diff --git a/composer.json b/composer.json
index d4800c6f5..1fffa1d2e 100644
--- a/composer.json
+++ b/composer.json
@@ -23,7 +23,7 @@
         "fortawesome/font-awesome": "~4.2.0",
         "jms/translation-bundle": "~1.1.0",
         "jms/di-extra-bundle": "~1.4.0",
-        "surfnet/stepup-middleware-client-bundle": "^1.3",
+        "surfnet/stepup-middleware-client-bundle": "^1.5",
         "guzzlehttp/guzzle": "~4",
         "surfnet/stepup-saml-bundle": "^2.5",
         "surfnet/stepup-bundle": "^1.5",
diff --git a/composer.lock b/composer.lock
index 1fc6b4e56..7783a27ef 100644
--- a/composer.lock
+++ b/composer.lock
@@ -4,8 +4,8 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#composer-lock-the-lock-file",
         "This file is @generated automatically"
     ],
-    "hash": "3939dd4d4dda140bc1d12134bf80962f",
-    "content-hash": "60b8aa1373bccb0093766bcef11e2319",
+    "hash": "30b097cad2369e8b1f692132b053a06a",
+    "content-hash": "4bf70b2ffbffe5ac5d3155bd776c5ac8",
     "packages": [
         {
             "name": "beberlei/assert",
@@ -1857,12 +1857,12 @@
             "version": "1.5.0",
             "source": {
                 "type": "git",
-                "url": "https://github.com/SURFnet/Stepup-bundle.git",
+                "url": "https://github.com/OpenConext/Stepup-bundle.git",
                 "reference": "4ad7ebe9f9075ec39c5d1fc8449fe8fef33e60d2"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/SURFnet/Stepup-bundle/zipball/4ad7ebe9f9075ec39c5d1fc8449fe8fef33e60d2",
+                "url": "https://api.github.com/repos/OpenConext/Stepup-bundle/zipball/4ad7ebe9f9075ec39c5d1fc8449fe8fef33e60d2",
                 "reference": "4ad7ebe9f9075ec39c5d1fc8449fe8fef33e60d2",
                 "shasum": ""
             },
@@ -1907,16 +1907,16 @@
         },
         {
             "name": "surfnet/stepup-middleware-client-bundle",
-            "version": "1.3.0",
+            "version": "1.5.0",
             "source": {
                 "type": "git",
-                "url": "https://github.com/SURFnet/Stepup-Middleware-clientbundle.git",
-                "reference": "ee1dbf1664ca959500609793ec8c185a367cb9ca"
+                "url": "https://github.com/OpenConext/Stepup-Middleware-clientbundle.git",
+                "reference": "33db2b063ffcf5e2a3b0da2f2d5cd59072877c66"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/SURFnet/Stepup-Middleware-clientbundle/zipball/ee1dbf1664ca959500609793ec8c185a367cb9ca",
-                "reference": "ee1dbf1664ca959500609793ec8c185a367cb9ca",
+                "url": "https://api.github.com/repos/OpenConext/Stepup-Middleware-clientbundle/zipball/33db2b063ffcf5e2a3b0da2f2d5cd59072877c66",
+                "reference": "33db2b063ffcf5e2a3b0da2f2d5cd59072877c66",
                 "shasum": ""
             },
             "require": {
@@ -1952,19 +1952,19 @@
                 "Apache-2.0"
             ],
             "description": "Symfony2 bundle for consuming the Step-up Middleware API.",
-            "time": "2016-08-03 08:56:12"
+            "time": "2017-02-14 16:07:55"
         },
         {
             "name": "surfnet/stepup-saml-bundle",
             "version": "2.5.0",
             "source": {
                 "type": "git",
-                "url": "https://github.com/SURFnet/Stepup-saml-bundle.git",
+                "url": "https://github.com/OpenConext/Stepup-saml-bundle.git",
                 "reference": "3ee050d16f76bf63b48fa01af3e75e1b42668d72"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/SURFnet/Stepup-saml-bundle/zipball/3ee050d16f76bf63b48fa01af3e75e1b42668d72",
+                "url": "https://api.github.com/repos/OpenConext/Stepup-saml-bundle/zipball/3ee050d16f76bf63b48fa01af3e75e1b42668d72",
                 "reference": "3ee050d16f76bf63b48fa01af3e75e1b42668d72",
                 "shasum": ""
             },
@@ -2007,12 +2007,12 @@
             "version": "dev-develop",
             "source": {
                 "type": "git",
-                "url": "https://github.com/SURFnet/Stepup-u2f-bundle.git",
+                "url": "https://github.com/OpenConext/Stepup-u2f-bundle.git",
                 "reference": "b28737d7b8df5ecbdf7a1e952ecfb530a2951c05"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/SURFnet/Stepup-u2f-bundle/zipball/b28737d7b8df5ecbdf7a1e952ecfb530a2951c05",
+                "url": "https://api.github.com/repos/OpenConext/Stepup-u2f-bundle/zipball/b28737d7b8df5ecbdf7a1e952ecfb530a2951c05",
                 "reference": "b28737d7b8df5ecbdf7a1e952ecfb530a2951c05",
                 "shasum": ""
             },
diff --git a/src/Surfnet/StepupSelfService/SelfServiceBundle/Controller/RegistrationController.php b/src/Surfnet/StepupSelfService/SelfServiceBundle/Controller/RegistrationController.php
index 201133f38..a96e708db 100644
--- a/src/Surfnet/StepupSelfService/SelfServiceBundle/Controller/RegistrationController.php
+++ b/src/Surfnet/StepupSelfService/SelfServiceBundle/Controller/RegistrationController.php
@@ -31,11 +31,20 @@ class RegistrationController extends Controller
      */
     public function displaySecondFactorTypesAction()
     {
-        $enabledSecondFactors = $this->getParameter('ss.enabled_second_factors');
+        $institutionConfigurationOptions = $this->get('self_service.service.institution_configuration_options')
+            ->getInstitutionConfigurationOptionsFor($this->getIdentity()->institution);
+
+        $availableSecondFactors = $this->getParameter('ss.enabled_second_factors');
+        if (!empty($institutionConfigurationOptions->allowedSecondFactors)) {
+            $availableSecondFactors = array_intersect(
+                $availableSecondFactors,
+                $institutionConfigurationOptions->allowedSecondFactors
+            );
+        }
 
         return [
             'commonName' => $this->getIdentity()->commonName,
-            'enabledSecondFactors' => array_combine($enabledSecondFactors, $enabledSecondFactors),
+            'availableSecondFactors' => array_combine($availableSecondFactors, $availableSecondFactors),
             'tiqrAppAndroidUrl' => $this->getParameter('tiqr_app_android_url'),
             'tiqrAppIosUrl'     => $this->getParameter('tiqr_app_ios_url'),
         ];
diff --git a/src/Surfnet/StepupSelfService/SelfServiceBundle/Resources/views/Registration/displaySecondFactorTypes.html.twig b/src/Surfnet/StepupSelfService/SelfServiceBundle/Resources/views/Registration/displaySecondFactorTypes.html.twig
index 81de62695..62952eefd 100644
--- a/src/Surfnet/StepupSelfService/SelfServiceBundle/Resources/views/Registration/displaySecondFactorTypes.html.twig
+++ b/src/Surfnet/StepupSelfService/SelfServiceBundle/Resources/views/Registration/displaySecondFactorTypes.html.twig
@@ -12,7 +12,7 @@
     <h2>{{ block('page_title') }}</h2>
 
     <div class="row">
-        {% if enabledSecondFactors.sms is defined %}
+        {% if availableSecondFactors.sms is defined %}
             {% include 'SurfnetStepupSelfServiceSelfServiceBundle::Registration/partial/secondFactor.html.twig' with {
                 'type': 'sms',
                 'security': 2,
@@ -21,7 +21,7 @@
                 'tiqrAppIosUrl': tiqrAppIosUrl,
             } only %}
         {% endif %}
-        {% if enabledSecondFactors.tiqr is defined %}
+        {% if availableSecondFactors.tiqr is defined %}
             {% include 'SurfnetStepupSelfServiceSelfServiceBundle::Registration/partial/secondFactor.html.twig' with {
                 'type': 'tiqr',
                 'security': 2,
@@ -30,7 +30,7 @@
                 'tiqrAppIosUrl': tiqrAppIosUrl,
             } only %}
         {% endif %}
-        {% if enabledSecondFactors.yubikey is defined %}
+        {% if availableSecondFactors.yubikey is defined %}
             {% include 'SurfnetStepupSelfServiceSelfServiceBundle::Registration/partial/secondFactor.html.twig' with {
                 'type': 'yubikey',
                 'security': 3,
@@ -39,7 +39,7 @@
                 'tiqrAppIosUrl': tiqrAppIosUrl,
             } only %}
         {% endif %}
-        {% if enabledSecondFactors.u2f is defined %}
+        {% if availableSecondFactors.u2f is defined %}
             {% include 'SurfnetStepupSelfServiceSelfServiceBundle::Registration/partial/secondFactor.html.twig' with {
                 'type': 'u2f',
                 'security': 3,
@@ -48,7 +48,7 @@
                 'tiqrAppIosUrl': tiqrAppIosUrl,
             } only %}
         {% endif %}
-        {% if enabledSecondFactors.biometric is defined %}
+        {% if availableSecondFactors.biometric is defined %}
             {% include 'SurfnetStepupSelfServiceSelfServiceBundle::Registration/partial/secondFactor.html.twig' with {
                 'type': 'biometric',
                 'security': 3,