diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 7a3601b0e3b7dcc6881020733acfa8fa52ad594d..f9934458fa6c5cc4a686c4bf80221cf6a2ecd7b2 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -6,6 +6,9 @@ stages:
 
 before_script:
   - echo email.key=$PEPPER >> local.properties
+  - echo MURENA_CLIENT_ID=$MURENA_CLIENT_ID >> local.properties
+  - echo MURENA_CLIENT_SECRET=$MURENA_CLIENT_SECRET >> local.properties
+  - echo MURENA_REDIRECT_URI=$MURENA_REDIRECT_URI >> local.properties
   - echo GOOGLE_CLIENT_ID=$GOOGLE_CLIENT_ID >> local.properties
   - echo GOOGLE_REDIRECT_URI=$GOOGLE_REDIRECT_URI >> local.properties
   - echo YAHOO_CLIENT_ID=$YAHOO_CLIENT_ID >> local.properties
diff --git a/app/build.gradle b/app/build.gradle
index 1a900b11a777a22ae344e2c2b1f650205091ed9e..4912627102985803c08a9ac760944c70480789dd 100644
--- a/app/build.gradle
+++ b/app/build.gradle
@@ -108,6 +108,10 @@ android {
     }
 
     defaultConfig {
+        buildConfigField "String", "MURENA_CLIENT_ID", "\"${retrieveKey("MURENA_CLIENT_ID")}\""
+        buildConfigField "String", "MURENA_CLIENT_SECRET", "\"${retrieveKey("MURENA_CLIENT_SECRET")}\""
+        buildConfigField "String", "MURENA_REDIRECT_URI", "\"${retrieveKey("MURENA_REDIRECT_URI")}\""
+
         buildConfigField "String", "GOOGLE_CLIENT_ID", "\"${retrieveKey("GOOGLE_CLIENT_ID")}\""
         buildConfigField "String", "GOOGLE_REDIRECT_URI", "\"${retrieveKey("GOOGLE_REDIRECT_URI")}\""
 
@@ -115,7 +119,8 @@ android {
 
 	    manifestPlaceholders = [
                 'appAuthRedirectScheme':  applicationId,
-                "googleAuthRedirectScheme": retrieveKey("GOOGLE_REDIRECT_URI")
+                "googleAuthRedirectScheme": retrieveKey("GOOGLE_REDIRECT_URI"),
+                "murenaAuthRedirectScheme": retrieveKey("MURENA_REDIRECT_URI")
         ]
     }
 
@@ -186,7 +191,7 @@ dependencies {
     // own libraries
     implementation "com.github.bitfireAT:cert4android:${versions.cert4android}"
     implementation files('../libs/ical4android.aar')
-    implementation "com.github.bitfireAT:vcard4android:${versions.vcard4android}"
+    implementation "foundation.e.lib:vcard4android:${versions.vcard4android}"
 
     // third-party libs
     implementation 'org.mnode.ical4j:ical4j:3.2.11'
@@ -222,6 +227,10 @@ dependencies {
         exclude group: 'com.squareup.okhttp3'
     }
 
+    // ez-vcard to parse/generate vCards
+    api("com.googlecode.ez-vcard:ez-vcard:0.12.0")
+
+
     // for tests
     androidTestImplementation "com.google.dagger:hilt-android-testing:${versions.hilt}"
     kaptAndroidTest "com.google.dagger:hilt-android-compiler:${versions.hilt}"
diff --git a/app/src/androidTestOse/java/at/bitfire/davdroid/syncadapter/TestSyncManager.kt b/app/src/androidTestOse/java/at/bitfire/davdroid/syncadapter/TestSyncManager.kt
index 85b04d82d1f0e750da011bb7ec5bf8c3119c55cf..905e42744dabdc93dead79f743f7f1e48f1acd4b 100644
--- a/app/src/androidTestOse/java/at/bitfire/davdroid/syncadapter/TestSyncManager.kt
+++ b/app/src/androidTestOse/java/at/bitfire/davdroid/syncadapter/TestSyncManager.kt
@@ -35,7 +35,7 @@ class TestSyncManager(
 
     override fun prepare(): Boolean {
         collectionURL = mockWebServer.url("/")
-        davCollection = DavCollection(httpClient.okHttpClient, collectionURL, null)
+        davCollection = DavCollection(httpClient.okHttpClient, collectionURL)
         return true
     }
 
diff --git a/app/src/main/AndroidManifest.xml b/app/src/main/AndroidManifest.xml
index fd66593b2d4d009d1af3d7ecd79ddab4f8d08b82..e519e3144d45acf1145c263a19a3545a7a0a5f89 100644
--- a/app/src/main/AndroidManifest.xml
+++ b/app/src/main/AndroidManifest.xml
@@ -27,6 +27,8 @@
     <!-- android.permission-group.CALENDAR -->
     <uses-permission android:name="android.permission.READ_CALENDAR"/>
     <uses-permission android:name="android.permission.WRITE_CALENDAR"/>
+    <!-- android.permission.eDrive -->
+    <uses-permission android:name="foundation.e.permission.ADD_ACCOUNT"/>
 
     <!-- android.permission-group.LOCATION -->
     <!-- getting the WiFi name (for "sync in Wifi only") requires
@@ -675,6 +677,7 @@
 
                 <data android:scheme="${appAuthRedirectScheme}" />
                 <data android:scheme="${googleAuthRedirectScheme}" />
+                <data android:scheme="${murenaAuthRedirectScheme}" />
             </intent-filter>
 
         </activity>
diff --git a/app/src/main/java/at/bitfire/davdroid/authorization/IdentityProvider.java b/app/src/main/java/at/bitfire/davdroid/authorization/IdentityProvider.java
index 3e25ddd2de4e720f9e1ecc4607ac97dae78b5caf..c4bd3d78d1899f7994cb75079d3920b7e1228d55 100644
--- a/app/src/main/java/at/bitfire/davdroid/authorization/IdentityProvider.java
+++ b/app/src/main/java/at/bitfire/davdroid/authorization/IdentityProvider.java
@@ -33,6 +33,17 @@ import at.bitfire.davdroid.BuildConfig;
  */
 public class IdentityProvider {
 
+    public static final IdentityProvider MURENA = new IdentityProvider(
+            "https://accounts.eeo.one/auth/realms/eeo.one/.well-known/openid-configuration",
+            null,
+            null,
+            BuildConfig.MURENA_CLIENT_ID,
+            BuildConfig.MURENA_CLIENT_SECRET,
+            BuildConfig.MURENA_REDIRECT_URI + ":/redirect",
+            "openid address profile email phone roles offline_access web-origins microprofile-jwt",
+            null
+    );
+
     public static final IdentityProvider GOOGLE = new IdentityProvider(
             "https://accounts.google.com/.well-known/openid-configuration",
             null,
diff --git a/app/src/main/java/at/bitfire/davdroid/network/HttpClient.kt b/app/src/main/java/at/bitfire/davdroid/network/HttpClient.kt
index 4cd6b08e46b2c5b0e9872808a6868aa41cdd8b3f..9b85b6ab17f0ab142af36eb9fee8a078e57b502f 100644
--- a/app/src/main/java/at/bitfire/davdroid/network/HttpClient.kt
+++ b/app/src/main/java/at/bitfire/davdroid/network/HttpClient.kt
@@ -156,10 +156,9 @@ class HttpClient private constructor(
             }
 
             // use account settings for authentication and cookies
-            if (accountSettings != null)
-                addAuthentication(null, accountSettings.credentials(), authStateCallback = { authState: AuthState ->
-                    accountSettings.credentials(Credentials(authState = authState))
-                })
+            if (accountSettings != null) {
+                addAuthentication(accountSettings)
+            }
         }
 
         constructor(context: Context, host: String?, credentials: Credentials?) : this(context) {
@@ -167,6 +166,30 @@ class HttpClient private constructor(
                 addAuthentication(host, credentials)
         }
 
+        private fun addAuthentication(accountSettings: AccountSettings) {
+            val credential = accountSettings.credentials()
+
+            addAuthentication(
+                null,
+                credential,
+                authStateCallback = { authState: AuthState ->
+                    updateCredentials(accountSettings, authState, credential.clientSecret)
+                })
+        }
+
+        private fun updateCredentials(
+            accountSettings: AccountSettings,
+            authState: AuthState,
+            clientSecret: String?
+        ) {
+            accountSettings.credentials(
+                Credentials(
+                    authState = authState,
+                    clientSecret = clientSecret
+                )
+            )
+        }
+
         fun addAuthentication(host: String?, credentials: Credentials, insecurePreemptive: Boolean = false, authStateCallback: BearerAuthInterceptor.AuthStateUpdateCallback? = null): Builder {
             if (credentials.userName != null && credentials.password != null) {
                 val authHandler = BasicDigestAuthHandler(UrlUtils.hostToDomain(host), credentials.userName, credentials.password, insecurePreemptive)
diff --git a/app/src/main/java/at/bitfire/davdroid/resource/contactrow/GroupMembershipBuilder.kt b/app/src/main/java/at/bitfire/davdroid/resource/contactrow/GroupMembershipBuilder.kt
index 84426a0c0ce6d7c9f2bc95efde01eb1b5e359a4d..c87cdc4ea3bfa7018f0fe440dddf1e0210737eb6 100644
--- a/app/src/main/java/at/bitfire/davdroid/resource/contactrow/GroupMembershipBuilder.kt
+++ b/app/src/main/java/at/bitfire/davdroid/resource/contactrow/GroupMembershipBuilder.kt
@@ -7,6 +7,7 @@ package at.bitfire.davdroid.resource.contactrow
 import android.net.Uri
 import android.provider.ContactsContract.CommonDataKinds.GroupMembership
 import at.bitfire.davdroid.resource.LocalAddressBook
+import at.bitfire.davdroid.syncadapter.ContactsSyncManager.Companion.LABEL_STARRED
 import at.bitfire.vcard4android.BatchOperation
 import at.bitfire.vcard4android.Contact
 import at.bitfire.vcard4android.GroupMethod
@@ -20,8 +21,14 @@ class GroupMembershipBuilder(dataRowUri: Uri, rawContactId: Long?, contact: Cont
         val result = LinkedList<BatchOperation.CpoBuilder>()
 
         if (addressBook.groupMethod == GroupMethod.CATEGORIES)
-            for (category in contact.categories)
+            for (category in contact.categories) {
+
+                if (category == LABEL_STARRED) {
+                    continue
+                }
+
                 result += newDataRow().withValue(GroupMembership.GROUP_ROW_ID, addressBook.findOrCreateGroup(category))
+            }
         else {
             // GroupMethod.GROUP_VCARDS -> memberships are handled by LocalGroups (and not by the members = LocalContacts, which we are processing here)
             // TODO: CATEGORIES <-> unknown properties
diff --git a/app/src/main/java/at/bitfire/davdroid/syncadapter/AccountUtils.kt b/app/src/main/java/at/bitfire/davdroid/syncadapter/AccountUtils.kt
index cbe2ba8ebdf6e33c8cbb04fb4fbf510a8c15fb1d..22ebaf52938ff06cce0dba3b908f9d64fb0ceab6 100644
--- a/app/src/main/java/at/bitfire/davdroid/syncadapter/AccountUtils.kt
+++ b/app/src/main/java/at/bitfire/davdroid/syncadapter/AccountUtils.kt
@@ -111,6 +111,7 @@ object AccountUtils {
 
     fun getOpenIdMainAccountTypes(context: Context) =
         listOf(
+            context.getString(R.string.eelo_account_type),
             context.getString(R.string.google_account_type),
             context.getString(R.string.yahoo_account_type)
         )
diff --git a/app/src/main/java/at/bitfire/davdroid/syncadapter/ContactsSyncManager.kt b/app/src/main/java/at/bitfire/davdroid/syncadapter/ContactsSyncManager.kt
index e32d4708c5051b3f89d29b1e60ca6dd0378e3a79..2f96ff59ac6b8ef4d550334329c80e53d75913a6 100644
--- a/app/src/main/java/at/bitfire/davdroid/syncadapter/ContactsSyncManager.kt
+++ b/app/src/main/java/at/bitfire/davdroid/syncadapter/ContactsSyncManager.kt
@@ -91,6 +91,7 @@ class ContactsSyncManager(
 
     companion object {
         infix fun <T> Set<T>.disjunct(other: Set<T>) = (this - other) union (other - this)
+        const val LABEL_STARRED = "starred"
     }
 
     private val readOnly = localAddressBook.readOnly
@@ -230,6 +231,12 @@ class ContactsSyncManager(
                 else -> throw IllegalArgumentException("resource must be LocalContact or LocalGroup")
             }
 
+            if (contact.starred && !contact.categories.contains(LABEL_STARRED)) {
+                contact.categories.add(LABEL_STARRED)
+            } else {
+                contact.categories.remove(LABEL_STARRED)
+            }
+
             Logger.log.log(Level.FINE, "Preparing upload of vCard ${resource.fileName}", contact)
 
             val os = ByteArrayOutputStream()
diff --git a/app/src/main/java/at/bitfire/davdroid/syncadapter/DefaultAccountAuthenticatorService.kt b/app/src/main/java/at/bitfire/davdroid/syncadapter/DefaultAccountAuthenticatorService.kt
index e31e04345b60d1d6b58b4b57ba775bd5f1336115..cc19d2dfa086f3be63a4e23adfeb1f0cc8c893bd 100644
--- a/app/src/main/java/at/bitfire/davdroid/syncadapter/DefaultAccountAuthenticatorService.kt
+++ b/app/src/main/java/at/bitfire/davdroid/syncadapter/DefaultAccountAuthenticatorService.kt
@@ -143,6 +143,11 @@ abstract class DefaultAccountAuthenticatorService : Service(), OnAccountsUpdateL
                     LoginActivity.OPEN_APP_ACTIVITY_AFTER_AUTH,
                     it.getString(LoginActivity.OPEN_APP_ACTIVITY_AFTER_AUTH)
                 )
+
+                intent.putExtra(
+                    LoginActivity.USERNAME_HINT,
+                    it.getString(LoginActivity.USERNAME_HINT)
+                )
             }
 
             val bundle = Bundle(1)
@@ -210,6 +215,11 @@ abstract class DefaultAccountAuthenticatorService : Service(), OnAccountsUpdateL
                     AccountSettings.KEY_AUTH_STATE,
                     authState.jsonSerializeString()
                 )
+                accountManager.setUserData(
+                    account,
+                    AccountSettings.KEY_CLIENT_SECRET,
+                    clientSecretString
+                )
                 val result = Bundle()
                 result.putString(AccountManager.KEY_ACCOUNT_NAME, account!!.name)
                 result.putString(AccountManager.KEY_ACCOUNT_TYPE, account.type)
diff --git a/app/src/main/java/at/bitfire/davdroid/ui/setup/AccountDetailsFragment.kt b/app/src/main/java/at/bitfire/davdroid/ui/setup/AccountDetailsFragment.kt
index 747b0310c1b18d5f6712960cdbf20075450389a0..33f71923f3fa32f17fcc642b764f35ad375cc243 100644
--- a/app/src/main/java/at/bitfire/davdroid/ui/setup/AccountDetailsFragment.kt
+++ b/app/src/main/java/at/bitfire/davdroid/ui/setup/AccountDetailsFragment.kt
@@ -178,11 +178,7 @@ class AccountDetailsFragment : Fragment() {
                         }
 
                         if (requireActivity().intent.getStringExtra(LoginActivity.ACCOUNT_TYPE) == getString(R.string.eelo_account_type)) {
-                            val intent = Intent("drive.services.InitializerService")
-                            intent.setPackage(getString(R.string.e_drive_package_name))
-                            intent.putExtra(AccountManager.KEY_ACCOUNT_NAME, name)
-                            intent.putExtra(AccountManager.KEY_ACCOUNT_TYPE, getString(R.string.eelo_account_type))
-                            requireActivity().startService(intent)
+                            triggerFileSyncSetup(name)
                         }
 
                         handlePostAuthOperations()
@@ -194,6 +190,18 @@ class AccountDetailsFragment : Fragment() {
         return v.root
     }
 
+
+    private fun triggerFileSyncSetup(name: String) {
+        val intent = Intent("foundation.e.drive.action.ADD_ACCOUNT")
+        intent.addFlags(Intent.FLAG_INCLUDE_STOPPED_PACKAGES)
+        intent.component =
+            ComponentName(getString(R.string.e_drive_package_name), "foundation.e.drive.account.receivers.AccountAddedReceiver")
+        intent.putExtra(AccountManager.KEY_ACCOUNT_NAME, name)
+        intent.putExtra(AccountManager.KEY_ACCOUNT_TYPE, getString(R.string.eelo_account_type))
+        requireActivity().sendBroadcast(intent)
+    }
+
+
     private fun handlePostAuthOperations() {
         val packageToBeOpened = requireActivity().intent.getStringExtra(LoginActivity.OPEN_APP_PACKAGE_AFTER_AUTH)
         val activityToBeOpened = requireActivity().intent.getStringExtra(LoginActivity.OPEN_APP_ACTIVITY_AFTER_AUTH)
@@ -279,14 +287,8 @@ class AccountDetailsFragment : Fragment() {
                 val accountManager = AccountManager.get(context)
 
                 if (!AccountUtils.createAccount(context, account, userData, credentials?.password)) {
-                    if (accountType in AccountUtils.getOpenIdMainAccountTypes(context)) {
-                        for (openIdAccount in AccountUtils.getOpenIdMainAccounts(context)) {
-                            if (userData.get(AccountSettings.KEY_EMAIL_ADDRESS) == accountManager
-                                    .getUserData(account, AccountSettings.KEY_EMAIL_ADDRESS)) {
-                                accountManager.setUserData(openIdAccount, AccountSettings.KEY_AUTH_STATE,
-                                    userData.getString(AccountSettings.KEY_AUTH_STATE))
-                            }
-                        }
+                    if (accountType in AccountUtils.getOpenIdMainAccountTypes(context) && credentials?.authState != null) {
+                        updateAuthState(userData, accountManager, account)
                     } else {
                         result.postValue(false)
                         return@launch
@@ -383,6 +385,27 @@ class AccountDetailsFragment : Fragment() {
             return result
         }
 
+        private fun updateAuthState(
+            userData: Bundle,
+            accountManager: AccountManager,
+            account: Account
+        ) {
+            for (openIdAccount in AccountUtils.getOpenIdMainAccounts(context)) {
+                if (userData.get(AccountSettings.KEY_EMAIL_ADDRESS) == accountManager
+                        .getUserData(account, AccountSettings.KEY_EMAIL_ADDRESS)
+                ) {
+                    accountManager.setUserData(
+                        openIdAccount, AccountSettings.KEY_AUTH_STATE,
+                        userData.getString(AccountSettings.KEY_AUTH_STATE)
+                    )
+                    accountManager.setUserData(
+                        openIdAccount, AccountSettings.KEY_CLIENT_SECRET,
+                        userData.getString(AccountSettings.KEY_CLIENT_SECRET)
+                    )
+                }
+            }
+        }
+
         private fun insertService(
             accountName: String,
             authState: String?,
diff --git a/app/src/main/java/at/bitfire/davdroid/ui/setup/DetectConfigurationFragment.kt b/app/src/main/java/at/bitfire/davdroid/ui/setup/DetectConfigurationFragment.kt
index c5286e67cfc56dc6eb0db624c273feb5e0df0bf4..92114462c591cc8ef88f598159f127d8a15182a7 100644
--- a/app/src/main/java/at/bitfire/davdroid/ui/setup/DetectConfigurationFragment.kt
+++ b/app/src/main/java/at/bitfire/davdroid/ui/setup/DetectConfigurationFragment.kt
@@ -47,11 +47,11 @@ class DetectConfigurationFragment: Fragment() {
             return
         }
 
-        val isMurenaAccountType = (accountType == getString(R.string.eelo_account_type))
+        val blockOnUnauthorizedException = (accountType == getString(R.string.eelo_account_type)) && !EeloAuthenticatorModel.enableOpenIdSupport
 
         val baseURI = loginModel.baseURI ?: return
 
-        model.detectConfiguration(baseURI, loginModel.credentials, loginModel.cardDavURI, isMurenaAccountType).observe(this) { result ->
+        model.detectConfiguration(baseURI, loginModel.credentials, loginModel.cardDavURI, blockOnUnauthorizedException).observe(this) { result ->
             // save result for next step
             loginModel.configuration = result
 
@@ -97,7 +97,7 @@ class DetectConfigurationFragment: Fragment() {
 
         }
 
-        fun detectConfiguration(baseURI: URI, credentials: Credentials?, cardDavURI: URI?, blockOnUnauthorizedException: Boolean): LiveData<DavResourceFinder.Configuration> {
+        fun detectConfiguration(baseURI: URI, credentials: Credentials?, cardDavURI: URI?, blockOnUnauthorizedException: Boolean = false): LiveData<DavResourceFinder.Configuration> {
             synchronized(result) {
                 if (detectionThread != null)
                     // detection already running
diff --git a/app/src/main/java/at/bitfire/davdroid/ui/setup/EeloAuthenticatorFragment.kt b/app/src/main/java/at/bitfire/davdroid/ui/setup/EeloAuthenticatorFragment.kt
index 50061c91beeb83e72fd7a2a373ae35eb55ec7c91..77b0252c74c3991a0685e53b924bf7db4da990a0 100644
--- a/app/src/main/java/at/bitfire/davdroid/ui/setup/EeloAuthenticatorFragment.kt
+++ b/app/src/main/java/at/bitfire/davdroid/ui/setup/EeloAuthenticatorFragment.kt
@@ -27,6 +27,7 @@ import android.view.ViewGroup
 import android.widget.Button
 import android.widget.Toast
 import androidx.core.content.ContextCompat
+import androidx.core.view.isVisible
 import androidx.core.widget.doOnTextChanged
 import androidx.fragment.app.Fragment
 import androidx.fragment.app.activityViewModels
@@ -55,6 +56,7 @@ class EeloAuthenticatorFragment : Fragment() {
     private lateinit var serverUrlEditTextLayout: TextInputLayout
     private lateinit var serverUrlEditText: TextInputEditText
     private lateinit var passwordEditText: TextInputEditText
+    private lateinit var passwordHolder: View
 
     private fun isNetworkAvailable(): Boolean {
         val connectivityManager = requireActivity().getSystemService(Context.CONNECTIVITY_SERVICE) as ConnectivityManager
@@ -64,11 +66,7 @@ class EeloAuthenticatorFragment : Fragment() {
 
     override fun onCreateView(inflater: LayoutInflater, container: ViewGroup?,
                               savedInstanceState: Bundle?): View {
-
-        if (!isNetworkAvailable()) {
-            Toast.makeText(context, "Please check your internet connection", Toast.LENGTH_LONG).show()
-            requireActivity().finish()
-        }
+        handleNoNetworkAvailable()
 
         val v = FragmentEeloAuthenticatorBinding.inflate(inflater, container, false)
         v.lifecycleOwner = this
@@ -79,12 +77,17 @@ class EeloAuthenticatorFragment : Fragment() {
         serverUrlEditTextLayout = v.root.findViewById(R.id.urlpwd_server_uri_layout)
         serverUrlEditText = v.root.findViewById(R.id.urlpwd_server_uri)
         passwordEditText = v.root.findViewById(R.id.urlpwd_password)
+        passwordHolder = v.root.findViewById(R.id.password_holder)
+
+        passwordHolder.isVisible = !EeloAuthenticatorModel.enableOpenIdSupport
 
         serverToggleButton.setOnClickListener { expandCollapse() }
 
         v.root.findViewById<View>(R.id.sign_in).setOnClickListener { login() }
 
-        v.root.findViewById<View>(R.id.twofa_info_button).setOnClickListener { show2FAInfoDialog() }
+        val tfaButton = v.root.findViewById<View>(R.id.twofa_info_button)
+        tfaButton.setOnClickListener { show2FAInfoDialog() }
+        tfaButton.isVisible = !EeloAuthenticatorModel.enableOpenIdSupport
 
         userIdEditText.doOnTextChanged { text, _, _, _ ->
             val domain = computeDomain(text)
@@ -190,24 +193,40 @@ class EeloAuthenticatorFragment : Fragment() {
         return domain
     }
 
-    private fun login() {
-        if (!isNetworkAvailable()) {
-            Toast.makeText(context, "Please check your internet connection", Toast.LENGTH_LONG).show()
-            requireActivity().finish()
+    private fun handleNoNetworkAvailable() {
+        if (isNetworkAvailable()) {
+            return
         }
 
-        if ((userIdEditText.text.toString() != "") && (passwordEditText.text.toString() != "")) {
-            if (validate())
-                parentFragmentManager.beginTransaction()
-                    .replace(android.R.id.content, DetectConfigurationFragment(), null)
-                    .addToBackStack(null)
-                    .commit()
+        Toast.makeText(context, R.string.no_internet_toast, Toast.LENGTH_LONG).show()
+        requireActivity().finish()
+    }
+
+    private fun login() {
+        handleNoNetworkAvailable()
+
+        val handleOpenIdAuth = EeloAuthenticatorModel.enableOpenIdSupport && !toggleButtonState
+        val userId = userIdEditText.text.toString()
+        val password = passwordEditText.text.toString()
+
+        if (handleOpenIdAuth && userId.isNotBlank()) {
+            requireActivity().intent.putExtra(LoginActivity.USERNAME_HINT, userIdEditText.text.toString())
+            navigate(MurenaOpenIdAuthFragment())
+        } else if (userId.isNotBlank() && password.isNotBlank() && validate()) {
+            navigate(DetectConfigurationFragment())
         } else {
-            Toast.makeText(context, "Please enter a valid username and password", Toast.LENGTH_LONG).show()
+            Toast.makeText(context, R.string.invalid_credentials, Toast.LENGTH_LONG).show()
         }
 
     }
 
+    private fun navigate(fragment: Fragment) {
+        parentFragmentManager.beginTransaction()
+            .replace(android.R.id.content, fragment, null)
+            .addToBackStack(null)
+            .commit()
+    }
+
     // if user wants to login with murena account, add support to automated retry
     // if user in any case provide wrong accountId as email (ex: abc@murena.io instead of abc@e.email)
     private fun addSupportRetryOn401IfPossible(serverUrl: String) {
@@ -279,11 +298,20 @@ class EeloAuthenticatorFragment : Fragment() {
             serverUrlEditTextLayout.visibility = View.VISIBLE
             serverUrlEditText.isEnabled = true
             toggleButtonState = true
+
+            passwordHolder.visibility = View.VISIBLE
         } else {
             serverToggleButton.setCompoundDrawablesWithIntrinsicBounds(null, null , ContextCompat.getDrawable(requireContext(), R.drawable.ic_expand_more), null)
             serverUrlEditTextLayout.visibility = View.GONE
             serverUrlEditText.isEnabled = false
             toggleButtonState = false
+
+            if(!EeloAuthenticatorModel.enableOpenIdSupport) {
+                return
+            }
+
+            passwordHolder.visibility = View.GONE
+            passwordEditText.text?.clear()
         }
     }
 
diff --git a/app/src/main/java/at/bitfire/davdroid/ui/setup/EeloAuthenticatorModel.kt b/app/src/main/java/at/bitfire/davdroid/ui/setup/EeloAuthenticatorModel.kt
index ce607af20cf88c454b59cc16796c6541ecf9967c..c65296df1a15c71d505ded1a55fa11ec712ec70f 100644
--- a/app/src/main/java/at/bitfire/davdroid/ui/setup/EeloAuthenticatorModel.kt
+++ b/app/src/main/java/at/bitfire/davdroid/ui/setup/EeloAuthenticatorModel.kt
@@ -24,24 +24,25 @@ import at.bitfire.davdroid.ECloudAccountHelper
 
 class EeloAuthenticatorModel(application: Application) : AndroidViewModel(application) {
 
+    companion object {
+        // as https://gitlab.e.foundation/e/backlog/-/issues/6287 is blocked, the openId implementation is not ready yet.
+        // But we want to push the changes so later we won't face any conflict. So we are disabling the openId feature for now.
+        const val enableOpenIdSupport = false
+    }
+
     private var initialized = false
 
+
     val loginWithUrlAndTokens = MutableLiveData<Boolean>()
 
     val baseUrl = MutableLiveData<String>()
     val baseUrlError = MutableLiveData<String>()
 
-    val emailAddress = MutableLiveData<String>()
-    val emailAddressError = MutableLiveData<String>()
-
     val username = MutableLiveData<String>()
-    val usernameError = MutableLiveData<String>()
 
     val password = MutableLiveData<String>()
-    val passwordError = MutableLiveData<String>()
 
     val certificateAlias = MutableLiveData<String>()
-    val certificateAliasError = MutableLiveData<String>()
 
     init {
         loginWithUrlAndTokens.value = true
@@ -53,7 +54,6 @@ class EeloAuthenticatorModel(application: Application) : AndroidViewModel(applic
 
         // we've got initial login data
         val givenUrl = intent.getStringExtra(LoginActivity.EXTRA_URL)
-        val givenUsername = intent.getStringExtra(LoginActivity.EXTRA_USERNAME)
         val givenPassword = intent.getStringExtra(LoginActivity.EXTRA_PASSWORD)
 
         baseUrl.value = givenUrl
diff --git a/app/src/main/java/at/bitfire/davdroid/ui/setup/LoginActivity.kt b/app/src/main/java/at/bitfire/davdroid/ui/setup/LoginActivity.kt
index 8bbd99bf090d8cf7322c1a5dad908bb65b8cd561..df981373c778b678a3590d15218754be983a0313 100644
--- a/app/src/main/java/at/bitfire/davdroid/ui/setup/LoginActivity.kt
+++ b/app/src/main/java/at/bitfire/davdroid/ui/setup/LoginActivity.kt
@@ -38,6 +38,8 @@ class LoginActivity: AppCompatActivity() {
          */
         const val EXTRA_PASSWORD = "password"
 
+        const val USERNAME_HINT = "userNameHint"
+
         const val AUTH_STATE = "authState"
         const val ACCOUNT_TYPE = "account_type"
         const val OPENID_AUTH_FLOW_COMPLETE = "openId_authFlow_complete"
diff --git a/app/src/main/java/at/bitfire/davdroid/ui/setup/MurenaLoginFragmentFactory.kt b/app/src/main/java/at/bitfire/davdroid/ui/setup/MurenaLoginFragmentFactory.kt
index 3a2462e932083d00fea25a2691a59dc26bc8cd8d..4bb15ba6f81fb8ef3432c0ede540840abd66012e 100644
--- a/app/src/main/java/at/bitfire/davdroid/ui/setup/MurenaLoginFragmentFactory.kt
+++ b/app/src/main/java/at/bitfire/davdroid/ui/setup/MurenaLoginFragmentFactory.kt
@@ -35,12 +35,21 @@ class MurenaLoginFragmentFactory @Inject constructor(@ApplicationContext val con
         val accountType = intent.getStringExtra(LoginActivity.ACCOUNT_TYPE) ?: return null
 
         return when (accountType) {
-            context.getString(R.string.eelo_account_type) -> EeloAuthenticatorFragment()
+            context.getString(R.string.eelo_account_type) -> getMurenaFragment(intent)
             context.getString(R.string.google_account_type) -> GoogleAuthFragment()
             context.getString(R.string.yahoo_account_type) -> YahooAuthFragment()
             else -> null
         }
     }
+
+    private fun getMurenaFragment(intent: Intent): Fragment {
+        val isAuthFlowComplete = intent.getBooleanExtra(LoginActivity.OPENID_AUTH_FLOW_COMPLETE, false)
+
+        return when (isAuthFlowComplete) {
+            true -> MurenaOpenIdAuthFragment()
+            else -> EeloAuthenticatorFragment()
+        }
+    }
 }
 
 @Module
diff --git a/app/src/main/java/at/bitfire/davdroid/ui/setup/MurenaOpenIdAuthFragment.kt b/app/src/main/java/at/bitfire/davdroid/ui/setup/MurenaOpenIdAuthFragment.kt
new file mode 100644
index 0000000000000000000000000000000000000000..8a5636accfa099f12f1f09e08f94ddfe05d34c00
--- /dev/null
+++ b/app/src/main/java/at/bitfire/davdroid/ui/setup/MurenaOpenIdAuthFragment.kt
@@ -0,0 +1,54 @@
+/*
+ * Copyright MURENA SAS 2023
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ *  along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+package at.bitfire.davdroid.ui.setup
+
+import android.os.Bundle
+import android.view.View
+import at.bitfire.davdroid.ECloudAccountHelper
+import at.bitfire.davdroid.authorization.IdentityProvider
+import org.json.JSONObject
+
+class MurenaOpenIdAuthFragment : OpenIdAuthenticationBaseFragment(IdentityProvider.MURENA) {
+
+    override fun onViewCreated(view: View, savedInstanceState: Bundle?) {
+        super.onViewCreated(view, savedInstanceState)
+
+        if (!isAuthFlowComplete() && ECloudAccountHelper.alreadyHasECloudAccount(requireContext())) {
+            ECloudAccountHelper.showMultipleECloudAccountNotAcceptedDialog(requireActivity())
+            return
+        }
+
+        startAuthFLow()
+    }
+
+    override fun onAuthenticationComplete(userData: JSONObject) {
+        val userNameKey = "username"
+
+        if (!userData.has(userNameKey)) {
+            handleLoginFailedToast()
+            return
+        }
+
+        val userName = userData.getString(userNameKey)
+        if (userName.isBlank()) {
+            handleLoginFailedToast()
+            return
+        }
+
+        proceedNext(userName, "https://murena.io/remote.php/dav/files/$userName")
+    }
+}
diff --git a/app/src/main/java/at/bitfire/davdroid/ui/setup/OpenIdAuthenticationViewModel.kt b/app/src/main/java/at/bitfire/davdroid/ui/setup/OpenIdAuthenticationViewModel.kt
index b5c23d460068d4dc97449455adefe283f26a2204..175872dc535f3ca318c76db71bfc31a20cc6ccd3 100644
--- a/app/src/main/java/at/bitfire/davdroid/ui/setup/OpenIdAuthenticationViewModel.kt
+++ b/app/src/main/java/at/bitfire/davdroid/ui/setup/OpenIdAuthenticationViewModel.kt
@@ -25,6 +25,7 @@ import androidx.lifecycle.AndroidViewModel
 import at.bitfire.davdroid.OpenIdUtils
 import at.bitfire.davdroid.authorization.IdentityProvider
 import at.bitfire.davdroid.log.Logger
+import net.openid.appauth.AppAuthConfiguration
 import net.openid.appauth.AuthState
 import net.openid.appauth.AuthState.AuthStateAction
 import net.openid.appauth.AuthorizationException
@@ -46,10 +47,20 @@ import java.util.logging.Level
 
 class OpenIdAuthenticationViewModel(application: Application) : AndroidViewModel(application) {
 
-    private val authorizationService: AuthorizationService = AuthorizationService(getApplication())
+    private val authorizationService: AuthorizationService
     private var authState: AuthState? = null
     var identityProvider: IdentityProvider? = null
 
+    init {
+        val appAuthConfig = AppAuthConfiguration.Builder()
+            .setBrowserMatcher {
+                it.useCustomTab
+            }
+            .build()
+
+        authorizationService = AuthorizationService(getApplication(), appAuthConfig)
+    }
+
     override fun onCleared() {
         authorizationService.dispose()
         super.onCleared()
@@ -65,7 +76,8 @@ class OpenIdAuthenticationViewModel(application: Application) : AndroidViewModel
         }
 
         val authStateString =
-            intent.getStringExtra(LoginActivity.AUTH_STATE) ?: return OpenIdAuthStateSetupState.SET_UP_FAILED
+            intent.getStringExtra(LoginActivity.AUTH_STATE)
+                ?: return OpenIdAuthStateSetupState.SET_UP_FAILED
 
         authState = AuthState.jsonDeserialize(authStateString)
 
@@ -76,15 +88,22 @@ class OpenIdAuthenticationViewModel(application: Application) : AndroidViewModel
         return OpenIdAuthStateSetupState.SET_UP_SUCCEED
     }
 
-    fun requestAuthCode(serviceConfiguration: AuthorizationServiceConfiguration, intent: Intent) {
+    fun requestAuthCode(
+        serviceConfiguration: AuthorizationServiceConfiguration,
+        intent: Intent
+    ) {
         authState = AuthState(serviceConfiguration)
 
+        val loginHint = intent.getStringExtra(LoginActivity.USERNAME_HINT)
+
         val authRequest = AuthorizationRequest.Builder(
             serviceConfiguration,
             identityProvider!!.clientId,
             ResponseTypeValues.CODE,
             identityProvider!!.redirectUri
-        ).setScope(identityProvider!!.scope)
+        )
+            .setScope(identityProvider!!.scope)
+            .setLoginHint(sanitizeHint(loginHint))
             .build()
 
         authorizationService.performAuthorizationRequest(
@@ -94,6 +113,10 @@ class OpenIdAuthenticationViewModel(application: Application) : AndroidViewModel
         )
     }
 
+    private fun sanitizeHint(hint: String?): String? {
+        return if (hint.isNullOrBlank()) null else hint
+    }
+
     private fun createPostAuthorizationIntent(
         request: AuthorizationRequest,
         providedIntent: Intent
diff --git a/app/src/main/res/layout/fragment_eelo_authenticator.xml b/app/src/main/res/layout/fragment_eelo_authenticator.xml
index 0321f345d07c5c0ffcf01c8e65edae8667a11b0a..58d9cec2be88c8c3dee7b12043dee6b0c450a0c6 100644
--- a/app/src/main/res/layout/fragment_eelo_authenticator.xml
+++ b/app/src/main/res/layout/fragment_eelo_authenticator.xml
@@ -82,6 +82,7 @@
                 </com.google.android.material.textfield.TextInputLayout>
 
                 <com.google.android.material.textfield.TextInputLayout
+                    android:id="@+id/password_holder"
                     style="@style/edittext_holder_style"
                     android:layout_width="match_parent"
                     android:layout_height="wrap_content"
@@ -91,6 +92,7 @@
                     app:hintTextColor="@color/edittext"
                     app:boxStrokeColor="@color/edittext"
                     android:theme="@style/edittext_holder_theme"
+                    android:visibility="gone"
                     app:passwordToggleEnabled="true">
 
                     <com.google.android.material.textfield.TextInputEditText
@@ -165,6 +167,7 @@
                     android:drawableRight="@drawable/ic_info"
                     android:drawableTint="@color/button_text"
                     android:drawablePadding="7dp"
+                    android:visibility="gone"
                     android:layout_gravity="center"/>
             </LinearLayout>
         </ScrollView>
diff --git a/app/src/main/res/values-is/strings.xml b/app/src/main/res/values-is/strings.xml
index 2ca342a4094196971f7ead0976aa1527c5e4cdf6..2f1dbebd4467bf56fc5cf49004e407001a3e83f4 100644
--- a/app/src/main/res/values-is/strings.xml
+++ b/app/src/main/res/values-is/strings.xml
@@ -427,4 +427,40 @@
     <string name="intro_autostart_text">Þetta tæki lokar líklega á samstillingu. Ef þú verður var/vör við slíkt, geturðu einungis leyst það handvirkt.</string>
     <string name="yahoo_alert_message">Murena mun tilkynna falsaða gerð tækis til Yahoo til að vernda persónuupplýsingar þínar.
 \nÞú getur skoðað hvað það sé á síðunni Device Activity hjá Yahoo eftir að þú skráir þig inn.</string>
+    <string name="settings_username_key">notandanafn</string>
+    <string name="no_internet_sync_scheduled">Engin internettenging, áætla samstillingu</string>
+    <string name="account_synchronize_collections">Samstilla söfn</string>
+    <string name="account_rename_exists_already">Þetta nafn aðgangs er frátekið</string>
+    <string name="login_type_google">Google Tengiliðir / Dagatal</string>
+    <string name="login_google_account">Google-reikningur</string>
+    <string name="login_google">Skrá inn með Google</string>
+    <string name="login_oauth_couldnt_obtain_auth_code">Gat ekki náð í auðkenningarkóða</string>
+    <string name="settings_oauth">Endur-auðkenna</string>
+    <string name="settings_oauth_summary">Framkvæma OAuth-innskráningu aftur</string>
+    <string name="collection_properties_sync_time">Síðast samstillt:</string>
+    <string name="collection_properties_sync_time_never">Aldrei samstillt</string>
+    <string name="sync_error_retry_limit_reached">Væg villa (hámarksfjölda tilrauna náð)</string>
+    <string name="wifi_permissions_background_location_disclaimer">%s notar heimild fyrir aðgang að staðsetningu aðeins til að ákvarða SSID-auðkenni fyrirliggjandi WiFi-nets fyrir aðganga með takmörkuðu SSID. Þetta mun gerast jafnvel þótt forritið sé keyrandi í bakgrunni. Engum staðsetningargögnum er safnað, þau geymd, unnin eða send neitt.</string>
+    <string name="account_rename_new_name">Óvistuð gögn á tækinu gætu verið sniðgengin. Nauðsynlegt er að endur-samstilla eftir endurnefningu. Heiti nýja aðgangsins:</string>
+    <string name="login_account_name_info">Notaðu tölvupóstfangið þitt sem nafn á aðganginn því Android mun nota heiti aðgangsins í SKIPULEGGJANDI-reitinn fyrir atburði sem þú útbýrð. Þú getur ekki verið með tvo aðganga með sama nafni.</string>
+    <string name="instructions"><b>1 - </b>Næst, í öðru tæki eða tölvu, skaltu opna boðspóstinn og ljúka við að útbúa aðganginn.
+\n
+\n<b>2 - </b>TSíðan ættirðu koma til baka á þennan skjá og skrá þig inn á glænýja murena.io aðganginn þinn.
+\n
+\n<b>Athugaðu:</b><font color="#61000000"> Þú getur sleppt þessu skrefi og bætt við aðgangnum þínum síðar í stillingunum.</font></string>
+    <string name="send_invite_heading">Settu inn tölvupóstfangið þitt til að fá boð um að fá ókeypis murena.io auðkenni, með þínu eigin tölvupóstfangi og einkasvæði á tölvuskýi.</string>
+    <string name="error_dialog_message">Boðið var ekki hægt að senda á tölvupóstfangið þitt vegna vandamála í netkerfi.
+\n
+\nPrófaðu aftur síðar.
+\n
+\nAthugaðu: þú getur líka sleppt þessu ferli og bætt við aðgangi síðar í stillingunum. Ef þú lendir í vandræðum ættirðu að hafa samband við aðstoðarteymið.</string>
+    <string name="wifi_permissions_intro">Í stillingum þínum í Aðgangastýringunni hefurðu tekið fram að samstilling geti aðeins farið fram þegar tengst er tilteknu þráðlausu WiFi-neti (WiFi SSID takmörkun). Til að þessi stilling geti virkað, þarf forritið að fá aðgang að fyrirliggjandi WiFi-nafni (SSID), sem krefst þess að allar heimildir hér fyrir neðan séu veittar:</string>
+    <string name="settings_default_alarm_message">Ef útbúa á sjálfgefnar áminningar fyrir atburði án áminningar: hér er ákveðinn fjöldi mínútna áður en atburður á sér stað. Hafðu þetta autt til að gera sjálfgefnar áminningar óvirkar.</string>
+    <string name="login_google_client_id">Auðkenni forrits (valkvætt)</string>
+    <string name="login_google_see_tested_with">Skoðaðu \"Tested with Google\" síðuna okkar til að sjá uppfærðar upplýsingar.</string>
+    <string name="login_google_unexpected_warnings">Þú gætir fengið óvæntar aðvaranir og/eða þurft að búa til þitt eigið auðkenni forrits.</string>
+    <string name="login_google_client_privacy_policy">%1$s flytur gögn Google-tengiliða og dagatals einungis til samstillingar við þetta tæki. Skoðaðu &lt;a href=%2$s&gt;Meðferð persónuupplýsinga&lt;/a&gt; til að sjá nánari upplýsingar.</string>
+    <string name="debug_info_archive_text">Deildu safnskránni til að flytja hana yfir á tölvu, þar sem þú getur sent hana í tölvupósti eða hengt við beiðni um aðstoð.</string>
+    <string name="login_google_client_limited_use">%1$s er í samræmi við &lt;a href=%2$s&gt;stefnu Google varðandi notkun á API-kerfisviðmóti&lt;/a&gt; (Google API Services User Data Policy), þar með taldar kröfur sem tengjast takmarkaðri notkun (Limited Use).</string>
+    <string name="debug_info_attached">Aflúsunarupplýsingar eru hengdar við þessi skilaboð (krefst stuðnings við viðhengi í viðtökuforritinu).</string>
 </resources>
\ No newline at end of file
diff --git a/app/src/main/res/values-sv/strings.xml b/app/src/main/res/values-sv/strings.xml
index e163ab64dfe37687fae4e4a705471880a91860a5..e84f3f12e061ec35f77f78131de8fdffa304358c 100644
--- a/app/src/main/res/values-sv/strings.xml
+++ b/app/src/main/res/values-sv/strings.xml
@@ -490,4 +490,21 @@
     <string name="navigation_drawer_open_webcalmanager">Kalenderhanterare för webben</string>
     <string name="account_list_datasaver_enabled">Datasparare aktiverad. Bakgrundssynkronisering är begränsad.</string>
     <string name="account_rename_exists_already">Kontonamn är upptaget</string>
-</resources>
+    <string name="settings_oauth">Autentisera igen</string>
+    <string name="settings_username_key">användarnamn</string>
+    <string name="login_google_client_privacy_policy">%1$s överför din data för Google Kontakter och Kalender enbart för synkronisering med denna enheten. Läs våran &lt;a href=%2$s&gt;Integritetspolicy&lt;/a&gt; för mer information.</string>
+    <string name="settings_oauth_summary">Logga in med OAuth igen</string>
+    <string name="login_google_account">Google-konto</string>
+    <string name="login_oauth_couldnt_obtain_auth_code">Kunde inte upprätta kod för auktorisering</string>
+    <string name="login_google_unexpected_warnings">Det kan uppstå oväntade varningar och du kan behöva skapa ett eget klient-ID.</string>
+    <string name="collection_properties_sync_time_never">Aldrig synkroniserad</string>
+    <string name="login_google_see_tested_with">Se våran sida \"Testad med Google\" för uppdaterad information.</string>
+    <string name="login_type_google">Google Kontakter / Kalender</string>
+    <string name="account_synchronize_collections">Synkronisera samlingar</string>
+    <string name="login_google">Logga in med Google</string>
+    <string name="login_google_client_id">Klient-ID (valfri)</string>
+    <string name="collection_properties_sync_time">Senast synkroniserad:</string>
+    <string name="sync_error_retry_limit_reached">Mjukt fel (maximalt antal omförsök nåddes)</string>
+    <string name="login_google_client_limited_use">%1$s följer &lt;a href=%2$s&gt;Google API Services User Data Policy&lt;/a&gt;, inklusive Limited Use requirements.</string>
+    <string name="no_internet_sync_scheduled">Inget internet, schemalägger synkronisering</string>
+</resources>
\ No newline at end of file
diff --git a/app/src/main/res/values/strings.xml b/app/src/main/res/values/strings.xml
index 100c5ad075ae851dbb5b89cab4526cffb35f976b..45cbd6c6c8a19235257aafe8f08a3ef86ff6b63b 100644
--- a/app/src/main/res/values/strings.xml
+++ b/app/src/main/res/values/strings.xml
@@ -582,4 +582,5 @@
 
     <string name="login_failed">Login failed, please try again later</string>
     <string name="ok">OK</string>
+    <string name="invalid_credentials">Authentication failed. Please enter a valid credentials</string>
 </resources>
diff --git a/build.gradle b/build.gradle
index 610b83ab56f33cd96b7239c6ca9557b1dd53ee1a..d0efb0c1f6f35366e2a5b881cbd1e46729ffe71e 100644
--- a/build.gradle
+++ b/build.gradle
@@ -20,7 +20,7 @@ buildscript {
         cert4android: 'f167e84',
         dav4jvm: 'da94a8b',
         ical4android: 'a78e72f',
-        vcard4android: 'bd08206'
+        vcard4android: '1.1.1'
     ]
 
     repositories {