diff --git a/awx/ui/client/src/configuration/auth-form/configuration-auth.controller.js b/awx/ui/client/src/configuration/auth-form/configuration-auth.controller.js
index 451b195f36..8098172162 100644
--- a/awx/ui/client/src/configuration/auth-form/configuration-auth.controller.js
+++ b/awx/ui/client/src/configuration/auth-form/configuration-auth.controller.js
@@ -171,7 +171,9 @@ export default [
                 placeholder: ConfigurationUtils.formatPlaceholder($scope.$parent.configDataResolve[key].placeholder, key) || null,
                 dataTitle: $scope.$parent.configDataResolve[key].label,
                 required: $scope.$parent.configDataResolve[key].required,
-                ngDisabled: $rootScope.user_is_system_auditor
+                ngDisabled: $rootScope.user_is_system_auditor,
+                disabled: $scope.$parent.configDataResolve[key].disabled || null,
+                readonly: $scope.$parent.configDataResolve[key].readonly || null,
             });
         }
 
@@ -203,7 +205,8 @@ export default [
                                scope: $scope.$parent,
                                variable: field.name,
                                parse_variable: 'parseType',
-                               field_id: form.formDef.name + '_' + field.name
+                               field_id: form.formDef.name + '_' + field.name,
+                               readonly: true,
                              });
                         }
                     });
diff --git a/awx/ui/client/src/configuration/auth-form/sub-forms/auth-azure.form.js b/awx/ui/client/src/configuration/auth-form/sub-forms/auth-azure.form.js
index bb5bbef1a1..95caa48439 100644
--- a/awx/ui/client/src/configuration/auth-form/sub-forms/auth-azure.form.js
+++ b/awx/ui/client/src/configuration/auth-form/sub-forms/auth-azure.form.js
@@ -11,6 +11,10 @@
          showHeader: false,
 
          fields: {
+             SOCIAL_AUTH_AZUREAD_OAUTH2_CALLBACK_URL: {
+                 type: 'text',
+                 reset: 'SOCIAL_AUTH_AZUREAD_OAUTH2_CALLBACK_URL'
+             },
              SOCIAL_AUTH_AZUREAD_OAUTH2_KEY: {
                  type: 'text',
                  reset: 'SOCIAL_AUTH_AZUREAD_OAUTH2_KEY'
diff --git a/awx/ui/client/src/configuration/auth-form/sub-forms/auth-github-org.form.js b/awx/ui/client/src/configuration/auth-form/sub-forms/auth-github-org.form.js
index 9aecc2699f..5f29da4924 100644
--- a/awx/ui/client/src/configuration/auth-form/sub-forms/auth-github-org.form.js
+++ b/awx/ui/client/src/configuration/auth-form/sub-forms/auth-github-org.form.js
@@ -11,6 +11,10 @@ export default ['i18n', function(i18n) {
         showHeader: false,
 
         fields: {
+            SOCIAL_AUTH_GITHUB_ORG_CALLBACK_URL: {
+                type: 'text',
+                reset: 'SOCIAL_AUTH_GITHUB_TEAM_CALLBACK_URL'
+            },
             SOCIAL_AUTH_GITHUB_ORG_KEY: {
                 type: 'text',
                 reset: 'SOCIAL_AUTH_GITHUB_ORG_KEY'
@@ -23,6 +27,20 @@ export default ['i18n', function(i18n) {
             SOCIAL_AUTH_GITHUB_ORG_NAME: {
                 type: 'text',
                 reset: 'SOCIAL_AUTH_GITHUB_ORG_NAME'
+            },
+            SOCIAL_AUTH_GITHUB_ORG_ORGANIZATION_MAP: {
+                type: 'textarea',
+                reset: 'SOCIAL_AUTH_GITHUB_ORG_ORGANIZATION_MAP',
+                rows: 6,
+                codeMirror: true,
+                class: 'Form-textAreaLabel Form-formGroup--fullWidth'
+            },
+            SOCIAL_AUTH_GITHUB_ORG_TEAM_MAP: {
+                type: 'textarea',
+                reset: 'SOCIAL_AUTH_GITHUB_ORG_TEAM_MAP',
+                rows: 6,
+                codeMirror: true,
+                class: 'Form-textAreaLabel Form-formGroup--fullWidth'
             }
         },
 
diff --git a/awx/ui/client/src/configuration/auth-form/sub-forms/auth-github-team.form.js b/awx/ui/client/src/configuration/auth-form/sub-forms/auth-github-team.form.js
index 3747127132..959d4ae14d 100644
--- a/awx/ui/client/src/configuration/auth-form/sub-forms/auth-github-team.form.js
+++ b/awx/ui/client/src/configuration/auth-form/sub-forms/auth-github-team.form.js
@@ -11,6 +11,10 @@ export default ['i18n', function(i18n) {
         showHeader: false,
 
         fields: {
+            SOCIAL_AUTH_GITHUB_TEAM_CALLBACK_URL: {
+                type: 'text',
+                reset: 'SOCIAL_AUTH_GITHUB_TEAM_CALLBACK_URL'
+            },
             SOCIAL_AUTH_GITHUB_TEAM_KEY: {
                 type: 'text',
                 reset: 'SOCIAL_AUTH_GITHUB_TEAM_KEY'
@@ -23,6 +27,20 @@ export default ['i18n', function(i18n) {
             SOCIAL_AUTH_GITHUB_TEAM_ID: {
                 type: 'text',
                 reset: 'SOCIAL_AUTH_GITHUB_TEAM_ID'
+            },
+            SOCIAL_AUTH_GITHUB_TEAM_ORGANIZATION_MAP: {
+                type: 'textarea',
+                reset: 'SOCIAL_AUTH_GITHUB_TEAM_ORGANIZATION_MAP',
+                rows: 6,
+                codeMirror: true,
+                class: 'Form-textAreaLabel Form-formGroup--fullWidth'
+            },
+            SOCIAL_AUTH_GITHUB_TEAM_TEAM_MAP: {
+                type: 'textarea',
+                reset: 'SOCIAL_AUTH_GITHUB_TEAM_TEAM_MAP',
+                rows: 6,
+                codeMirror: true,
+                class: 'Form-textAreaLabel Form-formGroup--fullWidth'
             }
         },
 
diff --git a/awx/ui/client/src/configuration/auth-form/sub-forms/auth-github.form.js b/awx/ui/client/src/configuration/auth-form/sub-forms/auth-github.form.js
index f8af9ea74d..8b7b8dbc6a 100644
--- a/awx/ui/client/src/configuration/auth-form/sub-forms/auth-github.form.js
+++ b/awx/ui/client/src/configuration/auth-form/sub-forms/auth-github.form.js
@@ -11,6 +11,10 @@ export default ['i18n', function(i18n) {
         showHeader: false,
 
         fields: {
+            SOCIAL_AUTH_GITHUB_CALLBACK_URL: {
+                type: 'text',
+                reset: 'SOCIAL_AUTH_GITHUB_CALLBACK_URL'
+            },
             SOCIAL_AUTH_GITHUB_KEY: {
                 type: 'text',
                 reset: 'SOCIAL_AUTH_GITHUB_KEY'
@@ -19,6 +23,20 @@ export default ['i18n', function(i18n) {
                 type: 'sensitive',
                 hasShowInputButton: true,
                 reset: 'SOCIAL_AUTH_GITHUB_SECRET'
+            },
+            SOCIAL_AUTH_GITHUB_ORGANIZATION_MAP: {
+                type: 'textarea',
+                reset: 'SOCIAL_AUTH_GITHUB_ORGANIZATION_MAP',
+                rows: 6,
+                codeMirror: true,
+                class: 'Form-textAreaLabel Form-formGroup--fullWidth'
+            },
+            SOCIAL_AUTH_GITHUB_TEAM_MAP: {
+                type: 'textarea',
+                reset: 'SOCIAL_AUTH_GITHUB_TEAM_MAP',
+                rows: 6,
+                codeMirror: true,
+                class: 'Form-textAreaLabel Form-formGroup--fullWidth'
             }
         },
 
diff --git a/awx/ui/client/src/configuration/auth-form/sub-forms/auth-google-oauth2.form.js b/awx/ui/client/src/configuration/auth-form/sub-forms/auth-google-oauth2.form.js
index 8842570974..3546fdbc3e 100644
--- a/awx/ui/client/src/configuration/auth-form/sub-forms/auth-google-oauth2.form.js
+++ b/awx/ui/client/src/configuration/auth-form/sub-forms/auth-google-oauth2.form.js
@@ -11,6 +11,10 @@ export default ['i18n', function(i18n) {
         showHeader: false,
 
         fields: {
+            SOCIAL_AUTH_GOOGLE_OAUTH2_CALLBACK_URL: {
+                type: 'text',
+                reset: 'SOCIAL_AUTH_GOOGLE_OAUTH2_CALLBACK_URL'
+            },
             SOCIAL_AUTH_GOOGLE_OAUTH2_KEY: {
                 type: 'text',
                 reset: 'SOCIAL_AUTH_GOOGLE_OAUTH2_KEY'
@@ -31,6 +35,20 @@ export default ['i18n', function(i18n) {
                 codeMirror: true,
                 rows: 6,
                 class: 'Form-textAreaLabel Form-formGroup--fullWidth',
+            },
+            SOCIAL_AUTH_GOOGLE_OAUTH2_ORGANIZATION_MAP: {
+                type: 'textarea',
+                reset: 'SOCIAL_AUTH_GOOGLE_OAUTH2_ORGANIZATION_MAP',
+                rows: 6,
+                codeMirror: true,
+                class: 'Form-textAreaLabel Form-formGroup--fullWidth'
+            },
+            SOCIAL_AUTH_GOOGLE_OAUTH2_TEAM_MAP: {
+                type: 'textarea',
+                reset: 'SOCIAL_AUTH_GOOGLE_OAUTH2_TEAM_MAP',
+                rows: 6,
+                codeMirror: true,
+                class: 'Form-textAreaLabel Form-formGroup--fullWidth'
             }
         },
 
diff --git a/awx/ui/client/src/configuration/auth-form/sub-forms/auth-saml.form.js b/awx/ui/client/src/configuration/auth-form/sub-forms/auth-saml.form.js
index 698bcbc6bd..ad1f7cb6d8 100644
--- a/awx/ui/client/src/configuration/auth-form/sub-forms/auth-saml.form.js
+++ b/awx/ui/client/src/configuration/auth-form/sub-forms/auth-saml.form.js
@@ -11,6 +11,14 @@ export default ['i18n', function(i18n) {
         showHeader: false,
 
         fields: {
+            SOCIAL_AUTH_SAML_CALLBACK_URL: {
+                type: 'text',
+                reset: 'SOCIAL_AUTH_SAML_CALLBACK_URL'
+            },
+            SOCIAL_AUTH_SAML_METADATA_URL: {
+                type: 'text',
+                reset: 'SOCIAL_AUTH_SAML_METADATA_URL'
+            },
             SOCIAL_AUTH_SAML_SP_ENTITY_ID: {
                 type: 'text',
                 reset: 'SOCIAL_AUTH_SAML_SP_ENTITY_ID'
@@ -51,6 +59,20 @@ export default ['i18n', function(i18n) {
                 rows: 6,
                 codeMirror: true,
                 class: 'Form-textAreaLabel Form-formGroup--fullWidth'
+            },
+            SOCIAL_AUTH_SAML_ORGANIZATION_MAP: {
+                type: 'textarea',
+                reset: 'SOCIAL_AUTH_SAML_ORGANIZATION_MAP',
+                rows: 6,
+                codeMirror: true,
+                class: 'Form-textAreaLabel Form-formGroup--fullWidth'
+            },
+            SOCIAL_AUTH_SAML_TEAM_MAP: {
+                type: 'textarea',
+                reset: 'SOCIAL_AUTH_SAML_TEAM_MAP',
+                rows: 6,
+                codeMirror: true,
+                class: 'Form-textAreaLabel Form-formGroup--fullWidth'
             }
         },
 
diff --git a/awx/ui/client/src/configuration/configuration.block.less b/awx/ui/client/src/configuration/configuration.block.less
index b25d36e400..ea00e16276 100644
--- a/awx/ui/client/src/configuration/configuration.block.less
+++ b/awx/ui/client/src/configuration/configuration.block.less
@@ -99,3 +99,45 @@ input#filePickerText {
 .Section-messageBar--close:hover {
     color: @white;
 }
+
+//Codemirror and more disabling - you can still tab into the field with this method though
+textarea[disabled="disabled"] + div[id*="-container"]{
+    pointer-events: none;
+    cursor: not-allowed;
+
+        .CodeMirror {
+            cursor: not-allowed;
+        }
+
+        .CodeMirror.cm-s-default,
+        .CodeMirror-line {
+            background-color: #f6f6f6;
+        }
+
+        .CodeMirror-gutter.CodeMirror-lint-markers,
+        .CodeMirror-gutter.CodeMirror-linenumbers {
+            background-color: #ebebeb;
+            color: @b7grey;
+        }
+
+        .CodeMirror-lines {
+            cursor: default;
+        }
+
+        .CodeMirror-cursors {
+            display: none;
+        }
+}
+
+//Needed to show the not-allowed cursor over a Codemirror instance
+.Form-formGroup--disabled {
+    cursor: not-allowed;
+
+    // Filepicker and toggle disabling
+    .Form-filePicker--pickerButton, .Form-filePicker--textBox,
+    .ScheduleToggle {
+        pointer-events: none;
+        cursor: not-allowed;
+    }
+
+}
diff --git a/awx/ui/client/src/configuration/configuration.service.js b/awx/ui/client/src/configuration/configuration.service.js
index 84dac656d0..c770de2400 100644
--- a/awx/ui/client/src/configuration/configuration.service.js
+++ b/awx/ui/client/src/configuration/configuration.service.js
@@ -11,20 +11,28 @@ export default ['$rootScope', 'GetBasePath', 'ProcessErrors', '$q', '$http', 'Re
         return {
             getConfigurationOptions: function() {
                 var deferred = $q.defer();
-                var returnData;
+                var returnData = {};
 
                 Rest.setUrl(url + '/all');
                 Rest.options()
                     .success(function(data) {
-                        if($rootScope.user_is_superuser) {
-                            returnData = data.actions.PUT;
-                        } else {
-                            returnData = data.actions.GET;
-                        }
+                        // Compare GET actions with PUT actions and flag discrepancies
+                        // for disabling in the UI
+                        var getActions = data.actions.GET;
+                        var getKeys = _.keys(getActions);
+                        var putActions = data.actions.PUT;
+
+                        _.each(getKeys, function(key) {
+                            if(putActions[key]) {
+                                returnData[key] = putActions[key];
+                            } else {
+                                returnData[key] = _.extend(getActions[key], {
+                                                        required: false,
+                                                        disabled: true
+                                                    });
+                            }
+                        });
 
-                        //LICENSE is read only, returning here explicitly for display
-                        // Removing LICENSE display until 3.2 or later
-                        //returnData.LICENSE = data.actions.GET.LICENSE;
                         deferred.resolve(returnData);
                     })
                     .error(function(error) {
diff --git a/awx/ui/client/src/configuration/jobs-form/configuration-jobs.controller.js b/awx/ui/client/src/configuration/jobs-form/configuration-jobs.controller.js
index 0d7cd0962b..953167c3f5 100644
--- a/awx/ui/client/src/configuration/jobs-form/configuration-jobs.controller.js
+++ b/awx/ui/client/src/configuration/jobs-form/configuration-jobs.controller.js
@@ -56,7 +56,9 @@ export default [
                 dataPlacement: 'top',
                 dataTitle: $scope.$parent.configDataResolve[key].label,
                 required: $scope.$parent.configDataResolve[key].required,
-                ngDisabled: $rootScope.user_is_system_auditor
+                ngDisabled: $rootScope.user_is_system_auditor,
+                disabled: $scope.$parent.configDataResolve[key].disabled || null,
+                readonly: $scope.$parent.configDataResolve[key].readonly || null,
             });
         }
 
diff --git a/awx/ui/client/src/configuration/system-form/configuration-system.controller.js b/awx/ui/client/src/configuration/system-form/configuration-system.controller.js
index da5a76181b..3d6ebef0de 100644
--- a/awx/ui/client/src/configuration/system-form/configuration-system.controller.js
+++ b/awx/ui/client/src/configuration/system-form/configuration-system.controller.js
@@ -130,7 +130,9 @@ export default [
                 placeholder: ConfigurationUtils.formatPlaceholder($scope.$parent.configDataResolve[key].placeholder, key) || null,
                 dataTitle: $scope.$parent.configDataResolve[key].label,
                 required: $scope.$parent.configDataResolve[key].required,
-                ngDisabled: $rootScope.user_is_system_auditor
+                ngDisabled: $rootScope.user_is_system_auditor,
+                disabled: $scope.$parent.configDataResolve[key].disabled || null,
+                readonly: $scope.$parent.configDataResolve[key].readonly || null,
             });
         }
 
diff --git a/awx/ui/client/src/configuration/ui-form/configuration-ui.controller.js b/awx/ui/client/src/configuration/ui-form/configuration-ui.controller.js
index bfa19b165f..2ae540625e 100644
--- a/awx/ui/client/src/configuration/ui-form/configuration-ui.controller.js
+++ b/awx/ui/client/src/configuration/ui-form/configuration-ui.controller.js
@@ -59,7 +59,9 @@
                  dataPlacement: 'top',
                  dataTitle: $scope.$parent.configDataResolve[key].label,
                  required: $scope.$parent.configDataResolve[key].required,
-                 ngDisabled: $rootScope.user_is_system_auditor
+                 ngDisabled: $rootScope.user_is_system_auditor,
+                 disabled: $scope.$parent.configDataResolve[key].disabled || null,
+                 readonly: $scope.$parent.configDataResolve[key].readonly || null,
              });
          }
 
diff --git a/awx/ui/client/src/shared/form-generator.js b/awx/ui/client/src/shared/form-generator.js
index 7c0804d499..1f4b418799 100644
--- a/awx/ui/client/src/shared/form-generator.js
+++ b/awx/ui/client/src/shared/form-generator.js
@@ -671,7 +671,7 @@ angular.module('FormGenerator', [GeneratorHelpers.name, 'Utilities', listGenerat
                             html += `<a class="Form-labelAction ${cls}" href="${href}" ng-click="${ngClick}">${action.label}</a>`;
                         }
 
-                        if(field.reset) {
+                        if(field.reset && !field.disabled) {
                             var resetValue = "'" + field.reset+ "'";
                             html+= `<a class="Form-resetValue" ng-click="resetValue(${resetValue})">Reset</a>`;
                         }
@@ -725,6 +725,7 @@ angular.module('FormGenerator', [GeneratorHelpers.name, 'Utilities', listGenerat
 
 
                     html += "<div class='form-group Form-formGroup ";
+                    html += (field.disabled) ? `Form-formGroup--disabled ` : ``;
                     html += (field.type === "checkbox") ? "Form-formGroup--checkbox" : "";
                     html += (field['class']) ? (field['class']) : "";
                     html += "'";
@@ -764,6 +765,7 @@ angular.module('FormGenerator', [GeneratorHelpers.name, 'Utilities', listGenerat
                             html += "\" ";
                             html += (field.placeholder) ? this.attr(field, 'placeholder') : "";
                             html += (field.required) ? "required " : "";
+                            html += (field.disabled) ? `disabled="disabled" `: ``;
                             html += (field.readonly || field.showonly) ? "readonly " : "";
                             html += (field.awPassMatch) ? "awpassmatch=\"" + field.associated + "\" " : "";
                             html += (field.capitalize) ? "capitalize " : "";
@@ -867,6 +869,7 @@ angular.module('FormGenerator', [GeneratorHelpers.name, 'Utilities', listGenerat
 
                         if (field.control === null || field.control === undefined || field.control) {
                             html += "<input ";
+                            html += (field.disabled) ? `disabled="disabled" `: ``;
                             html += buildId(field, fld + "_input", this.form);
                             html += "type='password' ";
                             html += "ng-model=\"" + fld + '" ';
@@ -986,6 +989,7 @@ angular.module('FormGenerator', [GeneratorHelpers.name, 'Utilities', listGenerat
                         html += ">\n";
 
                         html += "<textarea ";
+                        html += (field.disabled) ? `disabled="disabled" `: ``;
                         html += (field.rows) ? this.attr(field, 'rows') : "";
                         html += "ng-model=\"" + fld + '" ';
                         html += 'name="' + fld + '" ';
@@ -1045,6 +1049,7 @@ angular.module('FormGenerator', [GeneratorHelpers.name, 'Utilities', listGenerat
 
                         html += "<div class=\"Form-dropDownContainer\">\n";
                         html += "<select ";
+                        html += (field.disabled) ? `disabled="disabled" `: ``;
                         html += "ng-model=\"" + (field.ngModel ? field.ngModel : fld) + '" ';
                         html += 'name="' + fld + '" ';
                         html += "class=\"form-control Form-dropDown";