feat: Custom text login (#1925)

* feat: default custom message text

* feat: org custom message text

* feat: org custom message text

* feat: custom messages query side

* feat: default messages

* feat: message text user fields

* feat: check for inactive user

* feat: fix send password reset

* feat: fix custom org text

* feat: add variables to docs

* feat: custom text tests

* feat: fix notifications

* feat: add custom text feature

* feat: add custom text feature

* feat: feature in custom message texts

* feat: add custom text feature in frontend

* feat: merge main

* feat: feature tests

* feat: change phone message in setup

* fix: remove unused code, add event translation

* fix: merge main and fix problems

* fix: english translation file

* fix: migration versions

* fix: setup

* fix: custom login text

* feat: add all possible custom texts for login

* feat: iam login texts

* feat: org login texts

* feat: protos

* fix: custom text in admin api

* fix: add success login text

* fix: docs

* fix: add custom login texts to management api

* fix: add sub messages to custom login texts

* fix: setup custom texts

* feat: get org login texts

* feat: get org login texts

* feat: handler in adminapi

* feat: handlers in auth and admin

* feat: render login texts

* feat: custom login text

* feat: add all login text keys

* feat: handle correct login texts

* feat: custom login texts in command side

* feat: custom login texts in command side

* feat: fix yaml file

* feat: merge master and add confirmation text

* feat: fix html

* feat: read default login texts

* feat: get default text files

* feat: get custom texts org

* feat: tests

* feat: change translator handling

* fix translator from authReq

* feat: change h1 on login screens

* feat: add custom login text for remove

* feat: add custom login text for remove

* feat: cache translation files

* feat: cache translation files

* feat: zitadel user in env var

* feat: add registration user description

* feat: better func naming

* feat: tests

* feat: add mutex to read file

* feat: add mutex to read file

* fix mutex for accessing translation map

* fix: translation key

Co-authored-by: Livio Amstutz <[email protected]>

internal/ui/login/handler/change_password_handler.go

@@ -43,7 +43,7 @@ func (l *Login) renderChangePassword(w http.ResponseWriter, r *http.Request, aut
 		baseData:    l.getBaseData(r, authReq, "Change Password", errID, errMessage),
 		profileData: l.getProfileData(authReq),
 	}
-	policy, description, _ := l.getPasswordComplexityPolicy(r, authReq.UserOrgID)
+	policy, description, _ := l.getPasswordComplexityPolicy(r, authReq, authReq.UserOrgID)
 	if policy != nil {
 		data.PasswordPolicyDescription = description
 		data.MinLength = policy.MinLength
@@ -60,11 +60,12 @@ func (l *Login) renderChangePassword(w http.ResponseWriter, r *http.Request, aut
 			data.HasNumber = NumberRegex
 		}
 	}
-	l.renderer.RenderTemplate(w, r, l.renderer.Templates[tmplChangePassword], data, nil)
+	translator := l.getTranslator(authReq)
+	l.renderer.RenderTemplate(w, r, translator, l.renderer.Templates[tmplChangePassword], data, nil)
 }
 
 func (l *Login) renderChangePasswordDone(w http.ResponseWriter, r *http.Request, authReq *domain.AuthRequest) {
 	var errType, errMessage string
 	data := l.getUserData(r, authReq, "Password Change Done", errType, errMessage)
-	l.renderer.RenderTemplate(w, r, l.renderer.Templates[tmplChangePasswordDone], data, nil)
+	l.renderer.RenderTemplate(w, r, l.getTranslator(authReq), l.renderer.Templates[tmplChangePasswordDone], data, nil)
 }

internal/ui/login/handler/external_login_handler.go

@@ -148,7 +148,8 @@ func (l *Login) renderExternalNotFoundOption(w http.ResponseWriter, r *http.Requ
 	data := externalNotFoundOptionData{
 		baseData: l.getBaseData(r, authReq, "ExternalNotFoundOption", errID, errMessage),
 	}
-	l.renderer.RenderTemplate(w, r, l.renderer.Templates[tmplExternalNotFoundOption], data, nil)
+	translator := l.getTranslator(authReq)
+	l.renderer.RenderTemplate(w, r, translator, l.renderer.Templates[tmplExternalNotFoundOption], data, nil)
 }
 
 func (l *Login) handleExternalNotFoundOptionCheck(w http.ResponseWriter, r *http.Request) {

internal/ui/login/handler/init_password_handler.go

@@ -103,14 +103,13 @@ func (l *Login) renderInitPassword(w http.ResponseWriter, r *http.Request, authR
 	if userID == "" && authReq != nil {
 		userID = authReq.UserID
 	}
-
 	data := initPasswordData{
 		baseData:    l.getBaseData(r, authReq, "Init Password", errID, errMessage),
 		profileData: l.getProfileData(authReq),
 		UserID:      userID,
 		Code:        code,
 	}
-	policy, description, _ := l.getPasswordComplexityPolicyByUserID(r, userID)
+	policy, description, _ := l.getPasswordComplexityPolicyByUserID(r, authReq, userID)
 	if policy != nil {
 		data.PasswordPolicyDescription = description
 		data.MinLength = policy.MinLength
@@ -127,10 +126,11 @@ func (l *Login) renderInitPassword(w http.ResponseWriter, r *http.Request, authR
 			data.HasNumber = NumberRegex
 		}
 	}
-	l.renderer.RenderTemplate(w, r, l.renderer.Templates[tmplInitPassword], data, nil)
+	translator := l.getTranslator(authReq)
+	l.renderer.RenderTemplate(w, r, translator, l.renderer.Templates[tmplInitPassword], data, nil)
 }
 
 func (l *Login) renderInitPasswordDone(w http.ResponseWriter, r *http.Request, authReq *domain.AuthRequest) {
 	data := l.getUserData(r, authReq, "Password Init Done", "", "")
-	l.renderer.RenderTemplate(w, r, l.renderer.Templates[tmplInitPasswordDone], data, nil)
+	l.renderer.RenderTemplate(w, r, l.getTranslator(authReq), l.renderer.Templates[tmplInitPasswordDone], data, nil)
 }

internal/ui/login/handler/init_user_handler.go

@@ -104,7 +104,7 @@ func (l *Login) renderInitUser(w http.ResponseWriter, r *http.Request, authReq *
 		Code:        code,
 		PasswordSet: passwordSet,
 	}
-	policy, description, _ := l.getPasswordComplexityPolicyByUserID(r, userID)
+	policy, description, _ := l.getPasswordComplexityPolicyByUserID(r, nil, userID)
 	if policy != nil {
 		data.PasswordPolicyDescription = description
 		data.MinLength = policy.MinLength
@@ -121,10 +121,11 @@ func (l *Login) renderInitUser(w http.ResponseWriter, r *http.Request, authReq *
 			data.HasNumber = NumberRegex
 		}
 	}
-	l.renderer.RenderTemplate(w, r, l.renderer.Templates[tmplInitUser], data, nil)
+	translator := l.getTranslator(authReq)
+	l.renderer.RenderTemplate(w, r, translator, l.renderer.Templates[tmplInitUser], data, nil)
 }
 
 func (l *Login) renderInitUserDone(w http.ResponseWriter, r *http.Request, authReq *domain.AuthRequest) {
 	data := l.getUserData(r, authReq, "User Init Done", "", "")
-	l.renderer.RenderTemplate(w, r, l.renderer.Templates[tmplInitUserDone], data, nil)
+	l.renderer.RenderTemplate(w, r, l.getTranslator(authReq), l.renderer.Templates[tmplInitUserDone], data, nil)
 }

internal/ui/login/handler/link_users_handler.go

@@ -19,5 +19,5 @@ func (l *Login) linkUsers(w http.ResponseWriter, r *http.Request, authReq *domai
 func (l *Login) renderLinkUsersDone(w http.ResponseWriter, r *http.Request, authReq *domain.AuthRequest, err error) {
 	var errType, errMessage string
 	data := l.getUserData(r, authReq, "Linking Users Done", errType, errMessage)
-	l.renderer.RenderTemplate(w, r, l.renderer.Templates[tmplLinkUsersDone], data, nil)
+	l.renderer.RenderTemplate(w, r, l.getTranslator(authReq), l.renderer.Templates[tmplLinkUsersDone], data, nil)
 }

internal/ui/login/handler/login_handler.go

@@ -77,5 +77,5 @@ func (l *Login) renderLogin(w http.ResponseWriter, r *http.Request, authReq *dom
 			return authReq.LoginPolicy != nil && authReq.LoginPolicy.AllowExternalIDP && authReq.AllowedExternalIDPs != nil && len(authReq.AllowedExternalIDPs) > 0
 		},
 	}
-	l.renderer.RenderTemplate(w, r, l.renderer.Templates[tmplLogin], data, funcs)
+	l.renderer.RenderTemplate(w, r, l.getTranslator(authReq), l.renderer.Templates[tmplLogin], data, funcs)
 }

internal/ui/login/handler/login_success_handler.go

@@ -41,5 +41,5 @@ func (l *Login) renderSuccessAndCallback(w http.ResponseWriter, r *http.Request,
 	if authReq != nil {
 		data.RedirectURI = l.oidcAuthCallbackURL
 	}
-	l.renderer.RenderTemplate(w, r, l.renderer.Templates[tmplLoginSuccess], data, nil)
+	l.renderer.RenderTemplate(w, r, l.getTranslator(authReq), l.renderer.Templates[tmplLoginSuccess], data, nil)
 }

internal/ui/login/handler/logout_handler.go

@@ -14,5 +14,5 @@ func (l *Login) handleLogoutDone(w http.ResponseWriter, r *http.Request) {
 
 func (l *Login) renderLogoutDone(w http.ResponseWriter, r *http.Request) {
 	data := l.getUserData(r, nil, "Logout Done", "", "")
-	l.renderer.RenderTemplate(w, r, l.renderer.Templates[tmplLogoutDone], data, nil)
+	l.renderer.RenderTemplate(w, r, l.getTranslator(nil), l.renderer.Templates[tmplLogoutDone], data, nil)
 }

internal/ui/login/handler/mail_verify_handler.go

@@ -81,7 +81,8 @@ func (l *Login) renderMailVerification(w http.ResponseWriter, r *http.Request, a
 		UserID:      userID,
 		profileData: l.getProfileData(authReq),
 	}
-	l.renderer.RenderTemplate(w, r, l.renderer.Templates[tmplMailVerification], data, nil)
+	translator := l.getTranslator(authReq)
+	l.renderer.RenderTemplate(w, r, translator, l.renderer.Templates[tmplMailVerification], data, nil)
 }
 
 func (l *Login) renderMailVerified(w http.ResponseWriter, r *http.Request, authReq *domain.AuthRequest) {
@@ -89,5 +90,6 @@ func (l *Login) renderMailVerified(w http.ResponseWriter, r *http.Request, authR
 		baseData:    l.getBaseData(r, authReq, "Mail Verified", "", ""),
 		profileData: l.getProfileData(authReq),
 	}
-	l.renderer.RenderTemplate(w, r, l.renderer.Templates[tmplMailVerified], data, nil)
+	translator := l.getTranslator(authReq)
+	l.renderer.RenderTemplate(w, r, translator, l.renderer.Templates[tmplMailVerified], data, nil)
 }

internal/ui/login/handler/mfa_init_done_handler.go

@@ -16,5 +16,6 @@ func (l *Login) renderMFAInitDone(w http.ResponseWriter, r *http.Request, authRe
 	var errType, errMessage string
 	data.baseData = l.getBaseData(r, authReq, "MFA Init Done", errType, errMessage)
 	data.profileData = l.getProfileData(authReq)
-	l.renderer.RenderTemplate(w, r, l.renderer.Templates[tmplMFAInitDone], data, nil)
+	translator := l.getTranslator(authReq)
+	l.renderer.RenderTemplate(w, r, translator, l.renderer.Templates[tmplMFAInitDone], data, nil)
 }

internal/ui/login/handler/mfa_init_u2f.go

@@ -37,7 +37,7 @@ func (l *Login) renderRegisterU2F(w http.ResponseWriter, r *http.Request, authRe
 		},
 		MFAType: model.MFATypeU2F,
 	}
-	l.renderer.RenderTemplate(w, r, l.renderer.Templates[tmplMFAU2FInit], data, nil)
+	l.renderer.RenderTemplate(w, r, l.getTranslator(authReq), l.renderer.Templates[tmplMFAU2FInit], data, nil)
 }
 
 func (l *Login) handleRegisterU2F(w http.ResponseWriter, r *http.Request) {

internal/ui/login/handler/mfa_init_verify_handler.go

@@ -78,7 +78,8 @@ func (l *Login) renderMFAInitVerify(w http.ResponseWriter, r *http.Request, auth
 		}
 	}
 
-	l.renderer.RenderTemplate(w, r, l.renderer.Templates[tmplMFAInitVerify], data, nil)
+	translator := l.getTranslator(authReq)
+	l.renderer.RenderTemplate(w, r, translator, l.renderer.Templates[tmplMFAInitVerify], data, nil)
 }
 
 func generateQrCode(url string) (string, error) {

internal/ui/login/handler/mfa_prompt_handler.go

@@ -73,7 +73,8 @@ func (l *Login) renderMFAPrompt(w http.ResponseWriter, r *http.Request, authReq
 		l.handleMFACreation(w, r, authReq, data)
 		return
 	}
-	l.renderer.RenderTemplate(w, r, l.renderer.Templates[tmplMFAPrompt], data, nil)
+	translator := l.getTranslator(authReq)
+	l.renderer.RenderTemplate(w, r, translator, l.renderer.Templates[tmplMFAPrompt], data, nil)
 }
 
 func (l *Login) handleMFACreation(w http.ResponseWriter, r *http.Request, authReq *domain.AuthRequest, data *mfaVerifyData) {

internal/ui/login/handler/mfa_verify_handler.go

@@ -73,7 +73,7 @@ func (l *Login) renderMFAVerifySelected(w http.ResponseWriter, r *http.Request,
 		l.renderError(w, r, authReq, err)
 		return
 	}
-	l.renderer.RenderTemplate(w, r, l.renderer.Templates[tmplMFAVerify], data, nil)
+	l.renderer.RenderTemplate(w, r, l.getTranslator(authReq), l.renderer.Templates[tmplMFAVerify], data, nil)
 }
 
 func removeSelectedProviderFromList(providers []domain.MFAType, selected domain.MFAType) []domain.MFAType {

internal/ui/login/handler/mfa_verify_u2f_handler.go

@@ -44,7 +44,7 @@ func (l *Login) renderU2FVerification(w http.ResponseWriter, r *http.Request, au
 		MFAProviders:     providers,
 		SelectedProvider: -1,
 	}
-	l.renderer.RenderTemplate(w, r, l.renderer.Templates[tmplU2FVerification], data, nil)
+	l.renderer.RenderTemplate(w, r, l.getTranslator(authReq), l.renderer.Templates[tmplU2FVerification], data, nil)
 }
 
 func (l *Login) handleU2FVerification(w http.ResponseWriter, r *http.Request) {

internal/ui/login/handler/password_complexity_policy_handler.go

@@ -6,6 +6,7 @@ import (
 	"strconv"
 
 	"github.com/caos/zitadel/internal/auth_request/model"
+	"github.com/caos/zitadel/internal/domain"
 	"github.com/caos/zitadel/internal/errors"
 	iam_model "github.com/caos/zitadel/internal/iam/model"
 )
@@ -24,16 +25,16 @@ var (
 	hasSymbol          = regexp.MustCompile(SymbolRegex).MatchString
 )
 
-func (l *Login) getPasswordComplexityPolicy(r *http.Request, orgID string) (*iam_model.PasswordComplexityPolicyView, string, error) {
+func (l *Login) getPasswordComplexityPolicy(r *http.Request, authReq *domain.AuthRequest, orgID string) (*iam_model.PasswordComplexityPolicyView, string, error) {
 	policy, err := l.authRepo.GetMyPasswordComplexityPolicy(setContext(r.Context(), orgID))
 	if err != nil {
 		return nil, err.Error(), err
 	}
-	description, err := l.generatePolicyDescription(r, policy)
+	description, err := l.generatePolicyDescription(r, authReq, policy)
 	return policy, description, nil
 }
 
-func (l *Login) getPasswordComplexityPolicyByUserID(r *http.Request, userID string) (*iam_model.PasswordComplexityPolicyView, string, error) {
+func (l *Login) getPasswordComplexityPolicyByUserID(r *http.Request, authReq *domain.AuthRequest, userID string) (*iam_model.PasswordComplexityPolicyView, string, error) {
 	user, err := l.authRepo.UserByID(r.Context(), userID)
 	if err != nil {
 		return nil, "", nil
@@ -42,31 +43,32 @@ func (l *Login) getPasswordComplexityPolicyByUserID(r *http.Request, userID stri
 	if err != nil {
 		return nil, err.Error(), err
 	}
-	description, err := l.generatePolicyDescription(r, policy)
+	description, err := l.generatePolicyDescription(r, authReq, policy)
 	return policy, description, nil
 }
 
-func (l *Login) generatePolicyDescription(r *http.Request, policy *iam_model.PasswordComplexityPolicyView) (string, error) {
+func (l *Login) generatePolicyDescription(r *http.Request, authReq *domain.AuthRequest, policy *iam_model.PasswordComplexityPolicyView) (string, error) {
 	description := "<ul class=\"lgn-no-dots lgn-policy\" id=\"passwordcomplexity\">"
-	minLength := l.renderer.LocalizeFromRequest(r, "Password.MinLength", nil)
+	translator := l.getTranslator(authReq)
+	minLength := l.renderer.LocalizeFromRequest(translator, r, "Password.MinLength", nil)
 	description += "<li id=\"minlength\" class=\"invalid\"><i class=\"lgn-icon-times-solid lgn-warn\"></i><span>" + minLength + " " + strconv.Itoa(int(policy.MinLength)) + "</span></li>"
 	if policy.HasUppercase {
-		uppercase := l.renderer.LocalizeFromRequest(r, "Password.HasUppercase", nil)
+		uppercase := l.renderer.LocalizeFromRequest(translator, r, "Password.HasUppercase", nil)
 		description += "<li id=\"uppercase\" class=\"invalid\"><i class=\"lgn-icon-times-solid lgn-warn\"></i><span>" + uppercase + "</span></li>"
 	}
 	if policy.HasLowercase {
-		lowercase := l.renderer.LocalizeFromRequest(r, "Password.HasLowercase", nil)
+		lowercase := l.renderer.LocalizeFromRequest(translator, r, "Password.HasLowercase", nil)
 		description += "<li id=\"lowercase\" class=\"invalid\"><i class=\"lgn-icon-times-solid lgn-warn\"></i><span>" + lowercase + "</span></li>"
 	}
 	if policy.HasNumber {
-		hasnumber := l.renderer.LocalizeFromRequest(r, "Password.HasNumber", nil)
+		hasnumber := l.renderer.LocalizeFromRequest(translator, r, "Password.HasNumber", nil)
 		description += "<li id=\"number\" class=\"invalid\"><i class=\"lgn-icon-times-solid lgn-warn\"></i><span>" + hasnumber + "</span></li>"
 	}
 	if policy.HasSymbol {
-		hassymbol := l.renderer.LocalizeFromRequest(r, "Password.HasSymbol", nil)
+		hassymbol := l.renderer.LocalizeFromRequest(translator, r, "Password.HasSymbol", nil)
 		description += "<li id=\"symbol\" class=\"invalid\"><i class=\"lgn-icon-times-solid lgn-warn\"></i><span>" + hassymbol + "</span></li>"
 	}
-	confirmation := l.renderer.LocalizeFromRequest(r, "Password.Confirmation", nil)
+	confirmation := l.renderer.LocalizeFromRequest(translator, r, "Password.Confirmation", nil)
 	description += "<li id=\"confirmation\" class=\"invalid\"><i class=\"lgn-icon-times-solid lgn-warn\"></i><span>" + confirmation + "</span></li>"
 
 	description += "</ul>"

internal/ui/login/handler/password_handler.go

@@ -29,7 +29,7 @@ func (l *Login) renderPassword(w http.ResponseWriter, r *http.Request, authReq *
 			return true
 		},
 	}
-	l.renderer.RenderTemplate(w, r, l.renderer.Templates[tmplPassword], data, funcs)
+	l.renderer.RenderTemplate(w, r, l.getTranslator(authReq), l.renderer.Templates[tmplPassword], data, funcs)
 }
 
 func (l *Login) handlePasswordCheck(w http.ResponseWriter, r *http.Request) {

internal/ui/login/handler/password_reset_handler.go

@@ -30,5 +30,5 @@ func (l *Login) renderPasswordResetDone(w http.ResponseWriter, r *http.Request,
 		errID, errMessage = l.getErrorMessage(r, err)
 	}
 	data := l.getUserData(r, authReq, "Password Reset Done", errID, errMessage)
-	l.renderer.RenderTemplate(w, r, l.renderer.Templates[tmplPasswordResetDone], data, nil)
+	l.renderer.RenderTemplate(w, r, l.getTranslator(authReq), l.renderer.Templates[tmplPasswordResetDone], data, nil)
 }

internal/ui/login/handler/passwordless_login_handler.go

@@ -46,7 +46,7 @@ func (l *Login) renderPasswordlessVerification(w http.ResponseWriter, r *http.Re
 		},
 		passwordLogin,
 	}
-	l.renderer.RenderTemplate(w, r, l.renderer.Templates[tmplPasswordlessVerification], data, nil)
+	l.renderer.RenderTemplate(w, r, l.getTranslator(authReq), l.renderer.Templates[tmplPasswordlessVerification], data, nil)
 }
 
 func (l *Login) handlePasswordlessVerification(w http.ResponseWriter, r *http.Request) {

internal/ui/login/handler/register_handler.go

@@ -36,6 +36,7 @@ type registerData struct {
 	HasNumber                 string
 	HasSymbol                 string
 	ShowUsername              bool
+	OrgRegister               bool
 }
 
 func (l *Login) handleRegister(w http.ResponseWriter, r *http.Request) {
@@ -96,11 +97,12 @@ func (l *Login) renderRegister(w http.ResponseWriter, r *http.Request, authReque
 	if err != nil {
 		errID, errMessage = l.getErrorMessage(r, err)
 	}
+	translator := l.getTranslator(authRequest)
 	if formData == nil {
 		formData = new(registerFormData)
 	}
 	if formData.Language == "" {
-		formData.Language = l.renderer.Lang(r).String()
+		formData.Language = l.renderer.ReqLang(translator, r).String()
 	}
 	data := registerData{
 		baseData:         l.getBaseData(r, authRequest, "Register", errID, errMessage),
@@ -118,7 +120,7 @@ func (l *Login) renderRegister(w http.ResponseWriter, r *http.Request, authReque
 		resourceOwner = iam.GlobalOrgID
 	}
 
-	pwPolicy, description, _ := l.getPasswordComplexityPolicy(r, resourceOwner)
+	pwPolicy, description, _ := l.getPasswordComplexityPolicy(r, authRequest, resourceOwner)
 	if pwPolicy != nil {
 		data.PasswordPolicyDescription = description
 		data.MinLength = pwPolicy.MinLength
@@ -142,6 +144,7 @@ func (l *Login) renderRegister(w http.ResponseWriter, r *http.Request, authReque
 		return
 	}
 	data.ShowUsername = orgIAMPolicy.UserLoginMustBeDomain
+	data.OrgRegister = orgIAMPolicy.UserLoginMustBeDomain
 
 	funcs := map[string]interface{}{
 		"selectedLanguage": func(l string) bool {
@@ -157,7 +160,7 @@ func (l *Login) renderRegister(w http.ResponseWriter, r *http.Request, authReque
 			return formData.Gender == g
 		},
 	}
-	l.renderer.RenderTemplate(w, r, l.renderer.Templates[tmplRegister], data, funcs)
+	l.renderer.RenderTemplate(w, r, translator, l.renderer.Templates[tmplRegister], data, funcs)
 }
 
 func (d registerFormData) toHumanDomain() *domain.Human {

internal/ui/login/handler/register_option_handler.go

@@ -40,7 +40,8 @@ func (l *Login) renderRegisterOption(w http.ResponseWriter, r *http.Request, aut
 			return authReq.LoginPolicy.AllowExternalIDP && authReq.AllowedExternalIDPs != nil && len(authReq.AllowedExternalIDPs) > 0
 		},
 	}
-	l.renderer.RenderTemplate(w, r, l.renderer.Templates[tmplRegisterOption], data, funcs)
+	translator := l.getTranslator(authReq)
+	l.renderer.RenderTemplate(w, r, translator, l.renderer.Templates[tmplRegisterOption], data, funcs)
 }
 
 func (l *Login) handleRegisterOptionCheck(w http.ResponseWriter, r *http.Request) {

internal/ui/login/handler/register_org_handler.go

@@ -85,12 +85,11 @@ func (l *Login) renderRegisterOrg(w http.ResponseWriter, r *http.Request, authRe
 	if formData == nil {
 		formData = new(registerOrgFormData)
 	}
-
 	data := registerOrgData{
 		baseData:            l.getBaseData(r, authRequest, "Register", errID, errMessage),
 		registerOrgFormData: *formData,
 	}
-	pwPolicy, description, _ := l.getPasswordComplexityPolicy(r, "0")
+	pwPolicy, description, _ := l.getPasswordComplexityPolicy(r, authRequest, "0")
 	if pwPolicy != nil {
 		data.PasswordPolicyDescription = description
 		data.MinLength = pwPolicy.MinLength
@@ -113,7 +112,8 @@ func (l *Login) renderRegisterOrg(w http.ResponseWriter, r *http.Request, authRe
 		data.IamDomain = orgPolicy.IAMDomain
 	}
 
-	l.renderer.RenderTemplate(w, r, l.renderer.Templates[tmplRegisterOrg], data, nil)
+	translator := l.getTranslator(authRequest)
+	l.renderer.RenderTemplate(w, r, translator, l.renderer.Templates[tmplRegisterOrg], data, nil)
 }
 
 func (d registerOrgFormData) toUserDomain() *domain.Human {

internal/ui/login/handler/renderer.go

@@ -284,7 +284,7 @@ func (l *Login) renderInternalError(w http.ResponseWriter, r *http.Request, auth
 		msg = err.Error()
 	}
 	data := l.getBaseData(r, authReq, "Error", "Internal", msg)
-	l.renderer.RenderTemplate(w, r, l.renderer.Templates[tmplError], data, nil)
+	l.renderer.RenderTemplate(w, r, l.getTranslator(authReq), l.renderer.Templates[tmplError], data, nil)
 }
 
 func (l *Login) getUserData(r *http.Request, authReq *domain.AuthRequest, title string, errType, errMessage string) userData {
@@ -304,7 +304,7 @@ func (l *Login) getBaseData(r *http.Request, authReq *domain.AuthRequest, title
 			ErrID:      errType,
 			ErrMessage: errMessage,
 		},
-		Lang:                   l.renderer.Lang(r).String(),
+		Lang:                   l.renderer.ReqLang(l.getTranslator(authReq), r).String(),
 		Title:                  title,
 		Theme:                  l.getTheme(r),
 		ThemeMode:              l.getThemeMode(r),
@@ -338,6 +338,15 @@ func (l *Login) getBaseData(r *http.Request, authReq *domain.AuthRequest, title
 	return baseData
 }
 
+func (l *Login) getTranslator(authReq *domain.AuthRequest) *i18n.Translator {
+	translator, _ := l.renderer.NewTranslator()
+	if authReq != nil {
+		l.addLoginTranslations(translator, authReq.DefaultTranslations)
+		l.addLoginTranslations(translator, authReq.OrgTranslations)
+	}
+	return translator
+}
+
 func (l *Login) getProfileData(authReq *domain.AuthRequest) profileData {
 	var userName, loginName, displayName, avatar string
 	if authReq != nil {
@@ -357,7 +366,7 @@ func (l *Login) getProfileData(authReq *domain.AuthRequest) profileData {
 func (l *Login) getErrorMessage(r *http.Request, err error) (errID, errMsg string) {
 	caosErr := new(caos_errs.CaosError)
 	if errors.As(err, &caosErr) {
-		localized := l.renderer.LocalizeFromRequest(r, caosErr.Message, nil)
+		localized := l.renderer.LocalizeFromRequest(l.getTranslator(nil), r, caosErr.Message, nil)
 		return caosErr.ID, localized
 
 	}
@@ -416,6 +425,18 @@ func (l *Login) isDisplayLoginNameSuffix(authReq *domain.AuthRequest) bool {
 	}
 	return authReq.LabelPolicy != nil && !authReq.LabelPolicy.HideLoginNameSuffix
 }
+
+func (l *Login) addLoginTranslations(translator *i18n.Translator, customTexts []*domain.CustomText) {
+	for _, text := range customTexts {
+		msg := i18n.Message{
+			ID:   text.Key,
+			Text: text.Text,
+		}
+		err := l.renderer.AddMessages(translator, text.Language, msg)
+		logging.Log("HANDLE-GD3g2").OnError(err).Warn("could no add message to translator")
+	}
+}
+
 func getRequestID(authReq *domain.AuthRequest, r *http.Request) string {
 	if authReq != nil {
 		return authReq.ID
@@ -455,6 +476,7 @@ type baseData struct {
 	LoginPolicy            *domain.LoginPolicy
 	IDPProviders           []*domain.IDPProvider
 	LabelPolicy            *domain.LabelPolicy
+	LoginTexts             []*domain.CustomLoginText
 }
 
 type errorData struct {

internal/ui/login/handler/select_user_handler.go

@@ -21,7 +21,8 @@ func (l *Login) renderUserSelection(w http.ResponseWriter, r *http.Request, auth
 		Users:    selectionData.Users,
 		Linking:  len(authReq.LinkingUsers) > 0,
 	}
-	l.renderer.RenderTemplate(w, r, l.renderer.Templates[tmplUserSelection], data, nil)
+	translator := l.getTranslator(authReq)
+	l.renderer.RenderTemplate(w, r, translator, l.renderer.Templates[tmplUserSelection], data, nil)
 }
 
 func (l *Login) handleSelectUser(w http.ResponseWriter, r *http.Request) {

internal/ui/login/handler/username_change_handler.go

@@ -20,7 +20,7 @@ func (l *Login) renderChangeUsername(w http.ResponseWriter, r *http.Request, aut
 		errID, errMessage = l.getErrorMessage(r, err)
 	}
 	data := l.getUserData(r, authReq, "Change Username", errID, errMessage)
-	l.renderer.RenderTemplate(w, r, l.renderer.Templates[tmplChangeUsername], data, nil)
+	l.renderer.RenderTemplate(w, r, l.getTranslator(authReq), l.renderer.Templates[tmplChangeUsername], data, nil)
 }
 
 func (l *Login) handleChangeUsername(w http.ResponseWriter, r *http.Request) {
@@ -41,5 +41,5 @@ func (l *Login) handleChangeUsername(w http.ResponseWriter, r *http.Request) {
 func (l *Login) renderChangeUsernameDone(w http.ResponseWriter, r *http.Request, authReq *domain.AuthRequest) {
 	var errType, errMessage string
 	data := l.getUserData(r, authReq, "Username Change Done", errType, errMessage)
-	l.renderer.RenderTemplate(w, r, l.renderer.Templates[tmplChangeUsernameDone], data, nil)
+	l.renderer.RenderTemplate(w, r, l.getTranslator(authReq), l.renderer.Templates[tmplChangeUsernameDone], data, nil)
 }