools/Services/EnterpriseEnvironmentService.cs
+++ b/Studio/Tools/Services/EnterpriseEnvironmentService.cs
@ -263,7 +263,9 @@ public sealed class EnterpriseEnvironmentService(ILogger<EnterpriseEnvironmentSe
        {
            try
            {
-                var deleteResult = await rustService.DeleteAPIKey(target, target.StoreType);
+                var deleteResult = target.StoreType is { } storeType
+                    ? await rustService.DeleteAPIKey(target, storeType)
+                    : await rustService.DeleteSecret(target);
                if (deleteResult.Success)
                {
                    if (deleteResult.WasEntryFound)
@ -289,13 +291,14 @@ public sealed class EnterpriseEnvironmentService(ILogger<EnterpriseEnvironmentSe
        AddEnterpriseManagedSecretTargets(configurationData.Providers, SecretStoreType.LLM_PROVIDER, secretTargets);
        AddEnterpriseManagedSecretTargets(configurationData.EmbeddingProviders, SecretStoreType.EMBEDDING_PROVIDER, secretTargets);
        AddEnterpriseManagedSecretTargets(configurationData.TranscriptionProviders, SecretStoreType.TRANSCRIPTION_PROVIDER, secretTargets);
+        AddEnterpriseManagedSecretTargets(configurationData.DataSources.OfType<IExternalDataSource>(), null, secretTargets);

        return secretTargets.ToList();
    }

    private static void AddEnterpriseManagedSecretTargets<TSecret>(
        IEnumerable<TSecret> secrets,
-        SecretStoreType storeType,
+        SecretStoreType? storeType,
        ISet<EnterpriseSecretTarget> secretTargets) where TSecret : ISecretId, IConfigurationObject
    {
        foreach (var secret in secrets)
--- a/Studio/Tools/Services/RustService.OS.cs
+++ b/Studio/Tools/Services/RustService.OS.cs
@ -32,4 +32,35 @@ public sealed partial class RustService
            this.userLanguageLock.Release();
        }
    }
+
+    public async Task<string> ReadUserName(bool forceRequest = false)
+    {
+        if (!forceRequest && !string.IsNullOrWhiteSpace(this.cachedUserName))
+            return this.cachedUserName;
+
+        await this.userNameLock.WaitAsync();
+        try
+        {
+            if (!forceRequest && !string.IsNullOrWhiteSpace(this.cachedUserName))
+                return this.cachedUserName;
+
+            var response = await this.http.GetAsync("/system/username");
+            if (!response.IsSuccessStatusCode)
+            {
+                this.logger!.LogError($"Failed to read the user name from Rust: '{response.StatusCode}'");
+                return string.Empty;
+            }
+
+            var userName = (await response.Content.ReadAsStringAsync()).Trim();
+            if (string.IsNullOrWhiteSpace(userName))
+                return string.Empty;
+
+            this.cachedUserName = userName;
+            return userName;
+        }
+        finally
+        {
+            this.userNameLock.Release();
+        }
+    }
 }
--- a/Studio/Tools/Services/RustService.cs
+++ b/Studio/Tools/Services/RustService.cs
@ -18,6 +18,7 @@ public sealed partial class RustService : BackgroundService
    
    private readonly HttpClient http;
    private readonly SemaphoreSlim userLanguageLock = new(1, 1);
+    private readonly SemaphoreSlim userNameLock = new(1, 1);

    private readonly JsonSerializerOptions jsonRustSerializerOptions = new()
    {
@ -31,6 +32,7 @@ public sealed partial class RustService : BackgroundService
    private ILogger<RustService>? logger;
    private Encryption? encryptor;
    private string? cachedUserLanguage;
+    private string? cachedUserName;
    
    private readonly string apiPort;
    private readonly string certificateFingerprint;
@ -91,6 +93,7 @@ public sealed partial class RustService : BackgroundService
    {
        this.http.Dispose();
        this.userLanguageLock.Dispose();
+        this.userNameLock.Dispose();
        base.Dispose();
    }

--- a/Studio/wwwroot/changelog/v26.5.5.md
+++ b/Studio/wwwroot/changelog/v26.5.5.md
@ -1,4 +1,5 @@
 # v26.5.5, build 240 (2026-05-xx xx:xx UTC)
+- Added support for organization-managed ERI servers in configuration plugins, so admins can preconfigure external data sources for users.
 - Released the voice recording and transcription for all users. You no longer need to enable a preview feature to configure transcription providers, select a transcription provider, or use dictation.
 - Improved the app's security foundation with major modernization of the native runtime and its internal communication layer. This work is mostly invisible during everyday use, but it replaces older components that no longer received the security updates we require. We also continued updating security-sensitive dependencies so AI Studio stays on a healthier, better maintained base.
 - Improved the Pandoc management and detection process to make it more reliable.
@ -9,4 +10,4 @@
 - Upgraded Tauri to v2.11.1.
 - Upgraded PDFium to v148.0.7763.0.
 - Upgraded Qdrant to v1.18.0.
- Upgraded other dependencies as well.
+- Upgraded other dependencies as well.
--- a/runtime/Cargo.lock
+++ b/runtime/Cargo.lock
@ -2893,9 +2893,9 @@ dependencies = [

 [[package]]
 name = "libc"
-version = "0.2.183"
+version = "0.2.186"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5b646652bf6661599e1da8901b3b9522896f01e736bad5f723fe7a3a27f899d"
+checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"

 [[package]]
 name = "libdbus-sys"
@ -2928,11 +2928,10 @@ dependencies = [

 [[package]]
 name = "libredox"
-version = "0.1.3"
+version = "0.1.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0ff37bd590ca25063e35af745c343cb7a0271906fb7b37e4813e8f79f00268d"
+checksum = "e02f3bb43d335493c96bf3fd3a321600bf6bd07ed34bc64118e9293bdffea46c"
 dependencies = [
- "bitflags 2.11.1",
 "libc",
 ]

@ -3097,6 +3096,7 @@ dependencies = [
 "tempfile",
 "tokio",
 "tokio-stream",
+ "whoami",
 "windows-native-keyring-store",
 "windows-registry",
 ]
@ -3549,6 +3549,15 @@ dependencies = [
 "objc2-foundation 0.3.2",
 ]

+[[package]]
+name = "objc2-system-configuration"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7216bd11cbda54ccabcab84d523dc93b858ec75ecfb3a7d89513fa22464da396"
+dependencies = [
+ "objc2-core-foundation",
+]
+
 [[package]]
 name = "objc2-ui-kit"
 version = "0.3.0"
@ -6079,6 +6088,15 @@ dependencies = [
 "wit-bindgen",
 ]

+[[package]]
+name = "wasite"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "66fe902b4a6b8028a753d5424909b764ccf79b7a209eac9bf97e59cda9f71a42"
+dependencies = [
+ "wasi 0.13.3+wasi-0.2.2",
+]
+
 [[package]]
 name = "wasm-bindgen"
 version = "0.2.120"
@ -6298,6 +6316,19 @@ version = "0.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "53a85b86a771b1c87058196170769dd264f66c0782acf1ae6cc51bfd64b39082"

+[[package]]
+name = "whoami"
+version = "2.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "998767ef88740d1f5b0682a9c53c24431453923962269c2db68ee43788c5a40d"
+dependencies = [
+ "libc",
+ "libredox",
+ "objc2-system-configuration",
+ "wasite",
+ "web-sys",
+]
+
 [[package]]
 name = "winapi"
 version = "0.3.9"
--- a/runtime/Cargo.toml
+++ b/runtime/Cargo.toml
@ -41,6 +41,7 @@ file-format = "0.29.0"
 calamine = "0.35.0"
 pdfium-render = "0.9.1"
 sys-locale = "0.3.2"
+whoami = "2.1.2"
 cfg-if = "1.0.4"
 pptx-to-md = "0.4.0"
 tempfile = "3.27.0"
--- a/runtime/src/environment.rs
+++ b/runtime/src/environment.rs
@ -1,6 +1,6 @@
 use crate::api_token::APIToken;
 use axum::Json;
-use log::{debug, info, warn};
+use log::{debug, error, info, warn};
 use serde::Serialize;
 use std::collections::{HashMap, HashSet};
 use std::env;
@ -43,6 +43,14 @@ pub async fn get_data_directory(_token: APIToken) -> String {
    }
 }

+/// Returns the current user's username.
+pub async fn read_user_name(_token: APIToken) -> String {
+    whoami::username().unwrap_or_else(|e| {
+        error!("Failed to read the current OS username: {e}.");
+        String::new()
+    })
+}
+
 /// Returns true if the application is running in development mode.
 pub fn is_dev() -> bool {
    cfg!(debug_assertions)
--- a/runtime/src/runtime_api.rs
+++ b/runtime/src/runtime_api.rs
@ -48,6 +48,7 @@ pub fn start_runtime_api() {
        .route("/system/directories/config", get(crate::environment::get_config_directory))
        .route("/system/directories/data", get(crate::environment::get_data_directory))
        .route("/system/language", get(crate::environment::read_user_language))
+        .route("/system/username", get(crate::environment::read_user_name))
        .route("/system/enterprise/config/id", get(crate::environment::read_enterprise_env_config_id))
        .route("/system/enterprise/config/server", get(crate::environment::read_enterprise_env_config_server_url))
        .route("/system/enterprise/config/encryption_secret", get(crate::environment::read_enterprise_env_config_encryption_secret))