From dfe23f0207713d683e4c264979c92b48144fdffc Mon Sep 17 00:00:00 2001 From: Sam Glendenning Date: Tue, 16 Nov 2021 16:57:03 +0000 Subject: [PATCH 01/76] Initial HTML and JS for enabling MFA on user account through dashboard Files are not complete, work still to be done on creating and displaying the angular components --- .../user/mfa/user.mfa.component.html | 22 ++++ .../components/user/mfa/user.mfa.component.js | 57 +++++++++ .../components/user/user.component.html | 3 + .../templates/home/editmfasettings.html | 121 ++++++++++++++++++ .../home/enable-authenticator-app.html | 74 +++++++++++ iam-test-client/.factorypath | 82 ++++++++++++ iam-test-protected-resource/.factorypath | 66 ++++++++++ 7 files changed, 425 insertions(+) create mode 100644 iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/components/user/mfa/user.mfa.component.html create mode 100644 iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/components/user/mfa/user.mfa.component.js create mode 100644 iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/editmfasettings.html create mode 100644 iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/enable-authenticator-app.html create mode 100644 iam-test-client/.factorypath create mode 100644 iam-test-protected-resource/.factorypath diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/components/user/mfa/user.mfa.component.html b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/components/user/mfa/user.mfa.component.html new file mode 100644 index 000000000..84ae11cc8 --- /dev/null +++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/components/user/mfa/user.mfa.component.html @@ -0,0 +1,22 @@ + + + \ No newline at end of file diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/components/user/mfa/user.mfa.component.js b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/components/user/mfa/user.mfa.component.js new file mode 100644 index 000000000..0c29758cd --- /dev/null +++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/components/user/mfa/user.mfa.component.js @@ -0,0 +1,57 @@ +/* + * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019 + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +(function() { + 'use strict'; + + function UserMfaController( + toaster, Utils, ModalService, $uibModal) { + var self = this; + + self.$onInit = function() { + console.log('UserMfaController onInit'); + self.enabled = true; + self.user = self.userCtrl.user; + }; + + self.isMe = function() { return self.userCtrl.isMe(); }; + + self.openUserMfaModal = function() { + self.enabled = false; + var modalInstance = $uibModal.open({ + templateUrl: '/resources/iam/apps/dashboard-app/templates/home/editmfasettings.html', + controller: 'UserMfaController', + controllerAs: 'userMfaCtrl', + resolve: {user: function() { return self.user; }} + }); + + modalInstance.result.then(function(msg) { + toaster.pop({type: 'success', body: msg}); + }); + }; + } + + + + angular.module('dashboardApp').component('userMfa', { + require: {userCtrl: '^user'}, + templateUrl: + '/resources/iam/apps/dashboard-app/components/user/mfa/user.mfa.component.html', + controller: [ + 'toaster', 'Utils', 'ModalService', '$uibModal', + UserMfaController + ] + }); +})(); \ No newline at end of file diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/components/user/user.component.html b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/components/user/user.component.html index 2ee8052f1..c8fd6185e 100644 --- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/components/user/user.component.html +++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/components/user/user.component.html @@ -67,6 +67,9 @@

+ + + diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/editmfasettings.html b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/editmfasettings.html new file mode 100644 index 000000000..945784aeb --- /dev/null +++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/editmfasettings.html @@ -0,0 +1,121 @@ + +
+ +
+

Edit multi-factor authentication settings for '{{userMfaCtrl.eUser.name.formatted}}'

+
+ +
+ + +
+ + + + + Enabled + + + + Disabled + + + +
+ +
+ + + + + Enabled + + + + Disabled + + + +
+ + + +
+ +
+ +
+
diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/enable-authenticator-app.html b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/enable-authenticator-app.html new file mode 100644 index 000000000..c69686b8b --- /dev/null +++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/enable-authenticator-app.html @@ -0,0 +1,74 @@ + + +
+ +
+

Enable authenticator app

+
+ +
+ + + +

Alternatively, enter this secret manually into the app.

+

...

+ +
+
+ +
+
+ + + This is a required field + Minimum length required is {{enableAuthenticatorAppCtrl.codeMinlength}} +
+
+ +
+ + + +
+ + + + +
+ +
\ No newline at end of file diff --git a/iam-test-client/.factorypath b/iam-test-client/.factorypath new file mode 100644 index 000000000..f3186a492 --- /dev/null +++ b/iam-test-client/.factorypath @@ -0,0 +1,82 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/iam-test-protected-resource/.factorypath b/iam-test-protected-resource/.factorypath new file mode 100644 index 000000000..b7d292531 --- /dev/null +++ b/iam-test-protected-resource/.factorypath @@ -0,0 +1,66 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + From baf4fe8b77672a7b7e72671383d67dd0db7fcb5d Mon Sep 17 00:00:00 2001 From: Sam Glendenning Date: Thu, 18 Nov 2021 13:29:41 +0000 Subject: [PATCH 02/76] Button and modal for editing MFA settings now appears --- .../webapp/WEB-INF/views/iam/dashboard.jsp | 3 + .../user/mfa/user.mfa.component.html | 8 +- .../components/user/mfa/user.mfa.component.js | 7 +- .../controllers/user-mfa.controller.js | 112 ++++++++++++++++++ .../services/load-templates.service.js | 1 + .../templates/home/editmfasettings.html | 20 ++-- 6 files changed, 136 insertions(+), 15 deletions(-) create mode 100644 iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/user-mfa.controller.js diff --git a/iam-login-service/src/main/webapp/WEB-INF/views/iam/dashboard.jsp b/iam-login-service/src/main/webapp/WEB-INF/views/iam/dashboard.jsp index 746c26eb3..bdcdbd69f 100644 --- a/iam-login-service/src/main/webapp/WEB-INF/views/iam/dashboard.jsp +++ b/iam-login-service/src/main/webapp/WEB-INF/views/iam/dashboard.jsp @@ -110,6 +110,7 @@ + @@ -125,6 +126,8 @@ + + diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/enable-authenticator-app.controller.js b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/enable-authenticator-app.controller.js new file mode 100644 index 000000000..b4ca83bd5 --- /dev/null +++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/enable-authenticator-app.controller.js @@ -0,0 +1,85 @@ +/* + * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019 + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + 'use strict'; + + angular.module('dashboardApp') + .controller('EnableAuthenticatorAppController', EnableAuthenticatorAppController); + + EnableAuthenticatorAppController.$inject = [ + '$scope', '$state', '$uibModalInstance', 'Utils', 'user' + ]; + + function EnableAuthenticatorAppController( + $scope, $state, $uibModalInstance, Utils, user) { + var enableAuthAppCtrl = this; + + enableAuthAppCtrl.userToEdit = user; + enableAuthAppCtrl.codeMinlength = 6; + + enableAuthAppCtrl.dismiss = dismiss; + enableAuthAppCtrl.reset = reset; + + function reset() { + console.log('reset form'); + + enableAuthAppCtrl.enabled = true; + + enableAuthAppCtrl.user = { + code: '' + }; + + if ($scope.userMfaForm) { + $scope.userMfaForm.$setPristine(); + } + } + + enableAuthAppCtrl.reset(); + + function dismiss() { return $uibModalInstance.dismiss('Cancel'); } + + enableAuthAppCtrl.message = ''; + + enableAuthAppCtrl.submit = function() { + return $uibModalInstance.close('Updated settings'); + // ResetPasswordService + // .updatePassword( + // userMfaCtrl.user.currentPassword, + // userMfaCtrl.user.password) + // .then(function() { return $uibModalInstance.close('Password updated'); }) + // .catch(function(error) { + // console.error(error); + // $scope.operationResult = Utils.buildErrorResult(error.data); + // }); + }; + } + +// var compareTo = function() { +// return { +// require: 'ngModel', +// scope: {otherModelValue: '=compareTo'}, +// link: function(scope, element, attributes, ngModel) { + +// ngModel.$validators.compareTo = function(modelValue) { +// return modelValue == scope.otherModelValue; +// }; + +// scope.$watch('otherModelValue', function() { ngModel.$validate(); }); +// } +// }; +// }; + +// angular.module('dashboardApp').directive('compareTo', compareTo); +// })(); \ No newline at end of file diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/user-mfa.controller.js b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/user-mfa.controller.js index 1caa669a8..0331263f5 100644 --- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/user-mfa.controller.js +++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/user-mfa.controller.js @@ -19,11 +19,11 @@ .controller('UserMfaController', UserMfaController); UserMfaController.$inject = [ - '$scope', '$state', '$uibModalInstance', 'Utils', 'user' + '$scope', '$state', '$uibModalInstance', 'Utils', 'user', '$uibModal' ]; function UserMfaController( - $scope, $state, $uibModalInstance, Utils, user) { + $scope, $state, $uibModalInstance, Utils, user, $uibModal) { var userMfaCtrl = this; userMfaCtrl.$onInit = function() { @@ -32,14 +32,24 @@ userMfaCtrl.userToEdit = user; - userMfaCtrl.authenticatorAppActive = true; + userMfaCtrl.authenticatorAppActive = false; + userMfaCtrl.yubiKeyActive = false; userMfaCtrl.enableAuthenticatorApp = enableAuthenticatorApp; userMfaCtrl.disableAuthenticatorApp = disableAuthenticatorApp; userMfaCtrl.enableYubiKey = enableYubiKey; userMfaCtrl.disableYubiKey = disableYubiKey; function enableAuthenticatorApp() { - return true; + var modalInstance = $uibModal.open({ + templateUrl: '/resources/iam/apps/dashboard-app/templates/home/enable-authenticator-app.html', + controller: 'EnableAuthenticatorAppController', + controllerAs: 'enableAuthAppCtrl', + resolve: {user: function() { return self.user; }} + }); + + modalInstance.result.then(function(msg) { + toaster.pop({type: 'success', body: msg}); + }); } function disableAuthenticatorApp() { @@ -62,12 +72,6 @@ userMfaCtrl.enabled = true; - userMfaCtrl.user = { - currentPassword: '', - password: '', - confirmPassword: '' - }; - if ($scope.userMfaForm) { $scope.userMfaForm.$setPristine(); } diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/services/load-templates.service.js b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/services/load-templates.service.js index f233f5e71..06ea75363 100644 --- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/services/load-templates.service.js +++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/services/load-templates.service.js @@ -29,6 +29,7 @@ '/resources/iam/apps/dashboard-app/templates/home/editmfasettings.html', '/resources/iam/apps/dashboard-app/templates/home/editpassword.html', '/resources/iam/apps/dashboard-app/templates/home/edituser.html', + '/resources/iam/apps/dashboard-app/templates/home/enable-authenticator-app.html', '/resources/iam/apps/dashboard-app/templates/home/home.html', '/resources/iam/apps/dashboard-app/templates/loading-modal.html', '/resources/iam/apps/dashboard-app/templates/nav.html', diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/editmfasettings.html b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/editmfasettings.html index c848029e0..adab11553 100644 --- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/editmfasettings.html +++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/editmfasettings.html @@ -33,10 +33,10 @@

Edit multi-factor authentication settings for {{userMfaC Enabled - + Disabled - +

@@ -49,10 +49,10 @@

Edit multi-factor authentication settings for {{userMfaC Enabled - + Disabled - + diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/enable-authenticator-app.html b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/enable-authenticator-app.html index c69686b8b..9974c920d 100644 --- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/enable-authenticator-app.html +++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/enable-authenticator-app.html @@ -16,7 +16,7 @@ --> -
+

Enable authenticator app

@@ -25,6 +25,7 @@

Enable authenticator app

+

Scan the QR code through your authenticator app and input a TOTP to validate configuration.

Alternatively, enter this secret manually into the app.

...

@@ -34,41 +35,17 @@

Enable authenticator app

- + This is a required field - Minimum length required is {{enableAuthenticatorAppCtrl.codeMinlength}} + Minimum length required is {{enableAuthAppCtrl.codeMinlength}}
- - + +
-
- - -
- -
\ No newline at end of file + \ No newline at end of file From 0a5857896f3c6d3d75f0f3e93dd53da46def6fc0 Mon Sep 17 00:00:00 2001 From: Sam Glendenning Date: Fri, 19 Nov 2021 12:34:23 +0000 Subject: [PATCH 04/76] Adding models for IamTotpMfa and IamTotpRecoveryCode Also adding Maven dependency for TOTP library --- .../mw/iam/persistence/model/IamAccount.java | 23 +++ .../mw/iam/persistence/model/IamTotpMfa.java | 144 ++++++++++++++++++ .../model/IamTotpRecoveryCode.java | 111 ++++++++++++++ pom.xml | 7 + 4 files changed, 285 insertions(+) create mode 100644 iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpMfa.java create mode 100644 iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpRecoveryCode.java diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAccount.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAccount.java index bc6304907..46a9071c8 100644 --- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAccount.java +++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAccount.java @@ -92,6 +92,13 @@ public class IamAccount implements Serializable { @JoinColumn(name = "user_info_id") private IamUserInfo userInfo; + @Column(name = "mfa_enabled", nullable = false) + private boolean mfaEnabled; + + @OneToOne(cascade = CascadeType.ALL, mappedBy = "account") + @JoinColumn(name = "iam_totp_mfa", referencedColumnName = "id", nullable = true) + private IamTotpMfa totpMfa; + @Temporal(TemporalType.TIMESTAMP) @Column(name = "last_login_time", nullable = true) private Date lastLoginTime; @@ -245,6 +252,22 @@ public void setActive(final boolean active) { this.active = active; } + public boolean isMfaEnabled() { + return mfaEnabled; + } + + public void setMfaEnabled(final boolean mfaEnabled) { + this.mfaEnabled = mfaEnabled; + } + + public IamTotpMfa getTotpMfa() { + return totpMfa; + } + + public void setTotpMfa(final IamTotpMfa totpMfa) { + this.totpMfa = totpMfa; + } + public Set getSamlIds() { return samlIds; diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpMfa.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpMfa.java new file mode 100644 index 000000000..45e303c64 --- /dev/null +++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpMfa.java @@ -0,0 +1,144 @@ +package it.infn.mw.iam.persistence.model; + +import java.io.Serializable; +import java.util.Date; +import java.util.HashSet; +import java.util.Set; + +import javax.persistence.CascadeType; +import javax.persistence.Column; +import javax.persistence.Entity; +import javax.persistence.FetchType; +import javax.persistence.GeneratedValue; +import javax.persistence.GenerationType; +import javax.persistence.Id; +import javax.persistence.OneToMany; +import javax.persistence.OneToOne; +import javax.persistence.Table; +import javax.persistence.Temporal; +import javax.persistence.TemporalType; + +@Entity +@Table(name = "mfa") +public class IamTotpMfa implements Serializable { + @Id + @GeneratedValue(strategy = GenerationType.IDENTITY) + private Long id; + + @OneToOne(mappedBy = "totpMfa") + private IamAccount account; + + @Column(name = "secret") + private String secret; + + @Temporal(TemporalType.TIMESTAMP) + @Column(name = "creationtime", nullable = false) + private Date creationTime; + + @Temporal(TemporalType.TIMESTAMP) + @Column(name = "lastupdatetime", nullable = false) + private Date lastUpdateTime; + + @Column(name = "active", nullable = false) + private boolean active; + + // TODO do we need a UUID? + + @OneToMany(mappedBy = "totpMfa", cascade = CascadeType.ALL, fetch = FetchType.EAGER, + orphanRemoval = true) + private Set recoveryCodes = new HashSet<>(); + + public IamTotpMfa(String secret) { + this.secret = secret; + } + + public Long getId() { + return id; + } + + public void setId(Long id) { + this.id = id; + } + + public IamAccount getAccount() { + return account; + } + + public void setAccount(final IamAccount account) { + this.account = account; + } + + public String getSecret() { + return secret; + } + + public void setSecret(final String secret) { + this.secret = secret; + } + + public Date getCreationTime() { + + return creationTime; + } + + public void setCreationTime(final Date creationTime) { + + this.creationTime = creationTime; + } + + public Date getLastUpdateTime() { + + return lastUpdateTime; + } + + public void setLastUpdateTime(final Date lastUpdateTime) { + + this.lastUpdateTime = lastUpdateTime; + } + + public boolean isActive() { + + return active; + } + + public void setActive(final boolean active) { + + this.active = active; + } + + public Set getRecoveryCodes() { + return recoveryCodes; + } + + public void setRecoveryCodes(final Set recoveryCodes) { + if (this.recoveryCodes.isEmpty()) { + this.recoveryCodes = recoveryCodes; + } else { + this.recoveryCodes.clear(); + this.recoveryCodes.addAll(recoveryCodes); + } + } + + @Override + public String toString() { + return "IamAccount [id=" + id + ", secret=" + secret + ", active=" + active + "]"; + } + + @Override + public boolean equals(final Object obj) { + + if (this == obj) + return true; + if (obj == null) + return false; + if (getClass() != obj.getClass()) + return false; + IamTotpMfa other = (IamTotpMfa) obj; + if (secret == null) { + if (other.secret != null) + return false; + } else if (!secret.equals(other.secret)) + return false; + return true; + } +} diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpRecoveryCode.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpRecoveryCode.java new file mode 100644 index 000000000..f2c2ecb1f --- /dev/null +++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpRecoveryCode.java @@ -0,0 +1,111 @@ +package it.infn.mw.iam.persistence.model; + +import java.io.Serializable; +import java.util.Date; + +import javax.persistence.Column; +import javax.persistence.Entity; +import javax.persistence.FetchType; +import javax.persistence.GeneratedValue; +import javax.persistence.GenerationType; +import javax.persistence.Id; +import javax.persistence.JoinColumn; +import javax.persistence.ManyToOne; +import javax.persistence.Table; +import javax.persistence.Temporal; +import javax.persistence.TemporalType; + +@Entity +@Table(name = "iam_totp_recovery_code") +public class IamTotpRecoveryCode implements Serializable { + + @Id + @GeneratedValue(strategy = GenerationType.IDENTITY) + private Long id; + + @Column(name = "code") + private String code; + + @ManyToOne(fetch = FetchType.EAGER) + @JoinColumn(name = "iam_totp_mfa", referencedColumnName = "id", nullable = false) + private IamTotpMfa totpMfa; + + @Temporal(TemporalType.TIMESTAMP) + @Column(name = "creationtime", nullable = false) + private Date creationTime; + + @Temporal(TemporalType.TIMESTAMP) + @Column(name = "lastupdatetime", nullable = false) + private Date lastUpdateTime; + + public IamTotpRecoveryCode(String code) { + this.code = code; + } + + public Long getId() { + return id; + } + + public void setId(Long id) { + this.id = id; + } + + public IamTotpMfa getTotpMfa() { + return totpMfa; + } + + public void setTotpMfa(final IamTotpMfa totpMfa) { + this.totpMfa = totpMfa; + } + + public String getCode() { + return code; + } + + public void setCode(final String code) { + this.code = code; + } + + public Date getCreationTime() { + + return creationTime; + } + + public void setCreationTime(final Date creationTime) { + + this.creationTime = creationTime; + } + + public Date getLastUpdateTime() { + + return lastUpdateTime; + } + + public void setLastUpdateTime(final Date lastUpdateTime) { + + this.lastUpdateTime = lastUpdateTime; + } + + @Override + public String toString() { + return "IamAccount [id=" + id + ", code=" + code + "]"; + } + + @Override + public boolean equals(final Object obj) { + + if (this == obj) + return true; + if (obj == null) + return false; + if (getClass() != obj.getClass()) + return false; + IamTotpRecoveryCode other = (IamTotpRecoveryCode) obj; + if (code == null) { + if (other.code != null) + return false; + } else if (!code.equals(other.code)) + return false; + return true; + } +} diff --git a/pom.xml b/pom.xml index 688d9ff91..e79deb640 100644 --- a/pom.xml +++ b/pom.xml @@ -237,6 +237,13 @@ ${jaxb-runtime.version} + + + dev.samstevens.totp + totp + 1.7.1 + + From 6fd8ccc684b67484ba1761daf4eda2680c9c6e2f Mon Sep 17 00:00:00 2001 From: Sam Glendenning Date: Fri, 19 Nov 2021 17:51:39 +0000 Subject: [PATCH 05/76] Adding modal for disabling authenticator app Also slight amendments to model logic for IamTotpMfa and IamTotpRecoveryCode --- .../webapp/WEB-INF/views/iam/dashboard.jsp | 1 + .../disable-authenticator-app.controller.js | 85 +++++++++++++++++++ .../controllers/user-mfa.controller.js | 12 ++- .../services/load-templates.service.js | 1 + .../home/disable-authenticator-app.html | 50 +++++++++++ .../templates/home/editmfasettings.html | 18 +++- .../mw/iam/persistence/model/IamTotpMfa.java | 8 +- .../model/IamTotpRecoveryCode.java | 6 +- 8 files changed, 174 insertions(+), 7 deletions(-) create mode 100644 iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/disable-authenticator-app.controller.js create mode 100644 iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/disable-authenticator-app.html diff --git a/iam-login-service/src/main/webapp/WEB-INF/views/iam/dashboard.jsp b/iam-login-service/src/main/webapp/WEB-INF/views/iam/dashboard.jsp index 1f03ecf53..b5cf9df17 100644 --- a/iam-login-service/src/main/webapp/WEB-INF/views/iam/dashboard.jsp +++ b/iam-login-service/src/main/webapp/WEB-INF/views/iam/dashboard.jsp @@ -109,6 +109,7 @@ + diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/disable-authenticator-app.controller.js b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/disable-authenticator-app.controller.js new file mode 100644 index 000000000..39ed38ce3 --- /dev/null +++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/disable-authenticator-app.controller.js @@ -0,0 +1,85 @@ +/* + * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019 + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + 'use strict'; + + angular.module('dashboardApp') + .controller('DisableAuthenticatorAppController', DisableAuthenticatorAppController); + + DisableAuthenticatorAppController.$inject = [ + '$scope', '$state', '$uibModalInstance', 'Utils', 'user' + ]; + + function DisableAuthenticatorAppController( + $scope, $state, $uibModalInstance, Utils, user) { + var disableAuthAppCtrl = this; + + disableAuthAppCtrl.userToEdit = user; + disableAuthAppCtrl.codeMinlength = 6; + + disableAuthAppCtrl.dismiss = dismiss; + disableAuthAppCtrl.reset = reset; + + function reset() { + console.log('reset form'); + + disableAuthAppCtrl.disabled = true; + + disableAuthAppCtrl.user = { + code: '' + }; + + if ($scope.userMfaForm) { + $scope.userMfaForm.$setPristine(); + } + } + + disableAuthAppCtrl.reset(); + + function dismiss() { return $uibModalInstance.dismiss('Cancel'); } + + disableAuthAppCtrl.message = ''; + + disableAuthAppCtrl.submit = function() { + return $uibModalInstance.close('Updated settings'); + // ResetPasswordService + // .updatePassword( + // userMfaCtrl.user.currentPassword, + // userMfaCtrl.user.password) + // .then(function() { return $uibModalInstance.close('Password updated'); }) + // .catch(function(error) { + // console.error(error); + // $scope.operationResult = Utils.buildErrorResult(error.data); + // }); + }; + } + +// var compareTo = function() { +// return { +// require: 'ngModel', +// scope: {otherModelValue: '=compareTo'}, +// link: function(scope, element, attributes, ngModel) { + +// ngModel.$validators.compareTo = function(modelValue) { +// return modelValue == scope.otherModelValue; +// }; + +// scope.$watch('otherModelValue', function() { ngModel.$validate(); }); +// } +// }; +// }; + +// angular.module('dashboardApp').directive('compareTo', compareTo); +// })(); \ No newline at end of file diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/user-mfa.controller.js b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/user-mfa.controller.js index 0331263f5..6182cca9e 100644 --- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/user-mfa.controller.js +++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/user-mfa.controller.js @@ -34,6 +34,7 @@ userMfaCtrl.authenticatorAppActive = false; userMfaCtrl.yubiKeyActive = false; + userMfaCtrl.authenticatorApp2Active = true; userMfaCtrl.enableAuthenticatorApp = enableAuthenticatorApp; userMfaCtrl.disableAuthenticatorApp = disableAuthenticatorApp; userMfaCtrl.enableYubiKey = enableYubiKey; @@ -53,7 +54,16 @@ } function disableAuthenticatorApp() { - return true; + var modalInstance = $uibModal.open({ + templateUrl: '/resources/iam/apps/dashboard-app/templates/home/disable-authenticator-app.html', + controller: 'DisableAuthenticatorAppController', + controllerAs: 'disableAuthAppCtrl', + resolve: {user: function() { return self.user; }} + }); + + modalInstance.result.then(function(msg) { + toaster.pop({type: 'success', body: msg}); + }); } function enableYubiKey() { diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/services/load-templates.service.js b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/services/load-templates.service.js index 06ea75363..efbb902ca 100644 --- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/services/load-templates.service.js +++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/services/load-templates.service.js @@ -26,6 +26,7 @@ '/resources/iam/apps/dashboard-app/templates/common/userinfo-box.html', '/resources/iam/apps/dashboard-app/templates/header.html', '/resources/iam/apps/dashboard-app/templates/home/account-link-dialog.html', + '/resources/iam/apps/dashboard-app/templates/home/disable-authenticator-app.html', '/resources/iam/apps/dashboard-app/templates/home/editmfasettings.html', '/resources/iam/apps/dashboard-app/templates/home/editpassword.html', '/resources/iam/apps/dashboard-app/templates/home/edituser.html', diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/disable-authenticator-app.html b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/disable-authenticator-app.html new file mode 100644 index 000000000..0b143fa7a --- /dev/null +++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/disable-authenticator-app.html @@ -0,0 +1,50 @@ + + +
+ +
+

Disable MFA through authenticator app

+
+ +
+ + +

This action disables multi-factor authentication on this account through your selected authentication app.

+

This could leave your account vulnerable and may restrict access to some IAM services.

+

To continue, please enter a code from your authenticator app.

+ +
+
+ +
+
+ + + This is a required field + Minimum length required is {{disableAuthAppCtrl.codeMinlength}} +
+
+ +
+ + + +
+ + \ No newline at end of file diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/editmfasettings.html b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/editmfasettings.html index adab11553..3ef7d8901 100644 --- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/editmfasettings.html +++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/editmfasettings.html @@ -25,7 +25,7 @@

Edit multi-factor authentication settings for {{userMfaC
- + @@ -40,6 +40,22 @@

Edit multi-factor authentication settings for {{userMfaC

+
+ + + + + + Enabled + + + + Disabled + + + +
+
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpMfa.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpMfa.java index 45e303c64..0a4dce404 100644 --- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpMfa.java +++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpMfa.java @@ -19,13 +19,13 @@ import javax.persistence.TemporalType; @Entity -@Table(name = "mfa") +@Table(name = "iam_totp_mfa") public class IamTotpMfa implements Serializable { @Id @GeneratedValue(strategy = GenerationType.IDENTITY) private Long id; - @OneToOne(mappedBy = "totpMfa") + @OneToOne() private IamAccount account; @Column(name = "secret") @@ -44,10 +44,12 @@ public class IamTotpMfa implements Serializable { // TODO do we need a UUID? - @OneToMany(mappedBy = "totpMfa", cascade = CascadeType.ALL, fetch = FetchType.EAGER, + @OneToMany(mappedBy = "totpMfa", cascade = CascadeType.ALL, fetch = FetchType.LAZY, orphanRemoval = true) private Set recoveryCodes = new HashSet<>(); + public IamTotpMfa() {} + public IamTotpMfa(String secret) { this.secret = secret; } diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpRecoveryCode.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpRecoveryCode.java index f2c2ecb1f..5688562e3 100644 --- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpRecoveryCode.java +++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpRecoveryCode.java @@ -26,8 +26,8 @@ public class IamTotpRecoveryCode implements Serializable { @Column(name = "code") private String code; - @ManyToOne(fetch = FetchType.EAGER) - @JoinColumn(name = "iam_totp_mfa", referencedColumnName = "id", nullable = false) + @ManyToOne(fetch = FetchType.LAZY) + @JoinColumn(referencedColumnName = "id", nullable = false) private IamTotpMfa totpMfa; @Temporal(TemporalType.TIMESTAMP) @@ -38,6 +38,8 @@ public class IamTotpRecoveryCode implements Serializable { @Column(name = "lastupdatetime", nullable = false) private Date lastUpdateTime; + public IamTotpRecoveryCode() {} + public IamTotpRecoveryCode(String code) { this.code = code; } From 1a08d0577de828b9bb86848fae139e1dcb4947fe Mon Sep 17 00:00:00 2001 From: rmiccoli Date: Thu, 2 Sep 2021 11:48:13 +0200 Subject: [PATCH 06/76] WIP: Increase the Cookie duration --- .../resources/iam/apps/saml-discovery/discovery.component.js | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/saml-discovery/discovery.component.js b/iam-login-service/src/main/webapp/resources/iam/apps/saml-discovery/discovery.component.js index 07aa8a57a..8e7665c13 100644 --- a/iam-login-service/src/main/webapp/resources/iam/apps/saml-discovery/discovery.component.js +++ b/iam-login-service/src/main/webapp/resources/iam/apps/saml-discovery/discovery.component.js @@ -48,8 +48,11 @@ }; self.storeIdpChoice = function(){ + var today = new Date(); + var exp = today; + exp.setMonth(today.getMonth() + 12); if ($scope.rememberChoice === 'y'){ - $cookies.putObject(COOKIE_KEY, $scope.idpSelected); + $cookies.putObject(COOKIE_KEY, $scope.idpSelected, { expires: exp }); } }; From fb229df8ba6a6e4d48a4321ca154c9cd4f514f6e Mon Sep 17 00:00:00 2001 From: Andrea Ceccanti Date: Fri, 10 Sep 2021 19:14:47 +0200 Subject: [PATCH 07/76] Allow config option in test client app to avoid disclosing tokens --- .../java/it/infn/mw/tc/IamClientConfig.java | 10 +++ .../infn/mw/tc/IamTestClientApplication.java | 45 ++++++++-- .../it/infn/mw/tc/OpenIDAuthentication.java | 82 +++++++++++++------ .../src/main/resources/application.yml | 3 + .../src/main/resources/templates/index.html | 73 +++++++++++------ 5 files changed, 153 insertions(+), 60 deletions(-) diff --git a/iam-test-client/src/main/java/it/infn/mw/tc/IamClientConfig.java b/iam-test-client/src/main/java/it/infn/mw/tc/IamClientConfig.java index 542771cd0..8737f976b 100644 --- a/iam-test-client/src/main/java/it/infn/mw/tc/IamClientConfig.java +++ b/iam-test-client/src/main/java/it/infn/mw/tc/IamClientConfig.java @@ -31,6 +31,8 @@ public void setUseGridTrustAnchors(boolean useGridTrustAnchors) { String extAuthnHint; TlsConfig tls; + boolean hideTokens = true; + public IamClientConfig() { setTokenEndpointAuthMethod(AuthMethod.SECRET_BASIC); } @@ -54,4 +56,12 @@ public void setExtAuthnHint(String extAuthnHint) { public void setOrganizationName(String organizationName) { this.organizationName = organizationName; } + + public boolean isHideTokens() { + return hideTokens; + } + + public void setHideTokens(boolean hideTokens) { + this.hideTokens = hideTokens; + } } diff --git a/iam-test-client/src/main/java/it/infn/mw/tc/IamTestClientApplication.java b/iam-test-client/src/main/java/it/infn/mw/tc/IamTestClientApplication.java index 4df12526b..632fe20bf 100644 --- a/iam-test-client/src/main/java/it/infn/mw/tc/IamTestClientApplication.java +++ b/iam-test-client/src/main/java/it/infn/mw/tc/IamTestClientApplication.java @@ -2,6 +2,7 @@ import java.io.IOException; import java.security.Principal; +import java.text.ParseException; import java.util.Collections; import java.util.HashMap; import java.util.Map; @@ -53,6 +54,7 @@ import org.springframework.web.util.WebUtils; import com.google.common.base.Strings; +import com.nimbusds.jwt.JWTParser; @SpringBootApplication @EnableAutoConfiguration(exclude = {ErrorMvcAutoConfiguration.class}) @@ -69,7 +71,7 @@ public class IamTestClientApplication extends WebSecurityConfigurerAdapter { @Autowired ClientHttpRequestFactory requestFactory; - + @Value("${iam.extAuthnHint}") String extAuthnHint; @@ -89,15 +91,15 @@ public void commence(HttpServletRequest request, HttpServletResponse response, } } - - public class ExtAuthnRequestOptionsService implements AuthRequestOptionsService{ + + public class ExtAuthnRequestOptionsService implements AuthRequestOptionsService { final String authnHint; - + public ExtAuthnRequestOptionsService(String hint) { this.authnHint = hint; } - + @Override public Map getOptions(ServerConfiguration server, RegisteredClient client, HttpServletRequest request) { @@ -111,16 +113,16 @@ public Map getTokenOptions(ServerConfiguration server, Registere HttpServletRequest request) { return Collections.emptyMap(); } - + } @Override protected void configure(HttpSecurity http) throws Exception { - + if (!Strings.isNullOrEmpty(extAuthnHint)) { oidcFilter.setAuthRequestOptionsService(new ExtAuthnRequestOptionsService(extAuthnHint)); } - + // @formatter:off http.antMatcher("/**").authorizeRequests() .antMatchers("/", "/user", "/error", "/openid_connect_login**", "/webjars/**").permitAll() @@ -172,7 +174,32 @@ public OpenIDAuthentication info(Principal principal) { if (principal instanceof OIDCAuthenticationToken) { OIDCAuthenticationToken token = (OIDCAuthenticationToken) principal; - OpenIDAuthentication auth = new OpenIDAuthentication(token); + OpenIDAuthentication auth = new OpenIDAuthentication(); + + auth.setIssuer(token.getIssuer()); + auth.setSub(token.getSub()); + + if (!clientConfig.isHideTokens()) { + auth.setAccessToken(token.getAccessTokenValue()); + auth.setIdToken(token.getIdToken().getParsedString()); + auth.setRefreshToken(token.getRefreshTokenValue()); + } + + try { + auth.setAccessTokenClaims(JWTParser.parse(token.getAccessTokenValue()) + .getJWTClaimsSet() + .toJSONObject() + .toString()); + + auth.setIdTokenClaims(token.getIdToken().getJWTClaimsSet().toJSONObject().toString()); + } catch (ParseException e) { + LOG.error(e.getMessage(), e); + } + + auth.setName(token.getUserInfo().getName()); + auth.setFamilyName(token.getUserInfo().getFamilyName()); + auth.setUserInfo(token.getUserInfo().toJson().toString()); + return auth; } diff --git a/iam-test-client/src/main/java/it/infn/mw/tc/OpenIDAuthentication.java b/iam-test-client/src/main/java/it/infn/mw/tc/OpenIDAuthentication.java index ca2b0628b..b6dad36ca 100644 --- a/iam-test-client/src/main/java/it/infn/mw/tc/OpenIDAuthentication.java +++ b/iam-test-client/src/main/java/it/infn/mw/tc/OpenIDAuthentication.java @@ -1,35 +1,21 @@ package it.infn.mw.tc; -import org.mitre.openid.connect.model.OIDCAuthenticationToken; - public class OpenIDAuthentication { - String issuer; - String sub; - - String name; - String familyName; - - String accessToken; - String refreshToken; - String idToken; - - String userInfo; + private String issuer; + private String sub; - public OpenIDAuthentication(OIDCAuthenticationToken token) { - issuer = token.getIssuer(); - sub = token.getSub(); + private String name; + private String familyName; - accessToken = token.getAccessTokenValue(); - refreshToken = token.getRefreshTokenValue(); - idToken = token.getIdToken().getParsedString(); + private String accessToken; + private String refreshToken; + private String idToken; + private String idTokenClaims; - name = token.getUserInfo().getName(); - familyName = token.getUserInfo().getFamilyName(); - userInfo = token.getUserInfo().toJson().toString(); - - } + private String userInfo; + private String accessTokenClaims; public String getIssuer() { @@ -71,4 +57,52 @@ public String getFamilyName() { return familyName; } + public String getAccessTokenClaims() { + return accessTokenClaims; + } + + public void setIssuer(String issuer) { + this.issuer = issuer; + } + + public void setSub(String sub) { + this.sub = sub; + } + + public void setName(String name) { + this.name = name; + } + + public void setFamilyName(String familyName) { + this.familyName = familyName; + } + + public void setAccessToken(String accessToken) { + this.accessToken = accessToken; + } + + public void setRefreshToken(String refreshToken) { + this.refreshToken = refreshToken; + } + + public void setIdToken(String idToken) { + this.idToken = idToken; + } + + public void setUserInfo(String userInfo) { + this.userInfo = userInfo; + } + + public void setAccessTokenClaims(String accessTokenClaims) { + this.accessTokenClaims = accessTokenClaims; + } + + public String getIdTokenClaims() { + return idTokenClaims; + } + + public void setIdTokenClaims(String idTokenClaims) { + this.idTokenClaims = idTokenClaims; + } + } diff --git a/iam-test-client/src/main/resources/application.yml b/iam-test-client/src/main/resources/application.yml index 415367607..f3dd35714 100644 --- a/iam-test-client/src/main/resources/application.yml +++ b/iam-test-client/src/main/resources/application.yml @@ -9,10 +9,13 @@ server: use-forward-headers: ${IAM_CLIENT_USE_FORWARD_HEADERS:false} iam: + issuer: ${IAM_CLIENT_ISSUER:http://localhost:8080/} organizationName: ${IAM_CLIENT_ORGANIZATION_NAME:indigo-dc} extAuthnHint: ${IAM_CLIENT_EXT_AUTHN_HINT:} + hide-tokens: ${IAM_CLIENT_HIDE_TOKENS:false} + tls: version: ${IAM_CLIENT_TLS_VERSION:TLSv1.2} ignore-namespace-checks: ${IAM_CLIENT_TLS_IGNORE_NAMESPACE_CHECKS:false} diff --git a/iam-test-client/src/main/resources/templates/index.html b/iam-test-client/src/main/resources/templates/index.html index f79675b2f..23f4b7aeb 100644 --- a/iam-test-client/src/main/resources/templates/index.html +++ b/iam-test-client/src/main/resources/templates/index.html @@ -53,30 +53,44 @@

INDIGO IAM Test Client Application

The authorization request included the following scopes: 


     

+    

+    	This IAM test client application has been configured
+    	to not disclose access, id and refresh tokens. 
+    	
+    	Below you will only see the	claims contained in the tokens returned to the test client application.
+    	
+    	To get direct access to 
+    	tokens, consider registering a client application. 
+    

     
This application has received the following information:

     
    
-      
  • access_token (JWT):
+      
  • access_token (JWT):
         
    {{home.access_token_jwt}}
    
       
    • 
 
-      
  • access_token (decoded):
-        
    {{home.access_token | prettyJSON }}
    
+      
  • access_token (claims):
+        
    {{home.access_token_claims | prettyJSON }}
    
       
    • 
+      
       
  • OAuth2 token introspection endpoint response (invoked on access_token,
         authorized by client credentials):
         
    {{home.introspect_result | prettyJSON}}
    
       
    • 
-      
  • id_token (JWT):
+      
+      
  • id_token (JWT):
         
    {{home.id_token_jwt}}
    
       
    • 
-      
  • id_token (decoded):
-        
    {{home.id_token | prettyJSON }}
    
+      
+      
  • id_token (claims):
+        
    {{home.id_token_claims | prettyJSON }}
    
       
    • 
+      
       
  • OpenID-Connect user info endpoint response (authorized via access_token):
         
    {{home.user_info | prettyJSON }}
    
       
    • 
-      
  • refresh_token:
-        
    {{home.refresh_token}}
    
+      
+      
  • refresh_token:
+        
    {{home.refresh_token_jwt}}
    
       
    • 
     

 
@@ -103,46 +117,51 @@ 
INDIGO IAM Test Client Application

       })
       .controller("home", function ($http, $location, jwtHelper) {
         var self = this;
-        $http.get("/iam-test-client/user").success(function (data) {
+        $http.get("/iam-test-client/user").then(function (response) {
 
-          if (!$.trim(data)) {
+          if (!$.trim(response.data)) {
             self.authenticated = false;
             return;
           }
 
           self.authenticated = true;
 
-          self.user = data.name;
-          self.sub = data.sub;
-          self.issuer = data.issuer;
-          self.access_token_jwt = data.accessToken;
-          self.access_token = jwtHelper.decodeToken(data.accessToken);
-          self.id_token_jwt = data.idToken;
-          self.id_token = jwtHelper.decodeToken(data.idToken);
-          self.user_info = $.parseJSON(data.userInfo);
-
-          if (data.refreshToken) {
+          self.user = response.data.name;
+          self.sub = response.data.sub;
+          self.issuer = response.data.issuer;
+          
+          self.access_token_claims = $.parseJSON(response.data.accessTokenClaims);
+          
+          self.access_token_jwt = response.data.accessToken;
+          
+          self.id_token_claims = $.parseJSON(response.data.idTokenClaims);
+          
+          self.id_token_jwt = response.data.idToken;
+          
+          self.user_info = $.parseJSON(response.data.userInfo);
+
+          if (response.data.refreshToken) {
             self.has_refresh_token = true;
-            self.refresh_token = data.refreshToken;
+            self.refresh_token_jwt = response.data.refreshToken;
           }
 
-          $http.get("/iam-test-client/introspect").success(function (idata) {
+          $http.get("/iam-test-client/introspect").then(function (response) {
 
-            self.introspect_result = idata;
+            self.introspect_result = response.data;
             self.has_introspect_result = true;
 
-          }).error(function () {
+          }).catch(function () {
             self.has_introspect_result = false;
           });
-        }).error(function () {
+        }).catch(function () {
           self.user = "N/A";
           self.authenticated = false;
         });
         self.logout = function () {
-          $http.post('logout', {}).success(function () {
+          $http.post('logout', {}).then(function () {
             self.authenticated = false;
             $location.path("/");
-          }).error(function (data) {
+          }).catch(function (data) {
             console.log("Logout failed")
             self.authenticated = false;
           });

From 02ac0d2f6c3c5ba36666cd609f8db463393cc882 Mon Sep 17 00:00:00 2001
From: Andrea Ceccanti 
Date: Sat, 11 Sep 2021 08:59:48 +0200
Subject: [PATCH 08/76] Dynamic downscoping in test client app

The test client app has been modified to allow downscoping the
authorization request to only include a subset of the configured scopes.
---
 .../mw/tc/IamAuthRequestOptionsService.java   | 62 +++++++++++++++++++
 .../infn/mw/tc/IamAuthRequestUrlBuilder.java  | 62 +++++++++++++++++++
 .../main/java/it/infn/mw/tc/IamClient.java    |  9 ++-
 .../infn/mw/tc/IamTestClientApplication.java  | 39 ------------
 .../java/it/infn/mw/tc/LocalController.java   |  7 +++
 .../src/main/resources/application.yml        |  4 +-
 .../src/main/resources/templates/index.html   | 45 +++++++++-----
 7 files changed, 165 insertions(+), 63 deletions(-)
 create mode 100644 iam-test-client/src/main/java/it/infn/mw/tc/IamAuthRequestOptionsService.java
 create mode 100644 iam-test-client/src/main/java/it/infn/mw/tc/IamAuthRequestUrlBuilder.java

diff --git a/iam-test-client/src/main/java/it/infn/mw/tc/IamAuthRequestOptionsService.java b/iam-test-client/src/main/java/it/infn/mw/tc/IamAuthRequestOptionsService.java
new file mode 100644
index 000000000..2d3a50c64
--- /dev/null
+++ b/iam-test-client/src/main/java/it/infn/mw/tc/IamAuthRequestOptionsService.java
@@ -0,0 +1,62 @@
+package it.infn.mw.tc;
+
+import static com.google.common.base.Strings.isNullOrEmpty;
+import static java.util.stream.Collectors.joining;
+
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import javax.servlet.http.HttpServletRequest;
+
+import org.mitre.oauth2.model.RegisteredClient;
+import org.mitre.openid.connect.client.service.AuthRequestOptionsService;
+import org.mitre.openid.connect.config.ServerConfiguration;
+
+import com.google.common.base.Splitter;
+import com.google.common.base.Strings;
+
+public class IamAuthRequestOptionsService implements AuthRequestOptionsService {
+
+  IamClientConfig properties;
+
+
+  public IamAuthRequestOptionsService(IamClientConfig properties) {
+    this.properties = properties;
+  }
+
+  private String sanitizeScope(String scope, RegisteredClient client) {
+    List requestedScopes = Splitter.on(" ").splitToList(scope);
+    return requestedScopes.stream().filter(client.getScope()::contains).collect(joining(" "));
+  }
+
+  @Override
+  public Map getOptions(ServerConfiguration server, RegisteredClient client,
+      HttpServletRequest request) {
+    Map options = new HashMap<>();
+
+    if (!isNullOrEmpty(properties.getExtAuthnHint())) {
+      options.put("ext_authn_hint", properties.getExtAuthnHint());
+    }
+
+    if (request.getParameter("scope") != null) {
+      String sanitizedScope = sanitizeScope(request.getParameter("scope"), client);
+
+      if (!Strings.isNullOrEmpty(sanitizedScope)) {
+        options.put("scope", sanitizedScope);
+      }
+
+    }
+
+    return options;
+  }
+
+  @Override
+  public Map getTokenOptions(ServerConfiguration server, RegisteredClient client,
+      HttpServletRequest request) {
+
+    return Collections.emptyMap();
+  }
+
+}
diff --git a/iam-test-client/src/main/java/it/infn/mw/tc/IamAuthRequestUrlBuilder.java b/iam-test-client/src/main/java/it/infn/mw/tc/IamAuthRequestUrlBuilder.java
new file mode 100644
index 000000000..0bdf4e790
--- /dev/null
+++ b/iam-test-client/src/main/java/it/infn/mw/tc/IamAuthRequestUrlBuilder.java
@@ -0,0 +1,62 @@
+package it.infn.mw.tc;
+
+import java.net.URISyntaxException;
+import java.util.Map;
+import java.util.Map.Entry;
+
+import org.apache.http.client.utils.URIBuilder;
+import org.mitre.oauth2.model.RegisteredClient;
+import org.mitre.openid.connect.client.service.AuthRequestUrlBuilder;
+import org.mitre.openid.connect.config.ServerConfiguration;
+import org.springframework.security.authentication.AuthenticationServiceException;
+
+import com.google.common.base.Joiner;
+import com.google.common.base.Strings;
+
+public class IamAuthRequestUrlBuilder implements AuthRequestUrlBuilder {
+
+
+  @Override
+  public String buildAuthRequestUrl(ServerConfiguration serverConfig, RegisteredClient clientConfig,
+      String redirectUri, String nonce, String state, Map options,
+      String loginHint) {
+
+    try {
+
+      URIBuilder uriBuilder = new URIBuilder(serverConfig.getAuthorizationEndpointUri());
+      uriBuilder.addParameter("response_type", "code");
+      uriBuilder.addParameter("client_id", clientConfig.getClientId());
+
+      if (options.get("scope") != null) {
+        uriBuilder.addParameter("scope", options.get("scope"));
+      } else {
+        uriBuilder.addParameter("scope", Joiner.on(" ").join(clientConfig.getScope()));
+      }
+
+
+      uriBuilder.addParameter("redirect_uri", redirectUri);
+
+      uriBuilder.addParameter("nonce", nonce);
+
+      uriBuilder.addParameter("state", state);
+
+      // Optional parameters:
+      for (Entry option : options.entrySet()) {
+        uriBuilder.addParameter(option.getKey(), option.getValue());
+      }
+
+      // if there's a login hint, send it
+      if (!Strings.isNullOrEmpty(loginHint)) {
+        uriBuilder.addParameter("login_hint", loginHint);
+      }
+
+      return uriBuilder.build().toString();
+
+    } catch (URISyntaxException e) {
+      throw new AuthenticationServiceException("Malformed Authorization Endpoint Uri", e);
+
+    }
+
+  }
+
+}
diff --git a/iam-test-client/src/main/java/it/infn/mw/tc/IamClient.java b/iam-test-client/src/main/java/it/infn/mw/tc/IamClient.java
index f0283c84f..adf737dc1 100644
--- a/iam-test-client/src/main/java/it/infn/mw/tc/IamClient.java
+++ b/iam-test-client/src/main/java/it/infn/mw/tc/IamClient.java
@@ -25,9 +25,8 @@
 import org.mitre.oauth2.model.RegisteredClient;
 import org.mitre.openid.connect.client.OIDCAuthenticationFilter;
 import org.mitre.openid.connect.client.OIDCAuthenticationProvider;
+import org.mitre.openid.connect.client.service.AuthRequestOptionsService;
 import org.mitre.openid.connect.client.service.IssuerService;
-import org.mitre.openid.connect.client.service.impl.PlainAuthRequestUrlBuilder;
-import org.mitre.openid.connect.client.service.impl.StaticAuthRequestOptionsService;
 import org.mitre.openid.connect.client.service.impl.StaticClientConfigurationService;
 import org.mitre.openid.connect.client.service.impl.StaticSingleIssuerService;
 import org.springframework.beans.factory.annotation.Autowired;
@@ -72,7 +71,7 @@ public OIDCAuthenticationFilter openIdConnectAuthenticationFilter()
 
     filter.setClientConfigurationService(staticClientConfiguration());
     filter.setAuthRequestOptionsService(authOptions());
-    filter.setAuthRequestUrlBuilder(new PlainAuthRequestUrlBuilder());
+    filter.setAuthRequestUrlBuilder(new IamAuthRequestUrlBuilder());
     filter.setHttpRequestFactory(httpRequestFactory());
 
 
@@ -120,9 +119,9 @@ private StaticClientConfigurationService staticClientConfiguration() {
     return config;
   }
 
-  private StaticAuthRequestOptionsService authOptions() {
+  private AuthRequestOptionsService authOptions() {
 
-    return new StaticAuthRequestOptionsService();
+    return new IamAuthRequestOptionsService(iamClientConfig);
   }
 
   public X509CertChainValidatorExt certificateValidator() {
diff --git a/iam-test-client/src/main/java/it/infn/mw/tc/IamTestClientApplication.java b/iam-test-client/src/main/java/it/infn/mw/tc/IamTestClientApplication.java
index 632fe20bf..592f5a8d5 100644
--- a/iam-test-client/src/main/java/it/infn/mw/tc/IamTestClientApplication.java
+++ b/iam-test-client/src/main/java/it/infn/mw/tc/IamTestClientApplication.java
@@ -3,9 +3,6 @@
 import java.io.IOException;
 import java.security.Principal;
 import java.text.ParseException;
-import java.util.Collections;
-import java.util.HashMap;
-import java.util.Map;
 
 import javax.servlet.Filter;
 import javax.servlet.FilterChain;
@@ -14,15 +11,11 @@
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
-import org.mitre.oauth2.model.RegisteredClient;
 import org.mitre.openid.connect.client.OIDCAuthenticationFilter;
-import org.mitre.openid.connect.client.service.AuthRequestOptionsService;
-import org.mitre.openid.connect.config.ServerConfiguration;
 import org.mitre.openid.connect.model.OIDCAuthenticationToken;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.beans.factory.annotation.Value;
 import org.springframework.boot.SpringApplication;
 import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
@@ -53,7 +46,6 @@
 import org.springframework.web.filter.OncePerRequestFilter;
 import org.springframework.web.util.WebUtils;
 
-import com.google.common.base.Strings;
 import com.nimbusds.jwt.JWTParser;
 
 @SpringBootApplication
@@ -72,9 +64,6 @@ public class IamTestClientApplication extends WebSecurityConfigurerAdapter {
   @Autowired
   ClientHttpRequestFactory requestFactory;
 
-  @Value("${iam.extAuthnHint}")
-  String extAuthnHint;
-
   public static void main(String[] args) {
 
     SpringApplication.run(IamTestClientApplication.class, args);
@@ -92,37 +81,9 @@ public void commence(HttpServletRequest request, HttpServletResponse response,
 
   }
 
-  public class ExtAuthnRequestOptionsService implements AuthRequestOptionsService {
-
-    final String authnHint;
-
-    public ExtAuthnRequestOptionsService(String hint) {
-      this.authnHint = hint;
-    }
-
-    @Override
-    public Map getOptions(ServerConfiguration server, RegisteredClient client,
-        HttpServletRequest request) {
-      Map m = new HashMap<>();
-      m.put("ext_authn_hint", authnHint);
-      return m;
-    }
-
-    @Override
-    public Map getTokenOptions(ServerConfiguration server, RegisteredClient client,
-        HttpServletRequest request) {
-      return Collections.emptyMap();
-    }
-
-  }
 
   @Override
   protected void configure(HttpSecurity http) throws Exception {
-
-    if (!Strings.isNullOrEmpty(extAuthnHint)) {
-      oidcFilter.setAuthRequestOptionsService(new ExtAuthnRequestOptionsService(extAuthnHint));
-    }
-
     // @formatter:off
     http.antMatcher("/**").authorizeRequests()
         .antMatchers("/", "/user", "/error", "/openid_connect_login**", "/webjars/**").permitAll()
diff --git a/iam-test-client/src/main/java/it/infn/mw/tc/LocalController.java b/iam-test-client/src/main/java/it/infn/mw/tc/LocalController.java
index 1369ef213..7a8cc556f 100644
--- a/iam-test-client/src/main/java/it/infn/mw/tc/LocalController.java
+++ b/iam-test-client/src/main/java/it/infn/mw/tc/LocalController.java
@@ -1,7 +1,9 @@
 package it.infn.mw.tc;
 
 import java.util.stream.Collectors;
+
 import javax.servlet.http.HttpServletRequest;
+
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.autoconfigure.web.ErrorController;
 import org.springframework.http.client.ClientHttpRequestFactory;
@@ -35,6 +37,11 @@ public String organizationName() {
     return clientConfig.getOrganizationName();
   }
 
+  @ModelAttribute("hidesTokens")
+  public Boolean hidesTokens() {
+    return clientConfig.isHideTokens();
+  }
+
   @RequestMapping("/")
   public String index(Model model) {
     return "index";
diff --git a/iam-test-client/src/main/resources/application.yml b/iam-test-client/src/main/resources/application.yml
index f3dd35714..4446e9d31 100644
--- a/iam-test-client/src/main/resources/application.yml
+++ b/iam-test-client/src/main/resources/application.yml
@@ -14,12 +14,12 @@ iam:
     organizationName: ${IAM_CLIENT_ORGANIZATION_NAME:indigo-dc}
     extAuthnHint: ${IAM_CLIENT_EXT_AUTHN_HINT:}
     
-    hide-tokens: ${IAM_CLIENT_HIDE_TOKENS:false}
+    hide-tokens: ${IAM_CLIENT_HIDE_TOKENS:true}
     
     tls:
       version: ${IAM_CLIENT_TLS_VERSION:TLSv1.2}
       ignore-namespace-checks: ${IAM_CLIENT_TLS_IGNORE_NAMESPACE_CHECKS:false} 
-      use-grid-trust-anchors: ${IAM_CLIENT_TLS_USE_GRID_TRUST_ANCHORS:true}
+      use-grid-trust-anchors: ${IAM_CLIENT_TLS_USE_GRID_TRUST_ANCHORS:false}
       
     client:
       clientId: ${IAM_CLIENT_ID:client}
diff --git a/iam-test-client/src/main/resources/templates/index.html b/iam-test-client/src/main/resources/templates/index.html
index 23f4b7aeb..5fb482703 100644
--- a/iam-test-client/src/main/resources/templates/index.html
+++ b/iam-test-client/src/main/resources/templates/index.html
@@ -39,29 +39,35 @@ 
INDIGO IAM Test Client Application

     
This is an example OpenID Connect client application for IAM hosted at:
       

     

-    

-      The authorization request will include the following scopes:
-      

-    

-    

-      Login
-    

-  

-
-  

-    
You're now logged in as: {{home.user}}

-    
The authorization request included the following scopes:
-      

-    

-    

+    

     	This IAM test client application has been configured
     	to not disclose access, id and refresh tokens. 
     	
-    	Below you will only see the	claims contained in the tokens returned to the test client application.
+    	After a successful login you will only see the claims contained in the tokens returned to the test client application.
     	
     	To get direct access to 
     	tokens, consider registering a client application. 
     

+    

+    
+    

+    	
+    	
+    	

+    	  Select, among the above scopes, which ones will be included in the authorization request. Note
+      	  that an empty scope value will be replaced by the full list of allowed scopes.
+      	
			
+    

+    
+   	

+   	  
+    

+    
    
+  

+
+  

+    
You're now logged in as: {{home.user}}

+    
     
This application has received the following information:

     
    
       
  • access_token (JWT):
@@ -126,7 +132,12 @@ 
    INDIGO IAM Test Client Application
    
 
           self.authenticated = true;
 
-          self.user = response.data.name;
+          if (response.data.name) {
+        	  self.user = response.data.name;	  
+          } else {
+        	  self.user = response.data.sub;
+          }
+          
           self.sub = response.data.sub;
           self.issuer = response.data.issuer;
           

From a2dcabba765d9a3962d5dd9f4e834e519a4fb3cb Mon Sep 17 00:00:00 2001
From: Andrea Ceccanti 
Date: Sat, 11 Sep 2021 09:14:52 +0200
Subject: [PATCH 09/76] Bumped version to v1.7.1

---
 iam-common/pom.xml                  | 2 +-
 iam-login-service/pom.xml           | 2 +-
 iam-persistence/pom.xml             | 2 +-
 iam-test-client/pom.xml             | 2 +-
 iam-test-protected-resource/pom.xml | 2 +-
 pom.xml                             | 2 +-
 6 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/iam-common/pom.xml b/iam-common/pom.xml
index a5a954b45..2267dafed 100644
--- a/iam-common/pom.xml
+++ b/iam-common/pom.xml
@@ -7,7 +7,7 @@
   
     it.infn.mw
     iam-parent
-    1.8.0-SNAPSHOT
+    1.7.1
   
 
   iam-common
diff --git a/iam-login-service/pom.xml b/iam-login-service/pom.xml
index f2841fc2f..1e7ec0a69 100644
--- a/iam-login-service/pom.xml
+++ b/iam-login-service/pom.xml
@@ -23,7 +23,7 @@
   
     it.infn.mw
     iam-parent
-    1.8.0-SNAPSHOT
+    1.7.1
   
 
   iam-login-service
diff --git a/iam-persistence/pom.xml b/iam-persistence/pom.xml
index 439e1203e..531bdb68c 100644
--- a/iam-persistence/pom.xml
+++ b/iam-persistence/pom.xml
@@ -23,7 +23,7 @@
   
     it.infn.mw
     iam-parent
-    1.8.0-SNAPSHOT
+    1.7.1
   
   iam-persistence
   jar
diff --git a/iam-test-client/pom.xml b/iam-test-client/pom.xml
index dd80f512e..034aec75f 100644
--- a/iam-test-client/pom.xml
+++ b/iam-test-client/pom.xml
@@ -7,7 +7,7 @@
   
     it.infn.mw
     iam-parent
-    1.8.0-SNAPSHOT
+    1.7.1
   
 
   iam-test-client
diff --git a/iam-test-protected-resource/pom.xml b/iam-test-protected-resource/pom.xml
index 8ab09f877..2111d81dd 100644
--- a/iam-test-protected-resource/pom.xml
+++ b/iam-test-protected-resource/pom.xml
@@ -7,7 +7,7 @@
   
     it.infn.mw
     iam-parent
-    1.8.0-SNAPSHOT
+    1.7.1
   
 
   iam-test-protected-resource
diff --git a/pom.xml b/pom.xml
index 7bc64781c..688d9ff91 100644
--- a/pom.xml
+++ b/pom.xml
@@ -7,7 +7,7 @@
 
   it.infn.mw
   iam-parent
-  1.8.0-SNAPSHOT
+  1.7.1
   pom
   INDIGO Identity and Access Manager (IAM)
 

From 80b314088e0286dd43020f8a6b228f754b5784fc Mon Sep 17 00:00:00 2001
From: Andrea Ceccanti 
Date: Sat, 11 Sep 2021 12:43:35 +0200
Subject: [PATCH 10/76] v1.7.1 changelog

---
 CHANGELOG.md | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 40c437210..0c48ba42d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,20 @@
 # Changelog
 
+## 1.7.1 (2021-09-13)
+
+This release provides only changes and bug fixes to the IAM test client
+application.
+
+### Added
+
+- It's now possible to configure the test client application so that tokens 
+  are not exposed to those accessing the test client app page, but only the
+  claims contained in tokens are presented (#414)
+
+### Fixed
+
+- A problem that prevented the correct behaviour of the IAM test client has
+  been fixed (#415)
 
 ## 1.7.0 (2021-09-02)
 

From 855ee1edb8bf13a02bb299bf04d12f05e6ca2034 Mon Sep 17 00:00:00 2001
From: Andrea Ceccanti 
Date: Sat, 11 Sep 2021 15:44:34 +0200
Subject: [PATCH 11/76] More CHANGELOG tweaks

---
 CHANGELOG.md | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0c48ba42d..ea86043e4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,14 +2,14 @@
 
 ## 1.7.1 (2021-09-13)
 
-This release provides only changes and bug fixes to the IAM test client
-application.
+This release provides changes and bug fixes to the IAM test client application.
 
 ### Added
 
-- It's now possible to configure the test client application so that tokens 
-  are not exposed to those accessing the test client app page, but only the
-  claims contained in tokens are presented (#414)
+- The IAM test client application, in its default configuration, no longer
+  exposes tokens, but only the claims contained in tokens. It's possible to
+  revert to the previous behavior by setting the `IAM_CLIENT_HIDE_TOKENS=false`
+  environment variable (#414)
 
 ### Fixed
 

From 894304280007d0dc7bcb56077a6c2963f4a52271 Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Tue, 16 Nov 2021 16:57:03 +0000
Subject: [PATCH 12/76] Initial HTML and JS for enabling MFA on user account
 through dashboard

Files are not complete, work still to be done on creating and displaying the angular components
---
 .../user/mfa/user.mfa.component.html          |  22 ++++
 .../components/user/mfa/user.mfa.component.js |  57 +++++++++
 .../components/user/user.component.html       |   3 +
 .../templates/home/editmfasettings.html       | 121 ++++++++++++++++++
 .../home/enable-authenticator-app.html        |  74 +++++++++++
 iam-test-client/.factorypath                  |  82 ++++++++++++
 iam-test-protected-resource/.factorypath      |  66 ++++++++++
 7 files changed, 425 insertions(+)
 create mode 100644 iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/components/user/mfa/user.mfa.component.html
 create mode 100644 iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/components/user/mfa/user.mfa.component.js
 create mode 100644 iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/editmfasettings.html
 create mode 100644 iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/enable-authenticator-app.html
 create mode 100644 iam-test-client/.factorypath
 create mode 100644 iam-test-protected-resource/.factorypath

diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/components/user/mfa/user.mfa.component.html b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/components/user/mfa/user.mfa.component.html
new file mode 100644
index 000000000..84ae11cc8
--- /dev/null
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/components/user/mfa/user.mfa.component.html
@@ -0,0 +1,22 @@
+
+
+
\ No newline at end of file
diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/components/user/mfa/user.mfa.component.js b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/components/user/mfa/user.mfa.component.js
new file mode 100644
index 000000000..0c29758cd
--- /dev/null
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/components/user/mfa/user.mfa.component.js
@@ -0,0 +1,57 @@
+/*
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+(function() {
+  'use strict';
+
+  function UserMfaController(
+      toaster, Utils, ModalService, $uibModal) {
+    var self = this;
+
+    self.$onInit = function() {
+      console.log('UserMfaController onInit');
+      self.enabled = true;
+      self.user = self.userCtrl.user;
+    };
+
+    self.isMe = function() { return self.userCtrl.isMe(); };
+
+    self.openUserMfaModal = function() {
+      self.enabled = false;
+      var modalInstance = $uibModal.open({
+        templateUrl: '/resources/iam/apps/dashboard-app/templates/home/editmfasettings.html',
+        controller: 'UserMfaController',
+        controllerAs: 'userMfaCtrl',
+        resolve: {user: function() { return self.user; }}
+      });
+
+      modalInstance.result.then(function(msg) {
+        toaster.pop({type: 'success', body: msg});
+      });
+    };
+  }
+
+
+
+  angular.module('dashboardApp').component('userMfa', {
+    require: {userCtrl: '^user'},
+    templateUrl:
+        '/resources/iam/apps/dashboard-app/components/user/mfa/user.mfa.component.html',
+    controller: [
+      'toaster', 'Utils', 'ModalService', '$uibModal',
+      UserMfaController
+    ]
+  });
+})();
\ No newline at end of file
diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/components/user/user.component.html b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/components/user/user.component.html
index 2ee8052f1..c8fd6185e 100644
--- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/components/user/user.component.html
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/components/user/user.component.html
@@ -67,6 +67,9 @@ 
    
                         
                         
 
+                        
+                        
+
                     

                 

             
diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/editmfasettings.html b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/editmfasettings.html
new file mode 100644
index 000000000..945784aeb
--- /dev/null
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/editmfasettings.html
@@ -0,0 +1,121 @@
+
+

+
+    

+        
Edit multi-factor authentication settings for '{{userMfaCtrl.eUser.name.formatted}}'

+    

+
+    

+        
+
+        

+          
+          
+          
+            
+               Enabled
+            
+            
+            
+               Disabled
+            
+            
+          
+        

+
+        

+          
+          
+          
+            
+               Enabled
+            
+            
+            
+               Disabled
+            
+            
+          
+        

+
+        
+
+    

+
+    

+        
+    

+

diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/enable-authenticator-app.html b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/enable-authenticator-app.html
new file mode 100644
index 000000000..c69686b8b
--- /dev/null
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/enable-authenticator-app.html
@@ -0,0 +1,74 @@
+
+
+

+
+  

+    
Enable authenticator app

+  

+
+  

+    
+
+    
+    
Alternatively, enter this secret manually into the app.

+    
...

+
+    

+      

+        
+      

+      

+        
+        
+         This is a required field
+        Minimum length required is {{enableAuthenticatorAppCtrl.codeMinlength}}
+      

+    

+
+  

+    
+    
+    
+  

+
+
+
+
+

+    
+  

\ No newline at end of file
diff --git a/iam-test-client/.factorypath b/iam-test-client/.factorypath
new file mode 100644
index 000000000..f3186a492
--- /dev/null
+++ b/iam-test-client/.factorypath
@@ -0,0 +1,82 @@
+
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+
diff --git a/iam-test-protected-resource/.factorypath b/iam-test-protected-resource/.factorypath
new file mode 100644
index 000000000..b7d292531
--- /dev/null
+++ b/iam-test-protected-resource/.factorypath
@@ -0,0 +1,66 @@
+
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+

From 900662c8c1679ee812602298fab8c47384d17fcb Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Thu, 18 Nov 2021 13:29:41 +0000
Subject: [PATCH 13/76] Button and modal for editing MFA settings now appears

---
 .../webapp/WEB-INF/views/iam/dashboard.jsp    |   3 +
 .../user/mfa/user.mfa.component.html          |   8 +-
 .../components/user/mfa/user.mfa.component.js |   7 +-
 .../controllers/user-mfa.controller.js        | 112 ++++++++++++++++++
 .../services/load-templates.service.js        |   1 +
 .../templates/home/editmfasettings.html       |  20 ++--
 6 files changed, 136 insertions(+), 15 deletions(-)
 create mode 100644 iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/user-mfa.controller.js

diff --git a/iam-login-service/src/main/webapp/WEB-INF/views/iam/dashboard.jsp b/iam-login-service/src/main/webapp/WEB-INF/views/iam/dashboard.jsp
index 746c26eb3..bdcdbd69f 100644
--- a/iam-login-service/src/main/webapp/WEB-INF/views/iam/dashboard.jsp
+++ b/iam-login-service/src/main/webapp/WEB-INF/views/iam/dashboard.jsp
@@ -110,6 +110,7 @@
   
   
   
+  
 
   
   
@@ -125,6 +126,8 @@
   
   
   
+  
   
   
   
   
+  
   
 
   
diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/enable-authenticator-app.controller.js b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/enable-authenticator-app.controller.js
new file mode 100644
index 000000000..b4ca83bd5
--- /dev/null
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/enable-authenticator-app.controller.js
@@ -0,0 +1,85 @@
+/*
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+  'use strict';
+
+  angular.module('dashboardApp')
+      .controller('EnableAuthenticatorAppController', EnableAuthenticatorAppController);
+
+  EnableAuthenticatorAppController.$inject = [
+    '$scope', '$state', '$uibModalInstance', 'Utils', 'user'
+  ];
+
+  function EnableAuthenticatorAppController(
+      $scope, $state, $uibModalInstance, Utils, user) {
+    var enableAuthAppCtrl = this;
+
+    enableAuthAppCtrl.userToEdit = user;
+    enableAuthAppCtrl.codeMinlength = 6;
+
+    enableAuthAppCtrl.dismiss = dismiss;
+    enableAuthAppCtrl.reset = reset;
+
+    function reset() {
+      console.log('reset form');
+
+      enableAuthAppCtrl.enabled = true;
+
+      enableAuthAppCtrl.user = {
+        code: ''
+      };
+
+      if ($scope.userMfaForm) {
+        $scope.userMfaForm.$setPristine();
+      }
+    }
+
+    enableAuthAppCtrl.reset();
+
+    function dismiss() { return $uibModalInstance.dismiss('Cancel'); }
+
+    enableAuthAppCtrl.message = '';
+
+    enableAuthAppCtrl.submit = function() {
+      return $uibModalInstance.close('Updated settings');
+      // ResetPasswordService
+      //     .updatePassword(
+      //         userMfaCtrl.user.currentPassword,
+      //         userMfaCtrl.user.password)
+      //     .then(function() { return $uibModalInstance.close('Password updated'); })
+      //     .catch(function(error) {
+      //       console.error(error);
+      //       $scope.operationResult = Utils.buildErrorResult(error.data);
+      //     });
+    };
+  }
+
+//   var compareTo = function() {
+//     return {
+//       require: 'ngModel',
+//       scope: {otherModelValue: '=compareTo'},
+//       link: function(scope, element, attributes, ngModel) {
+
+//         ngModel.$validators.compareTo = function(modelValue) {
+//           return modelValue == scope.otherModelValue;
+//         };
+
+//         scope.$watch('otherModelValue', function() { ngModel.$validate(); });
+//       }
+//     };
+//   };
+
+//   angular.module('dashboardApp').directive('compareTo', compareTo);
+// })();
\ No newline at end of file
diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/user-mfa.controller.js b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/user-mfa.controller.js
index 1caa669a8..0331263f5 100644
--- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/user-mfa.controller.js
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/user-mfa.controller.js
@@ -19,11 +19,11 @@
       .controller('UserMfaController', UserMfaController);
 
   UserMfaController.$inject = [
-    '$scope', '$state', '$uibModalInstance', 'Utils', 'user'
+    '$scope', '$state', '$uibModalInstance', 'Utils', 'user', '$uibModal'
   ];
 
   function UserMfaController(
-      $scope, $state, $uibModalInstance, Utils, user) {
+      $scope, $state, $uibModalInstance, Utils, user, $uibModal) {
     var userMfaCtrl = this;
 
     userMfaCtrl.$onInit = function() {
@@ -32,14 +32,24 @@
 
     userMfaCtrl.userToEdit = user;
     
-    userMfaCtrl.authenticatorAppActive = true;
+    userMfaCtrl.authenticatorAppActive = false;
+    userMfaCtrl.yubiKeyActive = false;
     userMfaCtrl.enableAuthenticatorApp = enableAuthenticatorApp;
     userMfaCtrl.disableAuthenticatorApp = disableAuthenticatorApp;
     userMfaCtrl.enableYubiKey = enableYubiKey;
     userMfaCtrl.disableYubiKey = disableYubiKey;
 
     function enableAuthenticatorApp() {
-      return true;
+      var modalInstance = $uibModal.open({
+        templateUrl: '/resources/iam/apps/dashboard-app/templates/home/enable-authenticator-app.html',
+        controller: 'EnableAuthenticatorAppController',
+        controllerAs: 'enableAuthAppCtrl',
+        resolve: {user: function() { return self.user; }}
+      });
+
+      modalInstance.result.then(function(msg) {
+        toaster.pop({type: 'success', body: msg});
+      });
     }
 
     function disableAuthenticatorApp() {
@@ -62,12 +72,6 @@
 
       userMfaCtrl.enabled = true;
 
-      userMfaCtrl.user = {
-        currentPassword: '',
-        password: '',
-        confirmPassword: ''
-      };
-
       if ($scope.userMfaForm) {
         $scope.userMfaForm.$setPristine();
       }
diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/services/load-templates.service.js b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/services/load-templates.service.js
index f233f5e71..06ea75363 100644
--- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/services/load-templates.service.js
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/services/load-templates.service.js
@@ -29,6 +29,7 @@
         '/resources/iam/apps/dashboard-app/templates/home/editmfasettings.html',
         '/resources/iam/apps/dashboard-app/templates/home/editpassword.html',
         '/resources/iam/apps/dashboard-app/templates/home/edituser.html',
+        '/resources/iam/apps/dashboard-app/templates/home/enable-authenticator-app.html',
         '/resources/iam/apps/dashboard-app/templates/home/home.html',
         '/resources/iam/apps/dashboard-app/templates/loading-modal.html',
         '/resources/iam/apps/dashboard-app/templates/nav.html',
diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/editmfasettings.html b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/editmfasettings.html
index c848029e0..adab11553 100644
--- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/editmfasettings.html
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/editmfasettings.html
@@ -33,10 +33,10 @@ 
Edit multi-factor authentication settings for {{userMfaC
                Enabled
             
             
-            
+            
                Disabled
             
-            
+            
           
         

 
@@ -49,10 +49,10 @@ 
Edit multi-factor authentication settings for {{userMfaC
                Enabled
             
             
-            
+            
                Disabled
             
-            
+            
           
         
 
diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/enable-authenticator-app.html b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/enable-authenticator-app.html
index c69686b8b..9974c920d 100644
--- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/enable-authenticator-app.html
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/enable-authenticator-app.html
@@ -16,7 +16,7 @@
 
 -->
 
-

+
 
   

     
Enable authenticator app

@@ -25,6 +25,7 @@ 
Enable authenticator app

   

     
 
+    
Scan the QR code through your authenticator app and input a TOTP to validate configuration.

     
     
Alternatively, enter this secret manually into the app.

     
...

@@ -34,41 +35,17 @@ 
Enable authenticator app

         
       

       

-        
+        
         
          This is a required field
-        Minimum length required is {{enableAuthenticatorAppCtrl.codeMinlength}}
+        Minimum length required is {{enableAuthAppCtrl.codeMinlength}}
       

     

 
   

     
-    
-    
+    
+    
   

 
-

-
-
-

-    
-  

\ No newline at end of file
+
\ No newline at end of file

From 474b287e97310027448df6f3873acdcf5e4267f1 Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Fri, 19 Nov 2021 12:34:23 +0000
Subject: [PATCH 15/76] Adding models for IamTotpMfa and IamTotpRecoveryCode

Also adding Maven dependency for TOTP library
---
 .../mw/iam/persistence/model/IamAccount.java  |  23 +++
 .../mw/iam/persistence/model/IamTotpMfa.java  | 144 ++++++++++++++++++
 .../model/IamTotpRecoveryCode.java            | 111 ++++++++++++++
 pom.xml                                       |   7 +
 4 files changed, 285 insertions(+)
 create mode 100644 iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpMfa.java
 create mode 100644 iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpRecoveryCode.java

diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAccount.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAccount.java
index bc6304907..46a9071c8 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAccount.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAccount.java
@@ -92,6 +92,13 @@ public class IamAccount implements Serializable {
   @JoinColumn(name = "user_info_id")
   private IamUserInfo userInfo;
 
+  @Column(name = "mfa_enabled", nullable = false)
+  private boolean mfaEnabled;
+
+  @OneToOne(cascade = CascadeType.ALL, mappedBy = "account")
+  @JoinColumn(name = "iam_totp_mfa", referencedColumnName = "id", nullable = true)
+  private IamTotpMfa totpMfa;
+
   @Temporal(TemporalType.TIMESTAMP)
   @Column(name = "last_login_time", nullable = true)
   private Date lastLoginTime;
@@ -245,6 +252,22 @@ public void setActive(final boolean active) {
     this.active = active;
   }
 
+  public boolean isMfaEnabled() {
+    return mfaEnabled;
+  }
+
+  public void setMfaEnabled(final boolean mfaEnabled) {
+    this.mfaEnabled = mfaEnabled;
+  }
+
+  public IamTotpMfa getTotpMfa() {
+    return totpMfa;
+  }
+
+  public void setTotpMfa(final IamTotpMfa totpMfa) {
+    this.totpMfa = totpMfa;
+  }
+
   public Set getSamlIds() {
 
     return samlIds;
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpMfa.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpMfa.java
new file mode 100644
index 000000000..45e303c64
--- /dev/null
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpMfa.java
@@ -0,0 +1,144 @@
+package it.infn.mw.iam.persistence.model;
+
+import java.io.Serializable;
+import java.util.Date;
+import java.util.HashSet;
+import java.util.Set;
+
+import javax.persistence.CascadeType;
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.FetchType;
+import javax.persistence.GeneratedValue;
+import javax.persistence.GenerationType;
+import javax.persistence.Id;
+import javax.persistence.OneToMany;
+import javax.persistence.OneToOne;
+import javax.persistence.Table;
+import javax.persistence.Temporal;
+import javax.persistence.TemporalType;
+
+@Entity
+@Table(name = "mfa")
+public class IamTotpMfa implements Serializable {
+  @Id
+  @GeneratedValue(strategy = GenerationType.IDENTITY)
+  private Long id;
+
+  @OneToOne(mappedBy = "totpMfa")
+  private IamAccount account;
+
+  @Column(name = "secret")
+  private String secret;
+
+  @Temporal(TemporalType.TIMESTAMP)
+  @Column(name = "creationtime", nullable = false)
+  private Date creationTime;
+
+  @Temporal(TemporalType.TIMESTAMP)
+  @Column(name = "lastupdatetime", nullable = false)
+  private Date lastUpdateTime;
+
+  @Column(name = "active", nullable = false)
+  private boolean active;
+
+  // TODO do we need a UUID?
+
+  @OneToMany(mappedBy = "totpMfa", cascade = CascadeType.ALL, fetch = FetchType.EAGER,
+      orphanRemoval = true)
+  private Set recoveryCodes = new HashSet<>();
+
+  public IamTotpMfa(String secret) {
+    this.secret = secret;
+  }
+
+  public Long getId() {
+    return id;
+  }
+
+  public void setId(Long id) {
+    this.id = id;
+  }
+
+  public IamAccount getAccount() {
+    return account;
+  }
+
+  public void setAccount(final IamAccount account) {
+    this.account = account;
+  }
+
+  public String getSecret() {
+    return secret;
+  }
+
+  public void setSecret(final String secret) {
+    this.secret = secret;
+  }
+
+  public Date getCreationTime() {
+
+    return creationTime;
+  }
+
+  public void setCreationTime(final Date creationTime) {
+
+    this.creationTime = creationTime;
+  }
+
+  public Date getLastUpdateTime() {
+
+    return lastUpdateTime;
+  }
+
+  public void setLastUpdateTime(final Date lastUpdateTime) {
+
+    this.lastUpdateTime = lastUpdateTime;
+  }
+
+  public boolean isActive() {
+
+    return active;
+  }
+
+  public void setActive(final boolean active) {
+
+    this.active = active;
+  }
+
+  public Set getRecoveryCodes() {
+    return recoveryCodes;
+  }
+
+  public void setRecoveryCodes(final Set recoveryCodes) {
+    if (this.recoveryCodes.isEmpty()) {
+      this.recoveryCodes = recoveryCodes;
+    } else {
+      this.recoveryCodes.clear();
+      this.recoveryCodes.addAll(recoveryCodes);
+    }
+  }
+
+  @Override
+  public String toString() {
+    return "IamAccount [id=" + id + ", secret=" + secret + ", active=" + active + "]";
+  }
+
+  @Override
+  public boolean equals(final Object obj) {
+
+    if (this == obj)
+      return true;
+    if (obj == null)
+      return false;
+    if (getClass() != obj.getClass())
+      return false;
+    IamTotpMfa other = (IamTotpMfa) obj;
+    if (secret == null) {
+      if (other.secret != null)
+        return false;
+    } else if (!secret.equals(other.secret))
+      return false;
+    return true;
+  }
+}
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpRecoveryCode.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpRecoveryCode.java
new file mode 100644
index 000000000..f2c2ecb1f
--- /dev/null
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpRecoveryCode.java
@@ -0,0 +1,111 @@
+package it.infn.mw.iam.persistence.model;
+
+import java.io.Serializable;
+import java.util.Date;
+
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.FetchType;
+import javax.persistence.GeneratedValue;
+import javax.persistence.GenerationType;
+import javax.persistence.Id;
+import javax.persistence.JoinColumn;
+import javax.persistence.ManyToOne;
+import javax.persistence.Table;
+import javax.persistence.Temporal;
+import javax.persistence.TemporalType;
+
+@Entity
+@Table(name = "iam_totp_recovery_code")
+public class IamTotpRecoveryCode implements Serializable {
+
+  @Id
+  @GeneratedValue(strategy = GenerationType.IDENTITY)
+  private Long id;
+
+  @Column(name = "code")
+  private String code;
+
+  @ManyToOne(fetch = FetchType.EAGER)
+  @JoinColumn(name = "iam_totp_mfa", referencedColumnName = "id", nullable = false)
+  private IamTotpMfa totpMfa;
+
+  @Temporal(TemporalType.TIMESTAMP)
+  @Column(name = "creationtime", nullable = false)
+  private Date creationTime;
+
+  @Temporal(TemporalType.TIMESTAMP)
+  @Column(name = "lastupdatetime", nullable = false)
+  private Date lastUpdateTime;
+
+  public IamTotpRecoveryCode(String code) {
+    this.code = code;
+  }
+
+  public Long getId() {
+    return id;
+  }
+
+  public void setId(Long id) {
+    this.id = id;
+  }
+
+  public IamTotpMfa getTotpMfa() {
+    return totpMfa;
+  }
+
+  public void setTotpMfa(final IamTotpMfa totpMfa) {
+    this.totpMfa = totpMfa;
+  }
+
+  public String getCode() {
+    return code;
+  }
+
+  public void setCode(final String code) {
+    this.code = code;
+  }
+
+  public Date getCreationTime() {
+
+    return creationTime;
+  }
+
+  public void setCreationTime(final Date creationTime) {
+
+    this.creationTime = creationTime;
+  }
+
+  public Date getLastUpdateTime() {
+
+    return lastUpdateTime;
+  }
+
+  public void setLastUpdateTime(final Date lastUpdateTime) {
+
+    this.lastUpdateTime = lastUpdateTime;
+  }
+
+  @Override
+  public String toString() {
+    return "IamAccount [id=" + id + ", code=" + code + "]";
+  }
+
+  @Override
+  public boolean equals(final Object obj) {
+
+    if (this == obj)
+      return true;
+    if (obj == null)
+      return false;
+    if (getClass() != obj.getClass())
+      return false;
+    IamTotpRecoveryCode other = (IamTotpRecoveryCode) obj;
+    if (code == null) {
+      if (other.code != null)
+        return false;
+    } else if (!code.equals(other.code))
+      return false;
+    return true;
+  }
+}
diff --git a/pom.xml b/pom.xml
index 688d9ff91..e79deb640 100644
--- a/pom.xml
+++ b/pom.xml
@@ -237,6 +237,13 @@
         ${jaxb-runtime.version}
       
 
+      
+      
+        dev.samstevens.totp
+        totp
+        1.7.1
+		  
+
     
 
   

From c7dd5bea8ccfaf3b009c350eeb1e2216e319d280 Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Fri, 19 Nov 2021 17:51:39 +0000
Subject: [PATCH 16/76] Adding modal for disabling authenticator app

Also slight amendments to model logic for IamTotpMfa and IamTotpRecoveryCode
---
 .../webapp/WEB-INF/views/iam/dashboard.jsp    |  1 +
 .../disable-authenticator-app.controller.js   | 85 +++++++++++++++++++
 .../controllers/user-mfa.controller.js        | 12 ++-
 .../services/load-templates.service.js        |  1 +
 .../home/disable-authenticator-app.html       | 50 +++++++++++
 .../templates/home/editmfasettings.html       | 18 +++-
 .../mw/iam/persistence/model/IamTotpMfa.java  |  8 +-
 .../model/IamTotpRecoveryCode.java            |  6 +-
 8 files changed, 174 insertions(+), 7 deletions(-)
 create mode 100644 iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/disable-authenticator-app.controller.js
 create mode 100644 iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/disable-authenticator-app.html

diff --git a/iam-login-service/src/main/webapp/WEB-INF/views/iam/dashboard.jsp b/iam-login-service/src/main/webapp/WEB-INF/views/iam/dashboard.jsp
index 1f03ecf53..b5cf9df17 100644
--- a/iam-login-service/src/main/webapp/WEB-INF/views/iam/dashboard.jsp
+++ b/iam-login-service/src/main/webapp/WEB-INF/views/iam/dashboard.jsp
@@ -109,6 +109,7 @@
   
   
   
+  
   
   
   
diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/disable-authenticator-app.controller.js b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/disable-authenticator-app.controller.js
new file mode 100644
index 000000000..39ed38ce3
--- /dev/null
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/disable-authenticator-app.controller.js
@@ -0,0 +1,85 @@
+/*
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+  'use strict';
+
+  angular.module('dashboardApp')
+      .controller('DisableAuthenticatorAppController', DisableAuthenticatorAppController);
+
+  DisableAuthenticatorAppController.$inject = [
+    '$scope', '$state', '$uibModalInstance', 'Utils', 'user'
+  ];
+
+  function DisableAuthenticatorAppController(
+      $scope, $state, $uibModalInstance, Utils, user) {
+    var disableAuthAppCtrl = this;
+
+    disableAuthAppCtrl.userToEdit = user;
+    disableAuthAppCtrl.codeMinlength = 6;
+
+    disableAuthAppCtrl.dismiss = dismiss;
+    disableAuthAppCtrl.reset = reset;
+
+    function reset() {
+      console.log('reset form');
+
+      disableAuthAppCtrl.disabled = true;
+
+      disableAuthAppCtrl.user = {
+        code: ''
+      };
+
+      if ($scope.userMfaForm) {
+        $scope.userMfaForm.$setPristine();
+      }
+    }
+
+    disableAuthAppCtrl.reset();
+
+    function dismiss() { return $uibModalInstance.dismiss('Cancel'); }
+
+    disableAuthAppCtrl.message = '';
+
+    disableAuthAppCtrl.submit = function() {
+      return $uibModalInstance.close('Updated settings');
+      // ResetPasswordService
+      //     .updatePassword(
+      //         userMfaCtrl.user.currentPassword,
+      //         userMfaCtrl.user.password)
+      //     .then(function() { return $uibModalInstance.close('Password updated'); })
+      //     .catch(function(error) {
+      //       console.error(error);
+      //       $scope.operationResult = Utils.buildErrorResult(error.data);
+      //     });
+    };
+  }
+
+//   var compareTo = function() {
+//     return {
+//       require: 'ngModel',
+//       scope: {otherModelValue: '=compareTo'},
+//       link: function(scope, element, attributes, ngModel) {
+
+//         ngModel.$validators.compareTo = function(modelValue) {
+//           return modelValue == scope.otherModelValue;
+//         };
+
+//         scope.$watch('otherModelValue', function() { ngModel.$validate(); });
+//       }
+//     };
+//   };
+
+//   angular.module('dashboardApp').directive('compareTo', compareTo);
+// })();
\ No newline at end of file
diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/user-mfa.controller.js b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/user-mfa.controller.js
index 0331263f5..6182cca9e 100644
--- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/user-mfa.controller.js
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/user-mfa.controller.js
@@ -34,6 +34,7 @@
     
     userMfaCtrl.authenticatorAppActive = false;
     userMfaCtrl.yubiKeyActive = false;
+    userMfaCtrl.authenticatorApp2Active = true;
     userMfaCtrl.enableAuthenticatorApp = enableAuthenticatorApp;
     userMfaCtrl.disableAuthenticatorApp = disableAuthenticatorApp;
     userMfaCtrl.enableYubiKey = enableYubiKey;
@@ -53,7 +54,16 @@
     }
 
     function disableAuthenticatorApp() {
-      return true;
+      var modalInstance = $uibModal.open({
+        templateUrl: '/resources/iam/apps/dashboard-app/templates/home/disable-authenticator-app.html',
+        controller: 'DisableAuthenticatorAppController',
+        controllerAs: 'disableAuthAppCtrl',
+        resolve: {user: function() { return self.user; }}
+      });
+
+      modalInstance.result.then(function(msg) {
+        toaster.pop({type: 'success', body: msg});
+      });
     }
 
     function enableYubiKey() {
diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/services/load-templates.service.js b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/services/load-templates.service.js
index 06ea75363..efbb902ca 100644
--- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/services/load-templates.service.js
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/services/load-templates.service.js
@@ -26,6 +26,7 @@
         '/resources/iam/apps/dashboard-app/templates/common/userinfo-box.html',
         '/resources/iam/apps/dashboard-app/templates/header.html',
         '/resources/iam/apps/dashboard-app/templates/home/account-link-dialog.html',
+        '/resources/iam/apps/dashboard-app/templates/home/disable-authenticator-app.html',
         '/resources/iam/apps/dashboard-app/templates/home/editmfasettings.html',
         '/resources/iam/apps/dashboard-app/templates/home/editpassword.html',
         '/resources/iam/apps/dashboard-app/templates/home/edituser.html',
diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/disable-authenticator-app.html b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/disable-authenticator-app.html
new file mode 100644
index 000000000..0b143fa7a
--- /dev/null
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/disable-authenticator-app.html
@@ -0,0 +1,50 @@
+
+
+

+
+  

+    
Disable MFA through authenticator app

+  

+
+  

+    
+
+    
This action disables multi-factor authentication on this account through your selected authentication app.

+    
This could leave your account vulnerable and may restrict access to some IAM services.

+    
To continue, please enter a code from your authenticator app.

+
+    

+      

+        
+      

+      

+        
+        
+         This is a required field
+        Minimum length required is {{disableAuthAppCtrl.codeMinlength}}
+      

+    

+
+  

+    
+    
+    
+  

+
+
\ No newline at end of file
diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/editmfasettings.html b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/editmfasettings.html
index adab11553..3ef7d8901 100644
--- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/editmfasettings.html
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/editmfasettings.html
@@ -25,7 +25,7 @@ 
Edit multi-factor authentication settings for {{userMfaC
         
 
         

-          
+          
           
           
             
@@ -40,6 +40,22 @@ 
Edit multi-factor authentication settings for {{userMfaC
           
         

 
+        

+          
+          
+          
+            
+            
+               Enabled
+            
+            
+            
+               Disabled
+            
+            
+          
+        

+
         

           
           
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpMfa.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpMfa.java
index 45e303c64..0a4dce404 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpMfa.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpMfa.java
@@ -19,13 +19,13 @@
 import javax.persistence.TemporalType;
 
 @Entity
-@Table(name = "mfa")
+@Table(name = "iam_totp_mfa")
 public class IamTotpMfa implements Serializable {
   @Id
   @GeneratedValue(strategy = GenerationType.IDENTITY)
   private Long id;
 
-  @OneToOne(mappedBy = "totpMfa")
+  @OneToOne()
   private IamAccount account;
 
   @Column(name = "secret")
@@ -44,10 +44,12 @@ public class IamTotpMfa implements Serializable {
 
   // TODO do we need a UUID?
 
-  @OneToMany(mappedBy = "totpMfa", cascade = CascadeType.ALL, fetch = FetchType.EAGER,
+  @OneToMany(mappedBy = "totpMfa", cascade = CascadeType.ALL, fetch = FetchType.LAZY,
       orphanRemoval = true)
   private Set recoveryCodes = new HashSet<>();
 
+  public IamTotpMfa() {}
+
   public IamTotpMfa(String secret) {
     this.secret = secret;
   }
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpRecoveryCode.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpRecoveryCode.java
index f2c2ecb1f..5688562e3 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpRecoveryCode.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpRecoveryCode.java
@@ -26,8 +26,8 @@ public class IamTotpRecoveryCode implements Serializable {
   @Column(name = "code")
   private String code;
 
-  @ManyToOne(fetch = FetchType.EAGER)
-  @JoinColumn(name = "iam_totp_mfa", referencedColumnName = "id", nullable = false)
+  @ManyToOne(fetch = FetchType.LAZY)
+  @JoinColumn(referencedColumnName = "id", nullable = false)
   private IamTotpMfa totpMfa;
 
   @Temporal(TemporalType.TIMESTAMP)
@@ -38,6 +38,8 @@ public class IamTotpRecoveryCode implements Serializable {
   @Column(name = "lastupdatetime", nullable = false)
   private Date lastUpdateTime;
 
+  public IamTotpRecoveryCode() {}
+
   public IamTotpRecoveryCode(String code) {
     this.code = code;
   }

From d77143bf38575c62eac86477212e55bdc3f9c295 Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Mon, 22 Nov 2021 14:42:02 +0000
Subject: [PATCH 17/76] Unifying controllers, adding auth app service

Previously, a separate controller existed for enabling and disabling the authenticator app. Since these do similar things, they are being unified into one controller.

Also creating a service for enabling and disabling auth app. This currently contains two functions (enabling and disabling) but both are extremely similar so will likely unify later. Added a TODO for this to create the foundations of step up authentication from this
---
 .../webapp/WEB-INF/views/iam/dashboard.jsp    |  4 +-
 .../authenticator-app.controller.js           | 95 +++++++++++++++++++
 .../disable-authenticator-app.controller.js   | 85 -----------------
 .../enable-authenticator-app.controller.js    | 85 -----------------
 .../controllers/user-mfa.controller.js        |  8 +-
 .../services/authenticator-app.service.js     | 75 +++++++++++++++
 .../home/disable-authenticator-app.html       | 20 ++--
 .../home/enable-authenticator-app.html        | 20 ++--
 .../mw/iam/persistence/model/IamTotpMfa.java  | 17 +++-
 .../model/IamTotpRecoveryCode.java            | 17 +++-
 10 files changed, 228 insertions(+), 198 deletions(-)
 create mode 100644 iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/authenticator-app.controller.js
 delete mode 100644 iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/disable-authenticator-app.controller.js
 delete mode 100644 iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/enable-authenticator-app.controller.js
 create mode 100644 iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/services/authenticator-app.service.js

diff --git a/iam-login-service/src/main/webapp/WEB-INF/views/iam/dashboard.jsp b/iam-login-service/src/main/webapp/WEB-INF/views/iam/dashboard.jsp
index b5cf9df17..3d336a4e7 100644
--- a/iam-login-service/src/main/webapp/WEB-INF/views/iam/dashboard.jsp
+++ b/iam-login-service/src/main/webapp/WEB-INF/views/iam/dashboard.jsp
@@ -106,12 +106,12 @@
   
   
   
+  
   
+  
   
   
-  
   
-  
   
 
   
diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/authenticator-app.controller.js b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/authenticator-app.controller.js
new file mode 100644
index 000000000..edf3f6039
--- /dev/null
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/authenticator-app.controller.js
@@ -0,0 +1,95 @@
+/*
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+(function() {
+  'use strict';
+
+  angular.module('dashboardApp')
+      .controller('AuthenticatorAppController', AuthenticatorAppController);
+
+  AuthenticatorAppController.$inject = [
+    '$scope', '$state', '$uibModalInstance', 'Utils', 'AuthenticatorAppService', 'user'
+  ];
+
+  function AuthenticatorAppController(
+      $scope, $state, $uibModalInstance, Utils, AuthenticatorAppService, user) {
+    var authAppCtrl = this;
+
+    authAppCtrl.userToEdit = user;
+    authAppCtrl.codeMinlength = 6;
+
+    authAppCtrl.dismiss = dismiss;
+    authAppCtrl.reset = reset;
+
+    function reset() {
+      console.log('reset form');
+
+      authAppCtrl.enabled = true;
+
+      authAppCtrl.user = {
+        code: ''
+      };
+
+      if ($scope.userMfaForm) {
+        $scope.userMfaForm.$setPristine();
+      }
+    }
+
+    authAppCtrl.reset();
+
+    function dismiss() { return $uibModalInstance.dismiss('Cancel'); }
+
+    authAppCtrl.message = '';
+
+    authAppCtrl.submitEnable = function() {
+      AuthenticatorAppService
+          .enableAuthenticatorApp(
+              authAppCtrl.user.code)
+          .then(function() { return $uibModalInstance.close('Authenticator app enabled'); })
+          .catch(function(error) {
+            console.error(error);
+            $scope.operationResult = Utils.buildErrorResult(error.data);
+          });
+    };
+
+    authAppCtrl.submitDisable = function() {
+      AuthenticatorAppService
+          .disableAuthenticatorApp(
+              authAppCtrl.user.code)
+          .then(function() { return $uibModalInstance.close('Authenticator app disabled'); })
+          .catch(function(error) {
+            console.error(error);
+            $scope.operationResult = Utils.buildErrorResult(error.data);
+          });
+    };
+  }
+
+  var compareTo = function() {
+    return {
+      require: 'ngModel',
+      scope: {otherModelValue: '=compareTo'},
+      link: function(scope, element, attributes, ngModel) {
+
+        ngModel.$validators.compareTo = function(modelValue) {
+          return modelValue == scope.otherModelValue;
+        };
+
+        scope.$watch('otherModelValue', function() { ngModel.$validate(); });
+      }
+    };
+  };
+
+  angular.module('dashboardApp').directive('compareTo', compareTo);
+})();
\ No newline at end of file
diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/disable-authenticator-app.controller.js b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/disable-authenticator-app.controller.js
deleted file mode 100644
index 39ed38ce3..000000000
--- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/disable-authenticator-app.controller.js
+++ /dev/null
@@ -1,85 +0,0 @@
-/*
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-  'use strict';
-
-  angular.module('dashboardApp')
-      .controller('DisableAuthenticatorAppController', DisableAuthenticatorAppController);
-
-  DisableAuthenticatorAppController.$inject = [
-    '$scope', '$state', '$uibModalInstance', 'Utils', 'user'
-  ];
-
-  function DisableAuthenticatorAppController(
-      $scope, $state, $uibModalInstance, Utils, user) {
-    var disableAuthAppCtrl = this;
-
-    disableAuthAppCtrl.userToEdit = user;
-    disableAuthAppCtrl.codeMinlength = 6;
-
-    disableAuthAppCtrl.dismiss = dismiss;
-    disableAuthAppCtrl.reset = reset;
-
-    function reset() {
-      console.log('reset form');
-
-      disableAuthAppCtrl.disabled = true;
-
-      disableAuthAppCtrl.user = {
-        code: ''
-      };
-
-      if ($scope.userMfaForm) {
-        $scope.userMfaForm.$setPristine();
-      }
-    }
-
-    disableAuthAppCtrl.reset();
-
-    function dismiss() { return $uibModalInstance.dismiss('Cancel'); }
-
-    disableAuthAppCtrl.message = '';
-
-    disableAuthAppCtrl.submit = function() {
-      return $uibModalInstance.close('Updated settings');
-      // ResetPasswordService
-      //     .updatePassword(
-      //         userMfaCtrl.user.currentPassword,
-      //         userMfaCtrl.user.password)
-      //     .then(function() { return $uibModalInstance.close('Password updated'); })
-      //     .catch(function(error) {
-      //       console.error(error);
-      //       $scope.operationResult = Utils.buildErrorResult(error.data);
-      //     });
-    };
-  }
-
-//   var compareTo = function() {
-//     return {
-//       require: 'ngModel',
-//       scope: {otherModelValue: '=compareTo'},
-//       link: function(scope, element, attributes, ngModel) {
-
-//         ngModel.$validators.compareTo = function(modelValue) {
-//           return modelValue == scope.otherModelValue;
-//         };
-
-//         scope.$watch('otherModelValue', function() { ngModel.$validate(); });
-//       }
-//     };
-//   };
-
-//   angular.module('dashboardApp').directive('compareTo', compareTo);
-// })();
\ No newline at end of file
diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/enable-authenticator-app.controller.js b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/enable-authenticator-app.controller.js
deleted file mode 100644
index b4ca83bd5..000000000
--- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/enable-authenticator-app.controller.js
+++ /dev/null
@@ -1,85 +0,0 @@
-/*
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-  'use strict';
-
-  angular.module('dashboardApp')
-      .controller('EnableAuthenticatorAppController', EnableAuthenticatorAppController);
-
-  EnableAuthenticatorAppController.$inject = [
-    '$scope', '$state', '$uibModalInstance', 'Utils', 'user'
-  ];
-
-  function EnableAuthenticatorAppController(
-      $scope, $state, $uibModalInstance, Utils, user) {
-    var enableAuthAppCtrl = this;
-
-    enableAuthAppCtrl.userToEdit = user;
-    enableAuthAppCtrl.codeMinlength = 6;
-
-    enableAuthAppCtrl.dismiss = dismiss;
-    enableAuthAppCtrl.reset = reset;
-
-    function reset() {
-      console.log('reset form');
-
-      enableAuthAppCtrl.enabled = true;
-
-      enableAuthAppCtrl.user = {
-        code: ''
-      };
-
-      if ($scope.userMfaForm) {
-        $scope.userMfaForm.$setPristine();
-      }
-    }
-
-    enableAuthAppCtrl.reset();
-
-    function dismiss() { return $uibModalInstance.dismiss('Cancel'); }
-
-    enableAuthAppCtrl.message = '';
-
-    enableAuthAppCtrl.submit = function() {
-      return $uibModalInstance.close('Updated settings');
-      // ResetPasswordService
-      //     .updatePassword(
-      //         userMfaCtrl.user.currentPassword,
-      //         userMfaCtrl.user.password)
-      //     .then(function() { return $uibModalInstance.close('Password updated'); })
-      //     .catch(function(error) {
-      //       console.error(error);
-      //       $scope.operationResult = Utils.buildErrorResult(error.data);
-      //     });
-    };
-  }
-
-//   var compareTo = function() {
-//     return {
-//       require: 'ngModel',
-//       scope: {otherModelValue: '=compareTo'},
-//       link: function(scope, element, attributes, ngModel) {
-
-//         ngModel.$validators.compareTo = function(modelValue) {
-//           return modelValue == scope.otherModelValue;
-//         };
-
-//         scope.$watch('otherModelValue', function() { ngModel.$validate(); });
-//       }
-//     };
-//   };
-
-//   angular.module('dashboardApp').directive('compareTo', compareTo);
-// })();
\ No newline at end of file
diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/user-mfa.controller.js b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/user-mfa.controller.js
index 6182cca9e..13c52a8da 100644
--- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/user-mfa.controller.js
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/user-mfa.controller.js
@@ -43,8 +43,8 @@
     function enableAuthenticatorApp() {
       var modalInstance = $uibModal.open({
         templateUrl: '/resources/iam/apps/dashboard-app/templates/home/enable-authenticator-app.html',
-        controller: 'EnableAuthenticatorAppController',
-        controllerAs: 'enableAuthAppCtrl',
+        controller: 'AuthenticatorAppController',
+        controllerAs: 'authAppCtrl',
         resolve: {user: function() { return self.user; }}
       });
 
@@ -56,8 +56,8 @@
     function disableAuthenticatorApp() {
       var modalInstance = $uibModal.open({
         templateUrl: '/resources/iam/apps/dashboard-app/templates/home/disable-authenticator-app.html',
-        controller: 'DisableAuthenticatorAppController',
-        controllerAs: 'disableAuthAppCtrl',
+        controller: 'AuthenticatorAppController',
+        controllerAs: 'authAppCtrl',
         resolve: {user: function() { return self.user; }}
       });
 
diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/services/authenticator-app.service.js b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/services/authenticator-app.service.js
new file mode 100644
index 000000000..5b28f4f6b
--- /dev/null
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/services/authenticator-app.service.js
@@ -0,0 +1,75 @@
+/*
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+'use strict'
+
+angular.module('dashboardApp').factory('AuthenticatorAppService', AuthenticatorAppService);
+
+AuthenticatorAppService.$inject = ['$http', '$httpParamSerializerJQLike'];
+
+function AuthenticatorAppService($http, $httpParamSerializerJQLike){
+	
+	var service = {
+		enableAuthenticatorApp : enableAuthenticatorApp,
+		disableAuthenticatorApp : disableAuthenticatorApp
+	};
+	
+	return service;
+	
+	// TODO two functions are broadly similar. This could be simplified into the foundations for step-up authentication
+	function enableAuthenticatorApp(code){
+		
+		var data = $httpParamSerializerJQLike({
+				code: code
+		});
+		
+		var config = {
+			headers : {
+				'Accept' : 'text/plain',
+				'Content-Type': 'application/x-www-form-urlencoded'
+			},
+			transformRequest: function(obj) {
+		        var str = [];
+		        for(var p in obj)
+		        str.push(encodeURIComponent(p) + "=" + encodeURIComponent(obj[p]));
+		        return str.join("&");
+		    }
+		};
+		
+		return $http.post('/iam/authenticator-app/enable', data, config);	
+	};
+	
+	function disableAuthenticatorApp(code){
+		
+		var data = $httpParamSerializerJQLike({
+				code: code
+		});
+		
+		var config = {
+			headers : {
+				'Accept' : 'text/plain',
+				'Content-Type': 'application/x-www-form-urlencoded'
+			},
+			transformRequest: function(obj) {
+		        var str = [];
+		        for(var p in obj)
+		        str.push(encodeURIComponent(p) + "=" + encodeURIComponent(obj[p]));
+		        return str.join("&");
+		    }
+		};
+		
+		return $http.post('/iam/authenticator-app/disable', data, config);	
+	};
+}
\ No newline at end of file
diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/disable-authenticator-app.html b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/disable-authenticator-app.html
index 0b143fa7a..460372dec 100644
--- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/disable-authenticator-app.html
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/disable-authenticator-app.html
@@ -16,7 +16,7 @@
 
 -->
 
-

+
 
   

     
Disable MFA through authenticator app

@@ -31,20 +31,20 @@ 
Disable MFA through authenticator app

 
     

       

-        
+        
       

-      

-        
-        
-         This is a required field
-        Minimum length required is {{disableAuthAppCtrl.codeMinlength}}
+      

+        
+        
+         This is a required field
+        Minimum length required is {{authAppCtrl.codeMinlength}}
       

     

 
   

-    
-    
-    
+    
+    
+    
   

 
 
\ No newline at end of file
diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/enable-authenticator-app.html b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/enable-authenticator-app.html
index 9974c920d..403919f31 100644
--- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/enable-authenticator-app.html
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/enable-authenticator-app.html
@@ -16,7 +16,7 @@
 
 -->
 
-

+
 
   

     
Enable authenticator app

@@ -32,20 +32,20 @@ 
Enable authenticator app

 
     

       

-        
+        
       

-      

-        
-        
-         This is a required field
-        Minimum length required is {{enableAuthAppCtrl.codeMinlength}}
+      

+        
+        
+         This is a required field
+        Minimum length required is {{authAppCtrl.codeMinlength}}
       

     

 
   

-    
-    
-    
+    
+    
+    
   

 
 
\ No newline at end of file
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpMfa.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpMfa.java
index 0a4dce404..5e2eebf5a 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpMfa.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpMfa.java
@@ -1,3 +1,18 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 package it.infn.mw.iam.persistence.model;
 
 import java.io.Serializable;
@@ -44,7 +59,7 @@ public class IamTotpMfa implements Serializable {
 
   // TODO do we need a UUID?
 
-  @OneToMany(mappedBy = "totpMfa", cascade = CascadeType.ALL, fetch = FetchType.LAZY,
+  @OneToMany(mappedBy = "totpMfa", cascade = CascadeType.ALL, fetch = FetchType.EAGER,
       orphanRemoval = true)
   private Set recoveryCodes = new HashSet<>();
 
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpRecoveryCode.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpRecoveryCode.java
index 5688562e3..f5f964c08 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpRecoveryCode.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpRecoveryCode.java
@@ -1,3 +1,18 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 package it.infn.mw.iam.persistence.model;
 
 import java.io.Serializable;
@@ -26,7 +41,7 @@ public class IamTotpRecoveryCode implements Serializable {
   @Column(name = "code")
   private String code;
 
-  @ManyToOne(fetch = FetchType.LAZY)
+  @ManyToOne(fetch = FetchType.EAGER)
   @JoinColumn(referencedColumnName = "id", nullable = false)
   private IamTotpMfa totpMfa;
 

From 67d80a1b578cc724e3bcfd037062ec4a64040ffb Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Mon, 22 Nov 2021 15:24:14 +0000
Subject: [PATCH 18/76] Syncing branch with origin

---
 .../webapp/WEB-INF/views/iam/dashboard.jsp    |  2 -
 .../disable-authenticator-app.controller.js   | 85 -------------------
 .../enable-authenticator-app.controller.js    | 85 -------------------
 3 files changed, 172 deletions(-)
 delete mode 100644 iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/disable-authenticator-app.controller.js
 delete mode 100644 iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/enable-authenticator-app.controller.js

diff --git a/iam-login-service/src/main/webapp/WEB-INF/views/iam/dashboard.jsp b/iam-login-service/src/main/webapp/WEB-INF/views/iam/dashboard.jsp
index f3ad8ed28..3d336a4e7 100644
--- a/iam-login-service/src/main/webapp/WEB-INF/views/iam/dashboard.jsp
+++ b/iam-login-service/src/main/webapp/WEB-INF/views/iam/dashboard.jsp
@@ -111,9 +111,7 @@
   
   
   
-  
   
-  
   
 
   
diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/disable-authenticator-app.controller.js b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/disable-authenticator-app.controller.js
deleted file mode 100644
index 39ed38ce3..000000000
--- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/disable-authenticator-app.controller.js
+++ /dev/null
@@ -1,85 +0,0 @@
-/*
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-  'use strict';
-
-  angular.module('dashboardApp')
-      .controller('DisableAuthenticatorAppController', DisableAuthenticatorAppController);
-
-  DisableAuthenticatorAppController.$inject = [
-    '$scope', '$state', '$uibModalInstance', 'Utils', 'user'
-  ];
-
-  function DisableAuthenticatorAppController(
-      $scope, $state, $uibModalInstance, Utils, user) {
-    var disableAuthAppCtrl = this;
-
-    disableAuthAppCtrl.userToEdit = user;
-    disableAuthAppCtrl.codeMinlength = 6;
-
-    disableAuthAppCtrl.dismiss = dismiss;
-    disableAuthAppCtrl.reset = reset;
-
-    function reset() {
-      console.log('reset form');
-
-      disableAuthAppCtrl.disabled = true;
-
-      disableAuthAppCtrl.user = {
-        code: ''
-      };
-
-      if ($scope.userMfaForm) {
-        $scope.userMfaForm.$setPristine();
-      }
-    }
-
-    disableAuthAppCtrl.reset();
-
-    function dismiss() { return $uibModalInstance.dismiss('Cancel'); }
-
-    disableAuthAppCtrl.message = '';
-
-    disableAuthAppCtrl.submit = function() {
-      return $uibModalInstance.close('Updated settings');
-      // ResetPasswordService
-      //     .updatePassword(
-      //         userMfaCtrl.user.currentPassword,
-      //         userMfaCtrl.user.password)
-      //     .then(function() { return $uibModalInstance.close('Password updated'); })
-      //     .catch(function(error) {
-      //       console.error(error);
-      //       $scope.operationResult = Utils.buildErrorResult(error.data);
-      //     });
-    };
-  }
-
-//   var compareTo = function() {
-//     return {
-//       require: 'ngModel',
-//       scope: {otherModelValue: '=compareTo'},
-//       link: function(scope, element, attributes, ngModel) {
-
-//         ngModel.$validators.compareTo = function(modelValue) {
-//           return modelValue == scope.otherModelValue;
-//         };
-
-//         scope.$watch('otherModelValue', function() { ngModel.$validate(); });
-//       }
-//     };
-//   };
-
-//   angular.module('dashboardApp').directive('compareTo', compareTo);
-// })();
\ No newline at end of file
diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/enable-authenticator-app.controller.js b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/enable-authenticator-app.controller.js
deleted file mode 100644
index b4ca83bd5..000000000
--- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/enable-authenticator-app.controller.js
+++ /dev/null
@@ -1,85 +0,0 @@
-/*
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-  'use strict';
-
-  angular.module('dashboardApp')
-      .controller('EnableAuthenticatorAppController', EnableAuthenticatorAppController);
-
-  EnableAuthenticatorAppController.$inject = [
-    '$scope', '$state', '$uibModalInstance', 'Utils', 'user'
-  ];
-
-  function EnableAuthenticatorAppController(
-      $scope, $state, $uibModalInstance, Utils, user) {
-    var enableAuthAppCtrl = this;
-
-    enableAuthAppCtrl.userToEdit = user;
-    enableAuthAppCtrl.codeMinlength = 6;
-
-    enableAuthAppCtrl.dismiss = dismiss;
-    enableAuthAppCtrl.reset = reset;
-
-    function reset() {
-      console.log('reset form');
-
-      enableAuthAppCtrl.enabled = true;
-
-      enableAuthAppCtrl.user = {
-        code: ''
-      };
-
-      if ($scope.userMfaForm) {
-        $scope.userMfaForm.$setPristine();
-      }
-    }
-
-    enableAuthAppCtrl.reset();
-
-    function dismiss() { return $uibModalInstance.dismiss('Cancel'); }
-
-    enableAuthAppCtrl.message = '';
-
-    enableAuthAppCtrl.submit = function() {
-      return $uibModalInstance.close('Updated settings');
-      // ResetPasswordService
-      //     .updatePassword(
-      //         userMfaCtrl.user.currentPassword,
-      //         userMfaCtrl.user.password)
-      //     .then(function() { return $uibModalInstance.close('Password updated'); })
-      //     .catch(function(error) {
-      //       console.error(error);
-      //       $scope.operationResult = Utils.buildErrorResult(error.data);
-      //     });
-    };
-  }
-
-//   var compareTo = function() {
-//     return {
-//       require: 'ngModel',
-//       scope: {otherModelValue: '=compareTo'},
-//       link: function(scope, element, attributes, ngModel) {
-
-//         ngModel.$validators.compareTo = function(modelValue) {
-//           return modelValue == scope.otherModelValue;
-//         };
-
-//         scope.$watch('otherModelValue', function() { ngModel.$validate(); });
-//       }
-//     };
-//   };
-
-//   angular.module('dashboardApp').directive('compareTo', compareTo);
-// })();
\ No newline at end of file

From af13c9c9ed6c0f5e5399562ddb2c1b99ad154773 Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Mon, 22 Nov 2021 15:27:58 +0000
Subject: [PATCH 19/76] Merging changes for updating Spring boot and Java
 version. Squashed commit of the following:

commit dccc0b6f8476492289479c2b0eb31b7f22288771
Merge: 0c674fb cc3b4d5
Author: Sam Glendenning 
Date:   Mon Nov 22 14:55:04 2021 +0000

    Merge branch 'iam-spring-update-oct-2021' of git://github.com/indigo-iam/iam into iam-spring-update-oct-2021

commit cc3b4d51af3cc1e5db71d8009642eb08eda11a82
Author: Andrea Ceccanti 
Date:   Mon Nov 15 08:33:55 2021 +0100

    More fixes for SonarCloud warnings

commit 5ff5e3be7018f8d5b43265c7503d6a6080700e67
Author: Andrea Ceccanti 
Date:   Sun Nov 14 16:38:07 2021 +0100

    Fixes for Sonar warnings/errors

    and other minor improvements

commit 91d05339bd2b4239981506ddd35aa5fc5592d0cd
Author: Andrea Ceccanti 
Date:   Sat Nov 13 16:02:51 2021 +0100

    Tests green (locally)

commit d575a479448fca88ee3d6e9a8cbf4c6a812ac2bc
Author: Andrea Ceccanti 
Date:   Sat Nov 13 08:59:09 2021 +0100

    More warning and test fixes

commit 0b629633411e0b034e360726a8d68968ce864593
Author: Andrea Ceccanti 
Date:   Fri Nov 12 18:38:35 2021 +0100

    More test fixes

commit 922b46452882cebca3984df8303cab136afe7b64
Author: Andrea Ceccanti 
Date:   Tue Nov 9 11:00:34 2021 +0100

    Test errors -> 0, Test failures -> ~12%

commit f7f851348bdebb905eae653f72fd754357e1b88e
Author: Andrea Ceccanti 
Date:   Sat Nov 6 09:50:08 2021 +0100

    Silence deprecation warnings

    Only if coming from the latest spring-security-oauth2 (for which we do
    not and won't have a replacement for some time).

commit 8f27bd2b28763d2a0557aa86f84a9939e7f959dc
Author: Andrea Ceccanti 
Date:   Sat Nov 6 08:44:07 2021 +0100

    Use H2 datasource for the tests

    This prevents issues with the hikari connection pool being closed.

commit 45c7b4e627c13d08b350b022eaa25a9045ecc9b0
Author: Andrea Ceccanti 
Date:   Fri Nov 5 19:44:15 2021 +0100

    Service starts up!

commit 4f984ee000e54e006cd88c7f411c1e5cb5e5e54f
Author: Andrea Ceccanti 
Date:   Fri Nov 5 19:27:01 2021 +0100

    Use a keystore with key size 2048

commit 3efc9f9f46f6921fdef85b271cb9386b90ab8248
Author: Andrea Ceccanti 
Date:   Fri Nov 5 18:37:34 2021 +0100

    Flyway migration refactoring to avoid naming errors

commit 3f5e74182d94c765b1451f32f429f876e3228f40
Author: Andrea Ceccanti 
Date:   Fri Nov 5 18:22:42 2021 +0100

    Moved source/target compatibility to Java 11

commit 7e1f1d6f7077663a70a3ea9e4ed630571b89c23c
Author: Andrea Ceccanti 
Date:   Fri Nov 5 18:14:18 2021 +0100

    License updates

commit b63ce93be8f5770ec7fb69232a6208b9dff5ec6c
Author: Andrea Ceccanti 
Date:   Fri Nov 5 18:13:32 2021 +0100

    Config files changes

commit 66d28d271365bb7f9bf0b973018296b80b971141
Author: Andrea Ceccanti 
Date:   Fri Nov 5 17:59:07 2021 +0100

    Builds against spring boot 2.5.6

commit 0d9167ab4a3b07b5c495eb8396342e36c1e3e3eb
Author: Andrea Ceccanti 
Date:   Fri Nov 5 10:26:35 2021 +0100

    Fixed flyway migrations compilation problems

commit 1ca9d730a94bf29a52730b75f38a8844aead0d6d
Author: Andrea Ceccanti 
Date:   Fri Nov 5 10:09:10 2021 +0100

    wip

commit acd7e4f814f2abfb3446ac2be7d4d85c5033eafe
Author: Andrea Ceccanti 
Date:   Fri Nov 5 08:07:33 2021 +0100

    WIP: maven clean succeeds

commit 2b9835edec7a221fc789efcfce13b56c5bed3cb5
Author: Andrea Ceccanti 
Date:   Thu Nov 4 18:18:33 2021 +0100

    wip

commit 8dbf1cf034676afe1a547b70acdac1dec3c5857d
Author: Andrea Ceccanti 
Date:   Wed Nov 3 19:35:18 2021 +0100

    Fixed code smells reported by Sonar

commit 56b570ed719ec52c166d7a22113c6a548cfa278f
Author: Andrea Ceccanti 
Date:   Wed Nov 3 19:16:59 2021 +0100

    Just build on Java 11

    Still not there for Java 17...

commit 15290496bf97125e78d50f7820d8b05c7eaee317
Author: Andrea Ceccanti 
Date:   Wed Nov 3 18:41:18 2021 +0100

    Restore sonar analysis

commit ed5220796f89c014cf3b3a4c5d5552d0644492c6
Author: Andrea Ceccanti 
Date:   Wed Nov 3 18:40:23 2021 +0100

    Use openjdk:11 docker images

commit cc382c21f93da9204630cd69f48baf1d689159bf
Author: Andrea Ceccanti 
Date:   Wed Nov 3 18:26:14 2021 +0100

    Drop java 8

commit 9dc729ca3239e4cd7e568ca0edced9aa4265f8bc
Author: Andrea Ceccanti 
Date:   Wed Nov 3 17:59:29 2021 +0100

    Build on Jenkins with Java 11

commit 7c090dd05da59c7b3a5b9f822f7c775efcae47ce
Author: Andrea Ceccanti 
Date:   Wed Nov 3 17:52:18 2021 +0100

    First attempt at java version matrix build

commit d77d86058fe48be7cd67c53355a8c21423a22a5b
Author: Andrea Ceccanti 
Date:   Wed Nov 3 17:43:21 2021 +0100

    Dropped validator-collections dependency

commit 47cf69b385df4f278d4f050b4f6cc8a0fc23bdfa
Author: Andrea Ceccanti 
Date:   Mon Nov 1 16:46:22 2021 +0100

    Fix test fixture initialization

commit 59406e0d0101c79ce4a5163a0c3fefdd10b9415b
Author: Andrea Ceccanti 
Date:   Mon Nov 1 16:45:23 2021 +0100

    Drop DevToolsDataSourceAutoConfiguration

    Which breaks h2 tests.

commit 6c18f352f74acbd0b91a7660406dda3d9ca19337
Author: Andrea Ceccanti 
Date:   Mon Nov 1 16:44:52 2021 +0100

    Add flyway debug log handle

commit 2f433adfd63f635fb2762e01ca0c84211d2f66af
Author: Andrea Ceccanti 
Date:   Mon Nov 1 16:44:28 2021 +0100

    Streamlined h2 db test configuration

commit c9eaa1687ddc2db0fc1877ba10ce9796a6997e18
Author: Andrea Ceccanti 
Date:   Mon Nov 1 16:41:39 2021 +0100

    Upgrade surefire plugin to the latest version

commit 3ae9b7fccc904be5f3a405f84ac1c568b80c8b18
Author: Andrea Ceccanti 
Date:   Fri Oct 29 08:18:12 2021 +0200

    Archive JUnit reports

commit 96269821519dda2a46a02f2c8733bb6c4957292d
Author: Andrea Ceccanti 
Date:   Fri Oct 29 07:45:04 2021 +0200

    Removed ununsed dependency

commit de574c8f60b6767fac2b312b4d83688bf1107556
Author: Andrea Ceccanti 
Date:   Fri Oct 29 07:44:30 2021 +0200

    More test fixes

commit b3620ac6fb84403ec9137745821a718c8ce1b540
Author: Andrea Ceccanti 
Date:   Fri Oct 29 07:43:58 2021 +0200

    Control how many test contexts are cached during builds

commit a853f9425f61d886176b436f69d9246630d9fcaf
Author: Andrea Ceccanti 
Date:   Thu Oct 28 12:32:08 2021 +0200

    More test fixes

commit 481a45697675ced9a14992e8c2819bc67f418e23
Author: Andrea Ceccanti 
Date:   Thu Oct 28 11:13:39 2021 +0200

    More test fixes

commit 003a4864b2e3fe66172ce4d619175b84164979bd
Author: Andrea Ceccanti 
Date:   Thu Oct 28 08:49:19 2021 +0200

    More test fixes

commit 0417ad15b54c3a2d70e2f66da8eab799762cbef7
Author: Andrea Ceccanti 
Date:   Wed Oct 27 19:25:19 2021 +0200

    More test porting

commit ed3032209b6684f0048b35538825ef60d9651719
Author: Andrea Ceccanti 
Date:   Wed Oct 27 18:29:58 2021 +0200

    Fixed Velocity initialization

    And moved email templates from the /templates folder
    to the /email-templates folder in the classpath.

commit b35bf83575c3aa0203ac146dd3406ac3bc07e01a
Author: Andrea Ceccanti 
Date:   Wed Oct 27 08:52:18 2021 +0200

    More test fixing work

commit c2b205b81acc68f8d80e9b51eec6cbad90512363
Author: Andrea Ceccanti 
Date:   Tue Oct 26 17:48:16 2021 +0200

    More test fixes

commit b310d4c3cbcb4cc8de5e10c60ba210979659f0ae
Author: Andrea Ceccanti 
Date:   Tue Oct 26 17:23:47 2021 +0200

    All api tests green

commit 4a7098254dd2bf6eee7b57c260caa51485e9c28a
Author: Andrea Ceccanti 
Date:   Tue Oct 26 12:17:49 2021 +0200

    Cors configuration & actuator test fixes

commit 4ed75ff33dde919194dd28a4252586ecb847dc7c
Author: Andrea Ceccanti 
Date:   Tue Oct 26 00:38:23 2021 +0200

    Remove cors filter configuration

commit a9487412794c9c1346eee9aff3a336e1bcd96667
Author: Andrea Ceccanti 
Date:   Mon Oct 25 19:37:51 2021 +0200

    Added license

commit e025b7d0509a8a4b520053226f9278fc36219c0a
Author: Andrea Ceccanti 
Date:   Mon Oct 25 19:37:25 2021 +0200

    Started migration of integration tests

commit ee7fc54c3d2ae67b3c8d1f7cd5f33d192b0769c3
Author: Andrea Ceccanti 
Date:   Mon Oct 25 19:36:54 2021 +0200

    New unified test annotation

commit 149d9d12c7e7278e3d55b59e9054b1dc308fc44b
Author: Andrea Ceccanti 
Date:   Mon Oct 25 19:14:54 2021 +0200

    Project compiles

commit 84ed532014bc57f0d68430d5ec332ce290f58a9a
Author: Andrea Ceccanti 
Date:   Mon Oct 25 19:12:59 2021 +0200

    Run update-tests script

commit ce93f59a9718ed8f59b44a372aba14aeaaf893c0
Author: Andrea Ceccanti 
Date:   Mon Oct 25 19:07:21 2021 +0200

    Fix compilation problems on main code

    Fix renamed classes and changed JPAConfig

commit 93b80c6c6d0b8d3bc2229302d6a41fd4fac3ca42
Author: Andrea Ceccanti 
Date:   Mon Oct 25 19:06:47 2021 +0200

    First migrate to spring boot 1.5.22

commit de5f1b1d65775bd8c87c5c287e0548d8151679fe
Author: Andrea Ceccanti 
Date:   Mon Oct 25 18:30:00 2021 +0200

    Updated Spring and mitreid deps

commit e9e54086b75fd9d532c3982f44a0b0a38184fee6
Merge: 8c9b8bc 4bfc271
Author: Andrea Ceccanti 
Date:   Sun Oct 24 17:47:19 2021 +0200

    Merge pull request #433 from indigo-iam/issue-432-include-groups-in-userinfo-response-wlcg

    Include wlcg.groups in userinfo response

commit 8c9b8bc4e158eb64e60542b52d3b5165cab56e8d
Merge: ec31232 8ffed21
Author: Andrea Ceccanti 
Date:   Sun Oct 24 17:47:05 2021 +0200

    Merge pull request #431 from indigo-iam/issue-430-improved-jwk-configuration

    Improved support for JWK configuration

commit ec31232b711b3e757e7429c75a1a68aa87b8bc0e
Merge: 767e86e 88bb278
Author: Andrea Ceccanti 
Date:   Sun Oct 24 17:46:45 2021 +0200

    Merge pull request #427 from indigo-iam/issue-426-jwt-based-client-auth

    First attempt at JWT-based client-auth

commit 4bfc2719c32f2063027ad232042098b081e64f8c
Author: Andrea Ceccanti 
Date:   Sun Oct 24 17:23:36 2021 +0200

    Include wlcg.groups information in userinfo response

    Even though the IAM access token is a JWT and even though groups are
    included in the access token when requested, as mandated by the WLCG JWT
    profile, there are still apps treating the access token as an opaque
    string.

    To support those apps, and be more consistent with the traditional IAM
    profile behaviour, IAM should include group information in the userinfo
    endpoint response also for the WLCG profile.

    Issue: #432

commit 195c2d76ace2b6bdeb540812e3c38ea470b9df74
Merge: 7f90144 5b8d9d8
Author: Andrea Ceccanti 
Date:   Thu Sep 23 15:23:34 2021 +0200

    Merge pull request #425 from indigo-iam/issue-424-IAM-does-not-encode-group-names-correctly-aarc-g002

    Fix for issue-422: iam does not encode group names correctly according to AARC G002

commit 8ffed21bbffaa19113f34eb14c0f4b17d43fa5f1
Author: Andrea Ceccanti 
Date:   Sun Oct 24 09:25:36 2021 +0200

    Improved support for JWT configuration

    It's now possible to specify the default key id and algorithm used for
    signing tokens.

    Issue: #430

commit 88bb2784d9580655eaa936df4255f069bfa81a96
Author: Andrea Ceccanti 
Date:   Sat Oct 23 09:56:08 2021 +0200

    More integration tests

commit cd8ef617a61adc4c2f654869949f8d6791b9bebe
Author: Andrea Ceccanti 
Date:   Sat Oct 23 08:39:43 2021 +0200

    More tests for JWTAuthenticationProvider

commit fc7148d42358ffbbf080d4e8675d22dacf5e4e05
Author: Andrea Ceccanti 
Date:   Sun Oct 17 23:03:37 2021 +0200

    First attempt at JWT-based client-auth

commit 767e86e0eed8cd386a678cbab84b8221be56fc48
Merge: 7f90144 5b8d9d8
Author: Andrea Ceccanti 
Date:   Thu Sep 23 15:23:34 2021 +0200

    Merge pull request #425 from indigo-iam/issue-424-IAM-does-not-encode-group-names-correctly-aarc-g002

    Fix for issue-422: iam does not encode group names correctly according to AARC G002

commit 5b8d9d8d27c7b006eb2e4989cc918345043233c9
Author: Andrea Ceccanti 
Date:   Thu Sep 23 14:50:32 2021 +0200

    Fix wrong AARC G002 group name encoding

commit 7f901442a97ceca8d98aac5bfe573c09b219a484
Author: Andrea Ceccanti 
Date:   Tue Sep 14 07:56:12 2021 +0200

    Version bumped back to 1.8.0-SNAPSHOT

commit 1828bf04df08587981053c70567f44c0b0aa0729
Author: Andrea Ceccanti 
Date:   Tue Sep 14 07:55:41 2021 +0200

    Test custom logging conf
---
 .github/workflows/maven.yml                   |  16 +-
 .../{sonar.yaml.disabled => sonar.yaml}       |  12 +-
 Jenkinsfile                                   |  20 +-
 LICENSE                                       |   2 +-
 compose/custom-logging/logback-spring.xml     |  42 ++
 docker-compose.yml                            |  10 +-
 iam-common/pom.xml                            |   2 +-
 iam-login-service/docker/Dockerfile           |   4 +-
 iam-login-service/docker/Dockerfile.prod      |   4 +-
 iam-login-service/docker/build-prod-image.sh  |   2 +-
 iam-login-service/docker/push-prod-image.sh   |   2 +-
 iam-login-service/pom.xml                     |  76 +--
 .../java/it/infn/mw/iam/IamLoginService.java  |  39 +-
 .../iam/actuator/IamHealthConfiguration.java  |  56 ---
 .../ExternalServiceProbeEndpoint.java         |  55 --
 .../actuator/endpoint/MailHealthEndpoint.java |  55 --
 .../mvc/ExternalServiceHealthMvcEndpoint.java |  93 ----
 .../endpoint/mvc/MailHealthMvcEndpoint.java   |  92 ----
 .../ExternalConnectivityHealthIndicator.java  |  70 +++
 .../health/ExternalServiceProbeIndicator.java |  55 --
 .../infn/mw/iam/api/account/AccountUtils.java |   3 +-
 .../AccountAttributesController.java          |   2 +-
 .../authority/AccountAuthorityController.java |   2 +-
 .../authority/AccountAuthorityService.java    |   2 +-
 .../authority/AuthorityAlreadyBoundError.java |   2 +-
 .../api/account/authority/AuthorityDTO.java   |   5 +-
 .../account/authority/AuthoritySetDTO.java    |   2 +-
 .../DefaultAccountAuthorityService.java       |   2 +-
 .../authority/InvalidAuthorityError.java      |   2 +-
 .../find/DefaultFindAccountService.java       |   2 +-
 .../account/find/FindAccountController.java   |   2 +-
 .../api/account/find/FindAccountService.java  |   2 +-
 .../account/group/AccountGroupController.java |   2 +-
 .../api/account/group/AlreadyMemberError.java |   2 +-
 .../iam/api/account/group/ErrorSuppliers.java |   2 +-
 .../api/account/group/NotAMemberError.java    |   2 +-
 .../AccountGroupManagerController.java        |   2 +-
 .../AccountGroupManagerService.java           |   2 +-
 .../DefaultAccountGroupManagerService.java    |   2 +-
 .../error/InvalidManagedGroupError.java       |   2 +-
 .../model/AccountManagedGroupsDTO.java        |   2 +-
 .../labels/AccountLabelsController.java       |   2 +-
 .../lifecycle/AccountLifecycleController.java |   2 +-
 .../lifecycle/AccountLifecycleDTO.java        |   2 +-
 .../lifecycle/InvalidLifecycleError.java      |   2 +-
 .../DefaultPasswordResetService.java          |   2 +-
 .../api/account/password_reset/EmailDTO.java  |   5 +-
 .../account/password_reset/PasswordDTO.java   |   5 +-
 .../PasswordResetController.java              |  19 +-
 .../password_reset/PasswordResetService.java  |   2 +-
 .../PasswordUpdateController.java             |   3 +-
 .../error/BadUserPasswordError.java           |   2 +-
 .../error/InvalidEmailAddressError.java       |   2 +-
 .../error/InvalidPasswordError.java           |   2 +-
 .../error/InvalidPasswordResetTokenError.java |   2 +-
 .../error/UserNotActiveOrNotVerified.java     |   2 +-
 .../error/UserNotFoundError.java              |   2 +-
 .../AccountProxyCertificatesController.java   |   2 +-
 .../search/AbstractSearchController.java      |   2 +-
 .../search/AccountSearchController.java       |  11 +-
 .../account/search/GroupSearchController.java |   5 +-
 .../service/DefaultPagedAccountsService.java  |   2 +-
 .../service/DefaultPagedGroupsService.java    |   2 +-
 .../AccountLinkingConstants.java              |   4 +-
 .../AccountLinkingController.java             |  10 +-
 .../AccountLinkingDisabledException.java      |   2 +-
 .../AccountLinkingService.java                |   2 +-
 .../DefaultAccountLinkingService.java         |   2 +-
 .../iam/api/aup/AUPSignatureCheckService.java |   2 +-
 .../it/infn/mw/iam/api/aup/AupController.java |   2 +-
 .../it/infn/mw/iam/api/aup/AupService.java    |   2 +-
 .../iam/api/aup/AupSignatureController.java   |   2 +-
 .../api/aup/AupSignaturePageController.java   |   2 +-
 .../mw/iam/api/aup/DefaultAupService.java     |   2 +-
 .../aup/DefaultAupSignatureCheckService.java  |   2 +-
 .../api/aup/error/AupAlreadyExistsError.java  |   2 +-
 .../iam/api/aup/error/AupNotFoundError.java   |   2 +-
 .../aup/error/AupSignatureNotFoundError.java  |   2 +-
 .../mw/iam/api/aup/error/InvalidAupError.java |   2 +-
 .../infn/mw/iam/api/aup/model/AccountDTO.java |   2 +-
 .../mw/iam/api/aup/model/AupConverter.java    |   2 +-
 .../it/infn/mw/iam/api/aup/model/AupDTO.java  |   4 +-
 .../api/aup/model/AupSignatureConverter.java  |   2 +-
 .../mw/iam/api/aup/model/AupSignatureDTO.java |   2 +-
 .../api/authn_info/AuthnInfoController.java   |   2 +-
 .../infn/mw/iam/api/common/AttributeDTO.java  |   2 +-
 .../iam/api/common/AttributeDTOConverter.java |   2 +-
 .../it/infn/mw/iam/api/common/ErrorDTO.java   |   2 +-
 .../it/infn/mw/iam/api/common/GroupDTO.java   |   2 +-
 .../it/infn/mw/iam/api/common/LabelDTO.java   |   4 +-
 .../mw/iam/api/common/LabelDTOConverter.java  |   2 +-
 .../mw/iam/api/common/ListResponseDTO.java    |   4 +-
 .../mw/iam/api/common/NoSuchAccountError.java |   2 +-
 .../mw/iam/api/common/OffsetPageable.java     |  29 +-
 .../iam/api/common/PagedResourceService.java  |   2 +-
 .../infn/mw/iam/api/common/PagingUtils.java   |   2 +-
 .../common/error/InvalidAttributeError.java   |   2 +-
 .../api/common/error/InvalidLabelError.java   |   2 +-
 .../api/common/form/PaginatedRequestForm.java |   2 +-
 .../form/PaginatedRequestWithFilterForm.java  |   2 +-
 .../validator/NullableNonBlankString.java     |   2 +-
 .../NullableNonBlankStringValidator.java      |   4 +-
 .../api/config/ConfigurationController.java   |   2 +-
 .../ClientMatchingPolicyDTO.java              |   2 +-
 .../DefaultTokenExchangePolicyService.java    |   7 +-
 .../ExchangePolicyController.java             |   8 +-
 .../ExchangePolicyConverter.java              |   2 +-
 .../exchange_policy/ExchangePolicyDTO.java    |   2 +-
 .../ExchangePolicyNotFoundError.java          |   2 +-
 .../ExchangeScopePolicyDTO.java               |   2 +-
 .../InvalidExchangePolicyError.java           |   2 +-
 .../TokenExchangePolicyService.java           |   2 +-
 .../mw/iam/api/group/GroupController.java     |   4 +-
 .../mw/iam/api/group/GroupDTOConverter.java   |   2 +-
 .../iam/api/group/GroupLabelsController.java  |   2 +-
 .../mw/iam/api/group/InvalidGroupError.java   |   2 +-
 .../group/find/DefaultFindGroupService.java   |   2 +-
 .../api/group/find/FindGroupController.java   |   2 +-
 .../iam/api/group/find/FindGroupService.java  |   2 +-
 .../group/validator/GroupNameAssigned.java    |   2 +-
 .../validator/GroupNameAssignedValidator.java |   2 +-
 .../api/group/validator/ValidGroupName.java   |   2 +-
 .../validator/ValidGroupNameValidator.java    |   2 +-
 .../proxy/DefaultProxyCertificateService.java |   2 +-
 .../api/proxy/InvalidProxyRequestError.java   |   2 +-
 .../mw/iam/api/proxy/ProxyCertificateDTO.java |   4 +-
 .../api/proxy/ProxyCertificateProperties.java |   2 +-
 .../api/proxy/ProxyCertificateRequestDTO.java |   2 +-
 .../api/proxy/ProxyCertificateService.java    |   2 +-
 .../proxy/ProxyCertificatesApiController.java |   2 +-
 .../mw/iam/api/proxy/ProxyNotFoundError.java  |   2 +-
 .../registration/cern/CernHrDBApiService.java |   2 +-
 .../registration/cern/CernHrDbApiError.java   |   2 +-
 .../cern/DefaultCernHrDBApiService.java       |   2 +-
 .../api/registration/cern/dto/ErrorDTO.java   |   2 +-
 .../registration/cern/dto/InstituteDTO.java   |   2 +-
 .../cern/dto/ParticipationDTO.java            |   2 +-
 .../registration/cern/dto/VOPersonDTO.java    |   2 +-
 .../cern/mock/MockCernAuthController.java     |   2 +-
 .../api/requests/GroupRequestConverter.java   |   2 +-
 .../iam/api/requests/GroupRequestUtils.java   |   2 +-
 .../api/requests/GroupRequestsController.java |   6 +-
 .../GroupRequestExceptionHandler.java         |   2 +-
 .../GroupRequestValidationError.java          |   2 +-
 .../InvalidGroupRequestStatusError.java       |   2 +-
 .../api/requests/model/GroupRequestDto.java   |   4 +-
 .../service/DefaultGroupRequestsService.java  |   9 +-
 .../service/GroupRequestsService.java         |   2 +-
 .../api/requests/validator/GroupRequest.java  |   2 +-
 .../validator/GroupRequestValidator.java      |   2 +-
 .../controller/ScimControllerSupport.java     |   2 +-
 .../scim/controller/ScimExceptionHandler.java |   2 +-
 .../scim/controller/ScimGroupController.java  |   2 +-
 .../api/scim/controller/ScimMeController.java |   3 +-
 .../scim/controller/ScimUserController.java   |   2 +-
 .../controller/utils/JsonDateSerializer.java  |   2 +-
 .../utils/ValidationErrorMessageHelper.java   |   2 +-
 .../controller/utils/ValidationHelper.java    |   2 +-
 .../api/scim/converter/AddressConverter.java  |   2 +-
 .../mw/iam/api/scim/converter/Converter.java  |   2 +-
 .../DefaultScimResourceLocationProvider.java  |   2 +-
 .../api/scim/converter/GroupConverter.java    |   2 +-
 .../api/scim/converter/OidcIdConverter.java   |   4 +-
 .../api/scim/converter/SamlIdConverter.java   |   2 +-
 .../ScimResourceLocationProvider.java         |   2 +-
 .../api/scim/converter/SshKeyConverter.java   |   7 +-
 .../iam/api/scim/converter/UserConverter.java |   9 +-
 .../converter/X509CertificateConverter.java   |   2 +-
 .../exception/IllegalArgumentException.java   |   2 +-
 .../iam/api/scim/exception/ScimException.java |   2 +-
 .../ScimPatchOperationNotSupported.java       |   2 +-
 .../ScimResourceExistsException.java          |   2 +-
 .../ScimResourceNotFoundException.java        |   2 +-
 .../exception/ScimValidationException.java    |   2 +-
 .../mw/iam/api/scim/model/ScimAddress.java    |   2 +-
 .../mw/iam/api/scim/model/ScimConstants.java  |   4 +-
 .../infn/mw/iam/api/scim/model/ScimEmail.java |   6 +-
 .../iam/api/scim/model/ScimErrorResponse.java |   2 +-
 .../infn/mw/iam/api/scim/model/ScimGroup.java |   4 +-
 .../api/scim/model/ScimGroupPatchRequest.java |   4 +-
 .../mw/iam/api/scim/model/ScimGroupRef.java   |   2 +-
 .../iam/api/scim/model/ScimIndigoGroup.java   |   2 +-
 .../mw/iam/api/scim/model/ScimIndigoUser.java |   2 +-
 .../infn/mw/iam/api/scim/model/ScimLabel.java |   2 +-
 .../iam/api/scim/model/ScimListResponse.java  |   2 +-
 .../mw/iam/api/scim/model/ScimMemberRef.java  |   4 +-
 .../infn/mw/iam/api/scim/model/ScimMeta.java  |   2 +-
 .../infn/mw/iam/api/scim/model/ScimName.java  |   4 +-
 .../mw/iam/api/scim/model/ScimOidcId.java     |   4 +-
 .../api/scim/model/ScimPatchOperation.java    |   2 +-
 .../infn/mw/iam/api/scim/model/ScimPhoto.java |   4 +-
 .../mw/iam/api/scim/model/ScimResource.java   |   2 +-
 .../mw/iam/api/scim/model/ScimSamlId.java     |   4 +-
 .../mw/iam/api/scim/model/ScimSshKey.java     |   4 +-
 .../infn/mw/iam/api/scim/model/ScimUser.java  |   6 +-
 .../api/scim/model/ScimUserPatchRequest.java  |   4 +-
 .../api/scim/model/ScimX509Certificate.java   |   2 +-
 .../provisioning/ScimGroupProvisioning.java   |  16 +-
 .../scim/provisioning/ScimProvisioning.java   |   2 +-
 .../iam/api/scim/provisioning/ScimQuery.java  |   2 +-
 .../provisioning/ScimUserProvisioning.java    |   2 +-
 .../paging/DefaultScimPageRequest.java        |   2 +-
 .../provisioning/paging/ScimPageRequest.java  |   2 +-
 .../api/scim/updater/AccountEventBuilder.java |   2 +-
 .../scim/updater/AccountEventPublisher.java   |   2 +-
 .../iam/api/scim/updater/AccountUpdater.java  |   2 +-
 .../scim/updater/AccountUpdaterBuilder.java   |   2 +-
 .../scim/updater/AccountUpdaterFactory.java   |   2 +-
 .../scim/updater/DefaultAccountUpdater.java   |   2 +-
 .../iam/api/scim/updater/DefaultUpdater.java  |   2 +-
 .../infn/mw/iam/api/scim/updater/Updater.java |   2 +-
 .../mw/iam/api/scim/updater/UpdaterType.java  |   4 +-
 .../builders/AccountBuilderSupport.java       |   2 +-
 .../updater/builders/AccountUpdaters.java     |   4 +-
 .../iam/api/scim/updater/builders/Adders.java |   4 +-
 .../builders/GroupMembershipManagement.java   |   8 +-
 .../api/scim/updater/builders/Removers.java   |   4 +-
 .../api/scim/updater/builders/Replacers.java  |   2 +-
 .../factory/DefaultAccountUpdaterFactory.java |   2 +-
 .../DefaultGroupMembershipUpdaterFactory.java |   2 +-
 .../api/scim/updater/util/AccountFinder.java  |   2 +-
 .../scim/updater/util/CollectionHelpers.java  |   2 +-
 .../scim/updater/util/IdNotBoundChecker.java  |   2 +-
 .../util/NullSafeNotEqualsMatcher.java        |   2 +-
 .../updater/util/ScimCollectionConverter.java |   2 +-
 .../api/scim/updater/util/ScimToEntity.java   |   2 +-
 .../DefaultScopePolicyConverter.java          |   2 +-
 .../DefaultScopePolicyService.java            |   2 +-
 .../DuplicateScopePolicyError.java            |   2 +-
 .../mw/iam/api/scope_policy/GroupRefDTO.java  |   4 +-
 .../api/scope_policy/IamAccountRefDTO.java    |   4 +-
 .../scope_policy/IamScopePolicyConverter.java |   2 +-
 .../scope_policy/InvalidScopePolicyError.java |   2 +-
 .../scope_policy/ScopePolicyController.java   |   2 +-
 .../iam/api/scope_policy/ScopePolicyDTO.java  |   7 +-
 .../ScopePolicyNotFoundError.java             |   2 +-
 .../api/scope_policy/ScopePolicyService.java  |   2 +-
 .../scope_policy/validation/IamAccountId.java |   2 +-
 .../validation/IamAccountIdValidator.java     |   2 +-
 .../scope_policy/validation/IamGroupId.java   |   2 +-
 .../validation/IamGroupIdValidator.java       |   2 +-
 .../scope_policy/validation/ScopePolicy.java  |   2 +-
 .../validation/ScopePolicyValidator.java      |  53 +-
 .../api/tokens/AccessTokensController.java    |   2 +-
 .../it/infn/mw/iam/api/tokens/Constants.java  |   2 +-
 ...DefaultTokensResourceLocationProvider.java |   2 +-
 .../api/tokens/RefreshTokensController.java   |   2 +-
 .../api/tokens/TokensControllerSupport.java   |   2 +-
 .../TokensResourceLocationProvider.java       |   2 +-
 .../api/tokens/converter/TokensConverter.java |   2 +-
 .../exception/TokenNotFoundException.java     |   2 +-
 .../mw/iam/api/tokens/model/AccessToken.java  |   2 +-
 .../mw/iam/api/tokens/model/ClientRef.java    |   2 +-
 .../mw/iam/api/tokens/model/IdTokenRef.java   |   2 +-
 .../mw/iam/api/tokens/model/RefreshToken.java |   2 +-
 .../api/tokens/model/TokensListResponse.java  |   2 +-
 .../infn/mw/iam/api/tokens/model/UserRef.java |   2 +-
 .../tokens/service/AbstractTokenService.java  |   5 +-
 .../service/DefaultAccessTokenService.java    |   2 +-
 .../service/DefaultRefreshTokenService.java   |   2 +-
 .../iam/api/tokens/service/TokenService.java  |   2 +-
 .../paging/DefaultTokensPageRequest.java      |   2 +-
 .../service/paging/TokensPageRequest.java     |   2 +-
 .../it/infn/mw/iam/api/utils/FindUtils.java   |   4 +-
 .../iam/api/utils/ValidationErrorUtils.java   |   2 +-
 .../iam/api/validators/HtmlEscapeCheck.java   |   4 +-
 .../validators/HtmlEscapeCheckValidator.java  |   2 +-
 .../mw/iam/api/validators/IamGroupName.java   |   2 +-
 .../api/validators/IamGroupNameValidator.java |   2 +-
 .../api/validators/IamGroupRequestNotes.java  |   2 +-
 .../IamGroupRequestNotesValidator.java        |   2 +-
 .../iam/api/validators/NoQueryParamsUrl.java  |   4 +-
 .../validators/NoQueryParamsUrlValidator.java |   2 +-
 .../api/validators/NoSpecialCharacters.java   |   4 +-
 .../NoSpecialCharactersValidator.java         |   2 +-
 .../mw/iam/audit/AuditDataSerializer.java     |   2 +-
 .../infn/mw/iam/audit/AuditEventLogger.java   |   2 +-
 .../mw/iam/audit/IamAuditEventLogger.java     |   2 +-
 .../it/infn/mw/iam/audit/IamAuditField.java   |   2 +-
 .../mw/iam/audit/IamAuditLoggingListener.java |   2 +-
 ...IamAuthenticationFailureAuditListener.java |   2 +-
 ...IamAuthenticationSuccessAuditListener.java |   2 +-
 .../audit/IamAuthorizationAuditListener.java  |   2 +-
 .../events/IamAuditApplicationEvent.java      |   2 +-
 .../events/account/AccountCreatedEvent.java   |   2 +-
 .../events/account/AccountDisabledEvent.java  |   2 +-
 .../account/AccountEndTimeUpdatedEvent.java   |   2 +-
 .../audit/events/account/AccountEvent.java    |   2 +-
 .../events/account/AccountLinkedEvent.java    |   2 +-
 .../events/account/AccountRemovedEvent.java   |   2 +-
 .../events/account/AccountReplacedEvent.java  |   2 +-
 .../events/account/AccountRestoredEvent.java  |   2 +-
 .../events/account/AccountUnlinkedEvent.java  |   2 +-
 .../events/account/AccountUpdatedEvent.java   |   2 +-
 .../events/account/ActiveReplacedEvent.java   |   2 +-
 .../events/account/EmailReplacedEvent.java    |   2 +-
 .../account/FamilyNameReplacedEvent.java      |   2 +-
 .../account/GivenNameReplacedEvent.java       |   2 +-
 .../events/account/PasswordReplacedEvent.java |   2 +-
 .../events/account/PictureRemovedEvent.java   |   2 +-
 .../events/account/PictureReplacedEvent.java  |   2 +-
 .../events/account/UsernameReplacedEvent.java |   2 +-
 .../account/X509CertificateLinkedEvent.java   |   2 +-
 .../account/X509CertificateUnlinkedEvent.java |   2 +-
 .../account/X509CertificateUpdatedEvent.java  |   2 +-
 .../attribute/AccountAttributeEvent.java      |   2 +-
 .../AccountAttributeRemovedEvent.java         |   2 +-
 .../attribute/AccountAttributeSetEvent.java   |   2 +-
 .../authority/AuthorityAddedEvent.java        |   2 +-
 .../account/authority/AuthorityEvent.java     |   2 +-
 .../authority/AuthorityRemovedEvent.java      |   2 +-
 .../group/GroupMembershipAddedEvent.java      |   2 +-
 .../group/GroupMembershipRemovedEvent.java    |   2 +-
 .../group/GroupMembershipUpdatedEvent.java    |   2 +-
 .../account/label/AccountLabelEvent.java      |   2 +-
 .../label/AccountLabelRemovedEvent.java       |   2 +-
 .../account/label/AccountLabelSetEvent.java   |   2 +-
 .../account/oidc/OidcAccountAddedEvent.java   |   2 +-
 .../account/oidc/OidcAccountRemovedEvent.java |   2 +-
 .../account/oidc/OidcAccountUpdatedEvent.java |   2 +-
 .../account/password/PasswordResetEvent.java  |   2 +-
 .../password/PasswordUpdatedEvent.java        |   2 +-
 .../account/saml/SamlAccountAddedEvent.java   |   2 +-
 .../account/saml/SamlAccountRemovedEvent.java |   2 +-
 .../account/saml/SamlAccountUpdatedEvent.java |   2 +-
 .../events/account/ssh/SshKeyAddedEvent.java  |   2 +-
 .../account/ssh/SshKeyRemovedEvent.java       |   2 +-
 .../account/ssh/SshKeyUpdatedEvent.java       |   2 +-
 .../x509/X509CertificateAddedEvent.java       |   2 +-
 .../x509/X509CertificateRemovedEvent.java     |   2 +-
 .../x509/X509CertificateUpdatedEvent.java     |   2 +-
 .../iam/audit/events/aup/AupCreatedEvent.java |   2 +-
 .../iam/audit/events/aup/AupDeletedEvent.java |   2 +-
 .../mw/iam/audit/events/aup/AupEvent.java     |   2 +-
 .../iam/audit/events/aup/AupSignedEvent.java  |   2 +-
 .../iam/audit/events/aup/AupUpdatedEvent.java |   2 +-
 .../events/auth/IamAuthenticationEvent.java   |   2 +-
 .../auth/IamAuthenticationFailureEvent.java   |   2 +-
 .../auth/IamAuthenticationSuccessEvent.java   |   2 +-
 .../auth/IamAuthorizationFailureEvent.java    |   2 +-
 .../audit/events/group/GroupCreatedEvent.java |   2 +-
 .../mw/iam/audit/events/group/GroupEvent.java |   2 +-
 .../audit/events/group/GroupRemovedEvent.java |   2 +-
 .../events/group/GroupReplacedEvent.java      |   2 +-
 .../events/group/label/GroupLabelEvent.java   |   2 +-
 .../group/label/GroupLabelRemovedEvent.java   |   2 +-
 .../group/label/GroupLabelSetEvent.java       |   2 +-
 .../request/GroupRequestApprovedEvent.java    |   2 +-
 .../request/GroupRequestCreatedEvent.java     |   2 +-
 .../request/GroupRequestDeletedEvent.java     |   2 +-
 .../group/request/GroupRequestEvent.java      |   2 +-
 .../request/GroupRequestRejectedEvent.java    |   2 +-
 .../RegistrationApproveEvent.java             |   2 +-
 .../RegistrationConfirmEvent.java             |   2 +-
 .../registration/RegistrationEvent.java       |   2 +-
 .../registration/RegistrationRejectEvent.java |   2 +-
 .../RegistrationRequestEvent.java             |   2 +-
 .../scope_policy/ScopePolicyCreatedEvent.java |   2 +-
 .../scope_policy/ScopePolicyDeletedEvent.java |   2 +-
 .../events/scope_policy/ScopePolicyEvent.java |   2 +-
 .../scope_policy/ScopePolicyUpdatedEvent.java |   2 +-
 .../iam/audit/utils/IamAccountSerializer.java |   2 +-
 .../audit/utils/IamAttributeSerializer.java   |   5 +-
 .../utils/IamAupSignatureSerializer.java      |   2 +-
 ...mAuthenticationFailureEventSerializer.java |   2 +-
 .../IamAuthenticationSuccessSerializer.java   |   2 +-
 ...amAuthorizationFailureEventSerializer.java |   2 +-
 .../utils/IamGroupCollectionSerializer.java   |   2 +-
 .../utils/IamGroupRequestSerializer.java      |   2 +-
 .../iam/audit/utils/IamGroupSerializer.java   |   2 +-
 .../iam/audit/utils/IamLabelSerializer.java   |   2 +-
 .../mw/iam/audit/utils/IamOidcSerializer.java |   2 +-
 .../IamRegistrationRequestSerializer.java     |   2 +-
 .../mw/iam/audit/utils/IamSamlSerializer.java |   2 +-
 .../audit/utils/IamScopePolicySerializer.java |   2 +-
 .../iam/audit/utils/IamSshKeySerializer.java  |   2 +-
 .../utils/IamX509CertificateSerializer.java   |   2 +-
 .../utils/Jackson2AuditDataSerializer.java    |   2 +-
 .../audit/utils/UpdaterTypeSerializer.java    |   2 +-
 .../AbstractExternalAuthenticationToken.java  |   2 +-
 .../AuthenticationExceptionMessageHelper.java |   2 +-
 .../authn/DefaultExternalAccountLinker.java   |   2 +-
 ...aultExternalAuthenticationHintService.java |   2 +-
 ...aultExternalAuthenticationInfoBuilder.java |   2 +-
 ...ltExternalAuthenticationInfoProcessor.java |   3 +-
 ...tInactiveAccountAuthenticationHandler.java |   2 +-
 .../EnforceAupSignatureSuccessHandler.java    |   3 +-
 .../mw/iam/authn/ExternalAccountLinker.java   |   2 +-
 .../ExternalAuthenticationFailureHandler.java |   9 +-
 .../ExternalAuthenticationHandlerSupport.java |   2 +-
 .../ExternalAuthenticationHintService.java    |   2 +-
 .../ExternalAuthenticationInfoBuilder.java    |   2 +-
 .../ExternalAuthenticationInfoProcessor.java  |   3 +-
 ...xternalAuthenticationRegistrationInfo.java |   2 +-
 .../ExternalAuthenticationSuccessHandler.java |   2 +-
 .../HintAwareAuthenticationEntryPoint.java    |   2 +-
 .../InactiveAccountAuthenticationHander.java  |   2 +-
 .../authn/RootIsDashboardSuccessHandler.java  |   2 +-
 .../iam/authn/TimestamperSuccessHandler.java  |   3 +-
 .../iam/authn/common/BaseValidatorCheck.java  |   2 +-
 .../authn/common/CompositeValidatorCheck.java |   2 +-
 .../infn/mw/iam/authn/common/Conjunction.java |   2 +-
 .../infn/mw/iam/authn/common/Disjunction.java |   2 +-
 .../it/infn/mw/iam/authn/common/Error.java    |   2 +-
 .../it/infn/mw/iam/authn/common/Fail.java     |   2 +-
 .../it/infn/mw/iam/authn/common/Negation.java |   2 +-
 .../it/infn/mw/iam/authn/common/Success.java  |   2 +-
 .../mw/iam/authn/common/ValidatorCheck.java   |   2 +-
 .../mw/iam/authn/common/ValidatorError.java   |   2 +-
 .../iam/authn/common/ValidatorResolver.java   |   2 +-
 .../mw/iam/authn/common/ValidatorResult.java  |   2 +-
 .../config/AuthenticationValidator.java       |   2 +-
 .../config/DefaultValidatorConfigParser.java  |   6 +-
 .../common/config/ValidatorConfigError.java   |   2 +-
 .../common/config/ValidatorConfigParser.java  |   2 +-
 .../common/config/ValidatorProperties.java    |   4 +-
 .../error/AccountAlreadyLinkedError.java      |   2 +-
 ...nvalidExternalAuthenticationHintError.java |   2 +-
 ...validExternalAuthenticationTokenError.java |   2 +-
 .../authn/oidc/DefaultOidcTokenRequestor.java |  13 +-
 .../oidc/DefaultRestTemplateFactory.java      |   2 +-
 .../oidc/OidcAuthenticationProvider.java      |   2 +-
 .../mw/iam/authn/oidc/OidcClientError.java    |   2 +-
 .../mw/iam/authn/oidc/OidcClientFilter.java   |   4 +-
 .../oidc/OidcExceptionMessageHelper.java      |   2 +-
 .../oidc/OidcExternalAuthenticationToken.java |   2 +-
 .../mw/iam/authn/oidc/OidcTokenRequestor.java |   2 +-
 .../iam/authn/oidc/RestTemplateFactory.java   |   2 +-
 .../model/TokenEndpointErrorResponse.java     |   2 +-
 .../DefaultOidcUserDetailsService.java        |   2 +-
 .../NullClientConfigurationService.java       |   2 +-
 .../oidc/service/OidcUserDetailsService.java  |   2 +-
 .../validator/DefaultOidcTokenValidator.java  |   2 +-
 .../DefaultOidcValidatorResolver.java         |   2 +-
 .../validator/check/ClaimPresentCheck.java    |   2 +-
 .../validator/check/ClaimRegexpMatch.java     |   2 +-
 .../CleanInactiveProvisionedAccounts.java     |   2 +-
 .../DefaultMappingPropertiesResolver.java     |   2 +-
 .../saml/DefaultMetadataLookupService.java    |   6 +-
 .../saml/DefaultSAMLUserDetailsService.java   |   2 +-
 .../authn/saml/IamCachingMetadataManager.java |   2 +-
 .../saml/IamExtendedMetadataDelegate.java     |   2 +-
 .../saml/IamSamlAuthenticationProvider.java   |   2 +-
 ...imeProvisioningSAMLUserDetailsService.java |   2 +-
 .../authn/saml/MappingPropertiesResolver.java |   2 +-
 .../iam/authn/saml/MetadataLookupService.java |   2 +-
 .../saml/SAMLUserDetailsServiceSupport.java   |   2 +-
 .../saml/SamlExceptionMessageHelper.java      |   2 +-
 .../saml/SamlExternalAuthenticationToken.java |   2 +-
 .../mw/iam/authn/saml/SamlMetadataError.java  |   2 +-
 .../iam/authn/saml/model/IdpDescription.java  |   2 +-
 .../DefaultSSOProfileOptionsResolver.java     |   2 +-
 .../iam/authn/saml/profile/IamSSOProfile.java |   2 +-
 .../saml/profile/IamSSOProfileOptions.java    |   2 +-
 .../profile/SSOProfileOptionsResolver.java    |   2 +-
 .../AbstractSamlUserIdentifierResolver.java   |   2 +-
 .../util/AttributeUserIdentifierResolver.java |   2 +-
 .../util/EPTIDUserIdentifierResolver.java     |   2 +-
 .../FirstApplicableChainedSamlIdResolver.java |   2 +-
 .../iam/authn/saml/util/IamSamlBootstrap.java |   2 +-
 .../authn/saml/util/IamSamlEntryPoint.java    |   2 +-
 .../util/NameIdUserIdentifierResolver.java    |   2 +-
 .../util/NamedSamlUserIdentifierResolver.java |   2 +-
 ...ersistentNameIdUserIdentifierResolver.java |   2 +-
 .../iam/authn/saml/util/Saml2Attribute.java   |   2 +-
 .../authn/saml/util/SamlAttributeNames.java   |   2 +-
 .../iam/authn/saml/util/SamlIdResolvers.java  |   2 +-
 .../SamlUserIdentifierResolutionResult.java   |   2 +-
 .../saml/util/SamlUserIdentifierResolver.java |   2 +-
 .../util/metadata/AbstractMetadataFilter.java |   2 +-
 .../AttributeValueMetadataFilter.java         |   2 +-
 .../EntityIdWhitelistMetadataFilter.java      |   2 +-
 .../ResearchAndScholarshipMetadataFilter.java |   2 +-
 .../SirtfiAttributeMetadataFilter.java        |   2 +-
 .../saml/util/metadata/ValidationResult.java  |   2 +-
 .../saml/validator/DefaultSamlValidator.java  |   2 +-
 .../DefaultSamlValidatorResolver.java         |   2 +-
 .../check/SamlAttributeValueRegexpMatch.java  |   2 +-
 .../check/SamlHasAttributeCheck.java          |   2 +-
 .../web/SamlRefreshMetadataController.java    |   2 +-
 .../iam/authn/saml/web/SamlSsoController.java |   2 +-
 .../iam/authn/util/AuthenticationUtils.java   |   9 +-
 .../it/infn/mw/iam/authn/util/JwtUtils.java   |   2 +-
 .../authn/util/SamlMetadataFetchTimer.java    |  11 +-
 .../iam/authn/util/SessionTimeoutHelper.java  |   4 +-
 .../infn/mw/iam/authn/util/SessionUtils.java  |   2 +-
 .../authn/x509/CertificateParsingError.java   |   2 +-
 ...X509AuthenticationCredentialExtractor.java |   2 +-
 .../x509/IamX509AuthenticationCredential.java |   2 +-
 .../x509/IamX509AuthenticationProvider.java   |   2 +-
 ...amX509AuthenticationUserDetailService.java |   2 +-
 ...X509PreauthenticationProcessingFilter.java |   4 +-
 ...X509AuthenticationCredentialExtractor.java |   2 +-
 .../x509/PEMX509CertificateChainParser.java   |   2 +-
 ...X509AuthenticationCredentialExtractor.java |   2 +-
 .../authn/x509/X509AuthenticationError.java   |   2 +-
 .../x509/X509CertificateChainParser.java      |   2 +-
 .../X509CertificateChainParsingResult.java    |   2 +-
 .../X509CertificateVerificationResult.java    |   2 +-
 .../infn/mw/iam/config/AssertionConfig.java   |   2 +-
 .../iam/config/AuthorizationServerConfig.java |   6 +-
 .../CustomAuthenticationEntryPoint.java       |   9 +-
 .../java/it/infn/mw/iam/config/IamConfig.java |  17 +-
 .../it/infn/mw/iam/config/IamProperties.java  | 182 +++++--
 .../config/IamTokenEnhancerProperties.java    |   4 +-
 .../infn/mw/iam/config/JWTCriptoConfig.java   |  35 +-
 .../it/infn/mw/iam/config/JacksonConfig.java  |   2 +-
 .../java/it/infn/mw/iam/config/JpaConfig.java |  23 +-
 .../mw/iam/config/MitreRepositoryConfig.java  |   2 +-
 .../mw/iam/config/MitreServicesConfig.java    |  52 +-
 .../java/it/infn/mw/iam/config/MvcConfig.java |  17 +-
 .../mw/iam/config/ResourceServerConfig.java   |  10 +-
 ...ecurityExpressionHandlerConfiguration.java |   2 +-
 .../it/infn/mw/iam/config/TaskConfig.java     |   2 +-
 .../infn/mw/iam/config/X509TrustConfig.java   |   2 +-
 .../mw/iam/config/cern/CernProperties.java    |   4 +-
 .../ClientRegistrationProperties.java         |   4 +-
 .../iam/config/error/IAMJWTKeystoreError.java |   2 +-
 .../config/lifecycle/LifecycleProperties.java |   2 +-
 .../mw/iam/config/login/LoginButtonImage.java |   2 +-
 .../config/login/LoginButtonProperties.java   |   4 +-
 .../infn/mw/iam/config/oidc/OidcClient.java   |   2 +-
 .../mw/iam/config/oidc/OidcConfiguration.java |   9 +-
 .../infn/mw/iam/config/oidc/OidcProvider.java |   4 +-
 .../config/oidc/OidcProviderProperties.java   |   2 +-
 .../OidcProviderValidatorCheckProperties.java |   4 +-
 .../oidc/OidcProviderValidatorProperties.java |   2 +-
 .../config/oidc/OidcValidatedProviders.java   |   2 +-
 .../saml/IamSamlIdpMetadataProperties.java    |   6 +-
 ...mSamlJITAccountProvisioningProperties.java |   6 +-
 .../iam/config/saml/IamSamlLoginShortcut.java |   4 +-
 .../mw/iam/config/saml/IamSamlProperties.java |   7 +-
 .../infn/mw/iam/config/saml/SamlConfig.java   |  82 +--
 .../mw/iam/config/scim/ScimProperties.java    |   2 +-
 .../mw/iam/config/security/CorsConfig.java    |  56 +++
 .../config/security/IamApiSecurityConfig.java |  73 +--
 .../IamTokenEndointSecurityConfig.java        |  58 ++-
 .../config/security/IamWebSecurityConfig.java |   3 +-
 .../config/security/MitreSecurityConfig.java  |  57 +--
 .../security/SpringHttpFirewallConfig.java    |  39 ++
 .../IamAuthenticationHolderEntityService.java |   3 +-
 .../core/IamLocalAuthenticationProvider.java  |   2 +-
 .../iam/core/IamThirdPartyIssuerService.java  |   2 +-
 .../it/infn/mw/iam/core/IamTokenService.java  |   2 +-
 .../mw/iam/core/IamUserDetailsService.java    |   2 +-
 .../client/ClientUserDetailsService.java}     |   9 +-
 .../client/IAMClientUserDetailsService.java   |  79 +++
 .../infn/mw/iam/core/error/StartupError.java  |   2 +-
 .../IamMethodSecurityExpressionHandler.java   |   3 +-
 .../IamSecurityExpressionMethods.java         |   3 +-
 .../IamWebSecurityExpressionHandler.java      |   3 +-
 .../core/group/DefaultIamGroupService.java    |   4 +-
 .../mw/iam/core/group/IamGroupService.java    |   2 +-
 .../iam/core/group/error/IamGroupError.java   |   2 +-
 .../error/InvalidGroupOperationError.java     |   2 +-
 .../core/group/error/NoSuchGroupError.java    |   2 +-
 .../lifecycle/ExpiredAccountsHandler.java     |  12 +-
 .../cern/CernHrLifecycleHandler.java          |   4 +-
 ...ClientCredentialsAuthenticationFilter.java |   2 +-
 .../IamIntrospectionResultAssembler.java      |   2 +-
 .../iam/core/oauth/IamJWKSetCacheService.java |   2 +-
 .../core/oauth/IamOAuth2RequestFactory.java   |   3 +-
 .../IAMJWTBearerAuthenticationProvider.java   | 233 +++++++++
 .../oauth/attributes/AttributeMapHelper.java  |   2 +-
 .../core/oauth/exchange/AnyClientMatcher.java |   3 +-
 .../oauth/exchange/ByIdClientMatcher.java     |   3 +-
 .../oauth/exchange/ByScopeClientMatcher.java  |   3 +-
 .../core/oauth/exchange/ClientMatcher.java    |   3 +-
 .../oauth/exchange/ClientMatcherFactory.java  |   2 +-
 .../exchange/DefaultTokenExchangePdp.java     |   3 +-
 .../oauth/exchange/ScopeExchangePolicy.java   |   2 +-
 .../core/oauth/exchange/TokenExchangePdp.java |   3 +-
 .../exchange/TokenExchangePdpResult.java      |   2 +-
 .../oauth/exchange/TokenExchangePolicy.java   |   3 +-
 .../granters/IamDeviceCodeTokenGranter.java   |   3 +-
 .../IamResourceOwnerPasswordTokenGranter.java |   5 +-
 .../granters/TokenExchangeTokenGranter.java   |   5 +-
 .../core/oauth/profile/IDTokenCustomizer.java |   3 +-
 .../profile/IamAccountIDTokenCustomizer.java  |   4 +-
 .../oauth/profile/IamOIDCTokenService.java    |   3 +-
 .../core/oauth/profile/IamTokenEnhancer.java  |   3 +-
 .../profile/IntrospectionResultHelper.java    |   2 +-
 .../oauth/profile/JWTAccessTokenBuilder.java  |   3 +-
 .../mw/iam/core/oauth/profile/JWTProfile.java |   2 +-
 .../oauth/profile/JWTProfileResolver.java     |   2 +-
 .../core/oauth/profile/RequestValidator.java  |   3 +-
 .../profile/ScopeAwareProfileResolver.java    |   3 +-
 .../core/oauth/profile/UserInfoHelper.java    |   3 +-
 .../profile/aarc/AarcClaimValueHelper.java    |  29 +-
 .../oauth/profile/aarc/AarcJWTProfile.java    |   3 +-
 .../AarcJWTProfileAccessTokenBuilder.java     |   3 +-
 .../aarc/AarcJWTProfileIdTokenCustomizer.java |   3 +-
 ...arcJWTProfileTokenIntrospectionHelper.java |   2 +-
 .../aarc/AarcJWTProfileUserinfoHelper.java    |   3 +-
 .../common/BaseAccessTokenBuilder.java        |   8 +-
 .../profile/common/BaseIdTokenCustomizer.java |   3 +-
 .../common/BaseIntrospectionHelper.java       |   2 +-
 .../profile/common/BaseUserinfoHelper.java    |   3 +-
 .../oauth/profile/iam/ClaimValueHelper.java   |   6 +-
 .../core/oauth/profile/iam/IamJWTProfile.java |   3 +-
 .../iam/IamJWTProfileAccessTokenBuilder.java  |   3 +-
 .../iam/IamJWTProfileIdTokenCustomizer.java   |   3 +-
 ...IamJWTProfileTokenIntrospectionHelper.java |   2 +-
 .../iam/IamJWTProfileUserinfoHelper.java      |   7 +-
 .../oauth/profile/wlcg/WLCGGroupHelper.java   |   3 +-
 .../profile/wlcg/WLCGIdTokenCustomizer.java   |   3 +-
 .../profile/wlcg/WLCGIntrospectionHelper.java |   3 +-
 .../oauth/profile/wlcg/WLCGJWTProfile.java    |   3 +-
 .../wlcg/WLCGProfileAccessTokenBuilder.java   |  13 +-
 .../profile/wlcg/WLCGUserInfoAdapter.java     |  28 +-
 .../profile/wlcg/WLCGUserinfoHelper.java      |  47 +-
 .../oauth/scope/IamSystemScopeService.java    |   2 +-
 .../matchers/DefaultScopeMatcherRegistry.java |   3 +-
 .../scope/matchers/RegexpScopeMatcher.java    |   2 +-
 .../oauth/scope/matchers/ScopeMatcher.java    |   4 +-
 .../ScopeMatcherOAuthRequestValidator.java    |   3 +-
 .../scope/matchers/ScopeMatcherRegistry.java  |   3 +-
 .../matchers/ScopeMatchersProperties.java     |   4 +-
 .../ScopeMatchersPropertiesParser.java        |   2 +-
 .../matchers/StringEqualsScopeMatcher.java    |   2 +-
 .../matchers/StructuredPathScopeMatcher.java  |   2 +-
 .../scope/pdp/DefaultScopePolicyPDP.java      |   2 +-
 .../oauth/scope/pdp/IamNullScopeFilter.java   |   2 +-
 .../oauth/scope/pdp/IamPDPScopeFilter.java    |   3 +-
 .../core/oauth/scope/pdp/IamScopeFilter.java  |   4 +-
 .../core/oauth/scope/pdp/ScopePolicyPDP.java  |   2 +-
 .../core/oidc/IamClientValidationService.java |   2 +-
 .../mw/iam/core/time/SystemTimeProvider.java  |   2 +-
 .../infn/mw/iam/core/time/TimeProvider.java   |   2 +-
 .../core/user/DefaultIamAccountService.java   |   2 +-
 .../mw/iam/core/user/IamAccountService.java   |   2 +-
 .../CredentialAlreadyBoundException.java      |   2 +-
 .../user/exception/IamAccountException.java   |   2 +-
 .../exception/InvalidCredentialException.java |   2 +-
 .../exception/UserAlreadyExistsException.java |   2 +-
 .../core/userinfo/AarcDecoratedUserInfo.java  |   2 +-
 .../mw/iam/core/userinfo/AarcUserInfo.java    |   2 +-
 .../iam/core/userinfo/DecoratedUserInfo.java  |   2 +-
 ...aultOAuth2AuthenticationScopeResolver.java |   3 +-
 .../userinfo/DelegateUserInfoAdapter.java     |   2 +-
 .../core/userinfo/IamDecoratedUserInfo.java   |   2 +-
 .../IamScopeClaimTranslationService.java      |   7 +-
 .../core/userinfo/IamUserInfoEndpoint.java    |   3 +-
 .../core/userinfo/IamUserInfoInterceptor.java |  92 ++++
 .../OAuth2AuthenticationScopeResolver.java    |   3 +-
 .../mw/iam/core/userinfo/UserInfoClaim.java   |  66 +--
 .../iam/core/util/AuthenticationLogger.java   |   2 +-
 .../util/IamAuthenticationEventPublisher.java |   2 +-
 .../core/util/IamAuthenticationLogger.java    |   3 +-
 .../it/infn/mw/iam/core/util/IamBanner.java   |   2 +-
 .../core/util/PoliteJsonMessageSource.java    |   3 +-
 .../web/DefaultLoginPageConfiguration.java    |  23 +-
 .../DefaultStartRegistrationController.java   |  13 +-
 .../mw/iam/core/web/EnforceAupFilter.java     |   2 +-
 .../mw/iam/core/web/IamDiscoveryEndpoint.java |   2 +-
 .../mw/iam/core/web/IamErrorController.java   |   9 +-
 .../mw/iam/core/web/IamRootController.java    |   2 +-
 .../iam/core/web/IamViewInfoInterceptor.java  |   6 +-
 .../iam/core/web/LoginPageConfiguration.java  |   2 +-
 .../web/jwk/IamJWKSetPublishingEndpoint.java  |   6 +-
 .../mw/iam/dashboard/DashboardController.java |   2 +-
 .../infn/mw/iam/github/GithubAuthFilter.java  |  66 ---
 .../notification/NotificationDelivery.java    |   2 +-
 .../NotificationDeliveryTask.java             |   2 +-
 .../iam/notification/NotificationFactory.java |   2 +-
 .../notification/NotificationProperties.java  |   6 +-
 .../PersistentNotificationFactory.java        |   2 +-
 .../TransientNotificationFactory.java         |   2 +-
 .../DefaultNotificationStoreService.java      |   4 +-
 .../service/JavaMailNotificationDelivery.java |   2 +-
 .../service/LoggingNotificationDelivery.java  |   2 +-
 .../service/NotificationStoreService.java     |   2 +-
 .../resolver/AddressResolutionService.java    |   2 +-
 .../AdminNotificationDeliveryStrategy.java    |   2 +-
 .../CompositeAdminsNotificationDelivery.java  |   2 +-
 .../resolver/ContextAwareAddressResolver.java |   2 +-
 .../DefaultAddressResolutionService.java      |   2 +-
 ...upManagerNotificationDeliveryStrategy.java |   2 +-
 .../IamAccountByAuthorityAddressResolver.java |   2 +-
 .../service/resolver/InvalidAudience.java     |   2 +-
 .../resolver/NotifyAdminAddressStrategy.java  |   2 +-
 .../resolver/NotifyAdminsStrategy.java        |   2 +-
 .../service/resolver/NotifyGmStrategy.java    |   2 +-
 .../resolver/NotifyGmsAndAdminsStrategy.java  |   2 +-
 .../repository/AddressAdapter.java            |   2 +-
 .../IamOAuthAccessTokenRepository.java        |   2 +-
 .../IamOAuthRefreshTokenRepository.java       |   2 +-
 .../repository/IamUserinfoRepository.java     |   2 +-
 .../repository/UserInfoAdapter.java           |   2 +-
 .../DefaultRCAuthCertificateRequestor.java    |   2 +-
 .../rcauth/DefaultRCAuthTokenRequestor.java   |   6 +-
 .../rcauth/DefaultRcAuthRequestService.java   |   2 +-
 .../rcauth/RCAuthAuthorizationResponse.java   |   4 +-
 .../rcauth/RCAuthCertificateRequestor.java    |   2 +-
 .../infn/mw/iam/rcauth/RCAuthController.java  |   2 +-
 .../it/infn/mw/iam/rcauth/RCAuthError.java    |   2 +-
 .../mw/iam/rcauth/RCAuthExchangeContext.java  |   2 +-
 .../infn/mw/iam/rcauth/RCAuthProperties.java  |   2 +-
 .../mw/iam/rcauth/RCAuthRequestService.java   |   2 +-
 .../mw/iam/rcauth/RCAuthSecurityConfig.java   |   2 +-
 .../mw/iam/rcauth/RCAuthTokenRequestor.java   |   2 +-
 .../mw/iam/rcauth/RCAuthTokenResponse.java    |   2 +-
 .../infn/mw/iam/rcauth/RCAuthX509Config.java  |   2 +-
 .../DefaultRCAuthTokenResponseVerifier.java   |   2 +-
 .../oidc/RCAuthTokenResponseVerifier.java     |   2 +-
 .../util/AddContentTypeInterceptor.java       |   2 +-
 .../rcauth/x509/CertificateRequestHolder.java |   2 +-
 .../rcauth/x509/CertificateRequestUtil.java   |   2 +-
 .../x509/DefaultProxyHelperService.java       |   2 +-
 .../iam/rcauth/x509/ProxyGenerationError.java |   2 +-
 .../iam/rcauth/x509/ProxyHelperService.java   |   2 +-
 .../DefaultRegistrationRequestService.java    |   4 +-
 .../PersistentUUIDTokenGenerator.java         |   2 +-
 .../RegistrationApiController.java            |   2 +-
 .../registration/RegistrationConverter.java   |   2 +-
 .../registration/RegistrationRequestDto.java  |   2 +-
 .../RegistrationRequestService.java           |   2 +-
 .../RegistrationUtilsController.java          |   2 +-
 .../mw/iam/registration/TokenGenerator.java   |   2 +-
 .../iam/registration/UUIDTokenGenerator.java  |   2 +-
 .../CernHrDbRequestValidatorService.java      |   2 +-
 .../RegistrationRequestValidationResult.java  |   2 +-
 .../RegistrationRequestValidationService.java |   2 +-
 .../RegistrationRequestValidatorError.java    |   2 +-
 .../mw/iam/util/BasicAuthenticationUtils.java |   2 +-
 .../infn/mw/iam/util/DumpHeadersFilter.java   |   2 +-
 .../it/infn/mw/iam/util/IamBcryptUtil.java    |   2 +-
 .../infn/mw/iam/util/JWKKeystoreLoader.java   |   2 +-
 .../it/infn/mw/iam/util/SamlDecryptUtil.java  |   2 +-
 .../iam/util/ssh/InvalidSshKeyException.java  |   2 +-
 .../mw/iam/util/ssh/RSAPublicKeyUtils.java    |  34 +-
 .../util/test/OidcSecurityContextBuilder.java |   2 +-
 .../test/SecurityContextBuilderSupport.java   |   2 +-
 .../test/saml/SamlSecurityContextBuilder.java |   2 +-
 .../it/infn/mw/iam/util/x509/X509Utils.java   |   2 +-
 .../resources-filtered/application.properties |  53 --
 .../resources-filtered/iam.version.properties |   4 +-
 .../resources/ValidationMessages.properties   |   4 +-
 .../src/main/resources/application-dev.yml    |   2 +-
 ...ication-h2-test.yml => application-h2.yml} |  38 +-
 .../main/resources/application-mysql-test.yml |  42 +-
 .../src/main/resources/application-mysql.yml  |   6 +-
 .../src/main/resources/application-oidc.yml   |   2 +-
 .../src/main/resources/application-prod.yml   |  36 +-
 .../application-saml-debug.properties         |   2 +-
 .../src/main/resources/application-saml.yml   |   2 +-
 .../main/resources/application-spid-test.yml  |   2 +-
 .../resources/application-wlcg-scopes.yml     |   2 +-
 .../src/main/resources/application.properties |  40 +-
 .../src/main/resources/application.yml        | 100 ++--
 .../accountActivated.ftl                      |   0
 .../adminHandleGroupRequest.ftl               |   0
 .../adminHandleRequest.ftl                    |   0
 .../confirmRegistration.ftl                   |   0
 .../groupMembershipApproved.ftl               |   0
 .../groupMembershipRejected.ftl               |   0
 .../requestRejected.ftl                       |   0
 .../resetPassword.ftl                         |   0
 .../src/main/resources/keystore.jwks          |  16 +-
 .../resources/saml/iam.local.io.metadata.xml  |   2 +-
 .../resources/saml/idp-metadata.signed.xml    |   2 +-
 .../src/main/resources/saml/idp-metadata.xml  |   2 +-
 .../saml/spid-idp.example.metadata.xml        |   2 +-
 .../test-idp.cloud.cnaf.infn.it.metadata.xml  |   2 +-
 .../WEB-INF/views/iam/cern/hr-error.jsp       |   2 +-
 .../views/iam/cern/insufficient-auth.jsp      |   2 +-
 .../views/iam/cern/not-a-vo-member.jsp        |   2 +-
 .../WEB-INF/views/iam/cern/register.jsp       |   2 +-
 .../webapp/WEB-INF/views/iam/dashboard.jsp    |   2 +-
 .../main/webapp/WEB-INF/views/iam/error.jsp   |   2 +-
 .../WEB-INF/views/iam/expiredsession.jsp      |   2 +-
 .../WEB-INF/views/iam/insufficient-auth.jsp   |   2 +-
 .../webapp/WEB-INF/views/iam/login-form.jsp   |   2 +-
 .../main/webapp/WEB-INF/views/iam/login.jsp   |   2 +-
 .../main/webapp/WEB-INF/views/iam/noAup.jsp   |   2 +-
 .../webapp/WEB-INF/views/iam/register.jsp     |   2 +-
 .../views/iam/registrationDisabled.jsp        |   2 +-
 .../WEB-INF/views/iam/requestSubmitted.jsp    |   2 +-
 .../WEB-INF/views/iam/requestVerified.jsp     |   2 +-
 .../WEB-INF/views/iam/resetPassword.jsp       |   2 +-
 .../WEB-INF/views/iam/samlDiscovery.jsp       |   2 +-
 .../main/webapp/WEB-INF/views/iam/signAup.jsp |   2 +-
 .../bootstrap2/css/bootstrap-responsive.css   |   2 +-
 .../css/bootstrap-responsive.min.css          |   2 +-
 .../resources/bootstrap2/css/bootstrap.css    |   2 +-
 .../bootstrap2/css/bootstrap.min.css          |   2 +-
 .../resources/bootstrap2/js/bootstrap.js      |   2 +-
 .../resources/bootstrap2/js/bootstrap.min.js  |   2 +-
 .../components/aup/aup.component.html         |   2 +-
 .../components/aup/aup.component.js           |   2 +-
 .../components/aup/aup.create.dialog.html     |   2 +-
 .../components/aup/aup.delete.dialog.html     |   2 +-
 .../components/aup/aup.edit.dialog.html       |   2 +-
 .../components/aup/aup.sign.dialog.html       |   2 +-
 .../components/common/result.component.html   |   2 +-
 .../components/common/result.component.js     |   2 +-
 .../common/user.linking.dialog.html           |   2 +-
 .../group-membership.adder.component.html     |   2 +-
 .../adder/group-membership.adder.component.js |   2 +-
 .../components/group/group.component.html     |   2 +-
 .../components/group/group.component.js       |   2 +-
 .../group/group.description.component.html    |   2 +-
 .../group/group.description.component.js      |   2 +-
 .../group/labels/group.labels.component.html  |   2 +-
 .../group/labels/group.labels.component.js    |   2 +-
 .../group/labels/set-group-label.dialog.html  |   2 +-
 .../managers/add-group-manager.dialog.html    |   2 +-
 .../managers/group.managers.component.html    |   2 +-
 .../managers/group.managers.component.js      |   2 +-
 .../managers/remove-group-manager.dialog.html |   2 +-
 .../members/group.members.component.html      |   2 +-
 .../group/members/group.members.component.js  |   2 +-
 .../group/set-group-description.dialog.html   |   2 +-
 .../group/subgroups/add-subgroup.dialog.html  |   2 +-
 .../subgroups/group.subgroups.component.html  |   2 +-
 .../subgroups/group.subgroups.component.js    |   2 +-
 .../components/groups/groups.component.html   |   2 +-
 .../components/groups/groups.component.js     |   2 +-
 .../groups/groupslist/group.add.dialog.html   |   2 +-
 .../groupslist/group.delete.dialog.html       |   2 +-
 .../groups.groupslist.component.html          |   2 +-
 .../groupslist/groups.groupslist.component.js |   2 +-
 .../groupslist/subgroup.add.dialog.html       |   2 +-
 .../search/groups.search.component.html       |   2 +-
 .../groups/search/groups.search.component.js  |   2 +-
 .../components/header/header.directive.js     |   2 +-
 .../components/header/header.html             |   2 +-
 .../group/requests.group.component.html       |   2 +-
 .../group/requests.group.component.js         |   2 +-
 .../registration/bulk-approve.dialog.html     |   2 +-
 .../registration/bulk-reject.dialog.html      |   2 +-
 .../requests.registration.component.html      |   2 +-
 .../requests.registration.component.js        |   2 +-
 .../requests/reject-request.dialog.html       |   2 +-
 .../requests/requests.component.html          |   2 +-
 .../components/requests/requests.component.js |   2 +-
 .../components/sidebar/sidebar.component.html |   2 +-
 .../components/sidebar/sidebar.component.js   |   2 +-
 .../accesslist/token.revoke.dialog.html       |   2 +-
 .../tokens.accesslist.component.html          |   2 +-
 .../accesslist/tokens.accesslist.component.js |   2 +-
 .../refreshlist/token.revoke.dialog.html      |   2 +-
 .../tokens.refreshlist.component.html         |   2 +-
 .../tokens.refreshlist.component.js           |   2 +-
 .../components/tokens/tokens.component.html   |   2 +-
 .../components/tokens/tokens.component.js     |   2 +-
 .../attributes/remove-attribute.dialog.html   |   2 +-
 .../user/attributes/set-attribute.dialog.html |   2 +-
 .../attributes/user.attributes.component.html |   2 +-
 .../attributes/user.attributes.component.js   |   2 +-
 .../user/detail/user.detail.component.html    |   2 +-
 .../user/detail/user.detail.component.js      |   2 +-
 .../user/edit/edit-user.controller.js         |   2 +-
 .../user/edit/edit-user.dialog.html           |   2 +-
 .../user/edit/user.edit.component.html        |   2 +-
 .../user/edit/user.edit.component.js          |   2 +-
 .../end-time/user.end-time.component.html     |   2 +-
 .../user/end-time/user.end-time.component.js  |   2 +-
 .../end-time/user.set-end-time.dialog.html    |   2 +-
 .../assign-group-manager-privileges.html      |   2 +-
 .../revoke-group-manager-privileges.html      |   2 +-
 .../user.group-manager.component.html         |   2 +-
 .../user.group-manager.component.js           |   2 +-
 .../cancel-group-request.dialog.html          |   2 +-
 .../group-requests/join-group.component.html  |   2 +-
 .../group-requests/join-group.component.js    |   2 +-
 .../group-requests/join-group.dialog.html     |   2 +-
 .../pending-requests.component.html           |   2 +-
 .../pending-requests.component.js             |   2 +-
 .../user/groups/user.groups.component.html    |   2 +-
 .../user/groups/user.groups.component.js      |   2 +-
 .../user/labels/user.labels.component.html    |   2 +-
 .../user/labels/user.labels.component.js      |   2 +-
 .../linked-accounts/account.link.dialog.html  |   2 +-
 .../linked-accounts/oidc-id.add.dialog.html   |   2 +-
 .../oidc-id.remove.dialog.html                |   2 +-
 .../oidc-id.unlink.dialog.html                |   2 +-
 .../linked-accounts/saml-id.add.dialog.html   |   2 +-
 .../saml-id.remove.dialog.html                |   2 +-
 .../saml-id.unlink.dialog.html                |   2 +-
 .../user.linked-accounts.component.html       |   2 +-
 .../user.linked-accounts.component.js         |   2 +-
 .../password/user.password.component.html     |   2 +-
 .../user/password/user.password.component.js  |   2 +-
 .../privileges/user.privileges.component.html |   2 +-
 .../privileges/user.privileges.component.js   |   2 +-
 .../user/saml/user.saml.component.html        |   2 +-
 .../user/saml/user.saml.component.js          |   2 +-
 .../user/ssh-keys/ssh-key.add.dialog.html     |   2 +-
 .../user/ssh-keys/ssh-key.remove.dialog.html  |   2 +-
 .../ssh-keys/user.ssh-keys.component.html     |   2 +-
 .../user/ssh-keys/user.ssh-keys.component.js  |   2 +-
 .../user/status/user.status.component.html    |   2 +-
 .../user/status/user.status.component.js      |   2 +-
 .../components/user/user.component.html       |   2 +-
 .../components/user/user.component.js         |   2 +-
 .../components/user/x509/cert.add.dialog.html |   2 +-
 .../user/x509/cert.link.dialog.html           |   2 +-
 .../user/x509/cert.remove.dialog.html         |   2 +-
 .../components/user/x509/cert.req.dialog.html |   2 +-
 .../user/x509/proxy-cert.add.dialog.html      |   2 +-
 .../user/x509/user.x509.component.html        |   2 +-
 .../user/x509/user.x509.component.js          |   2 +-
 .../components/users/users.component.html     |   2 +-
 .../components/users/users.component.js       |   2 +-
 .../users/userslist/user.add.dialog.html      |   2 +-
 .../users/userslist/user.delete.dialog.html   |   2 +-
 .../userslist/users.userslist.component.html  |   2 +-
 .../userslist/users.userslist.component.js    |   2 +-
 .../controllers/account-linking.controller.js |   2 +-
 .../account-privileges.controller.js          |   2 +-
 .../controllers/edit-me.controller.js         |   2 +-
 .../controllers/edit-password.controller.js   |   2 +-
 .../controllers/registration.controller.js    |   2 +-
 .../dashboard-app/dashboard-app.config.js     |   2 +-
 .../dashboard-app/dashboard-app.module.js     |   3 +-
 .../directives/isimage.directive.js           |   2 +-
 .../directives/operation-result.directive.js  |   2 +-
 .../directives/registration.directive.js      |   2 +-
 .../directives/userinfo-box.directive.js      |   2 +-
 .../factory/gatewayerror.interceptor.js       |   2 +-
 .../factory/sessionexpired.interceptor.js     |   2 +-
 .../dashboard-app/filters/get-by-id.filter.js |   2 +-
 .../filters/start-from.filter.js              |   2 +-
 .../services/account-group-manager.service.js |   2 +-
 .../services/account-lifecycle.service.js     |   2 +-
 .../services/account-linking.service.js       |   2 +-
 .../services/attributes.service.js            |   2 +-
 .../dashboard-app/services/aup.service.js     |   2 +-
 .../services/authorities.service.js           |   2 +-
 .../dashboard-app/services/clients.service.js |   2 +-
 .../services/clipboard.service.js             |   2 +-
 .../dashboard-app/services/find.service.js    |   2 +-
 .../services/group-requests.service.js        |   2 +-
 .../dashboard-app/services/group.service.js   |   2 +-
 .../dashboard-app/services/groups.service.js  |   2 +-
 .../dashboard-app/services/labels.service.js  |   2 +-
 .../services/load-templates.service.js        |   2 +-
 .../dashboard-app/services/modal.service.js   |   2 +-
 .../services/passwordreset.service.js         |   2 +-
 .../services/proxycert.service.js             |   2 +-
 .../services/registration.service.js          |   2 +-
 .../services/scim-factory.service.js          |   2 +-
 .../dashboard-app/services/tokens.service.js  |   2 +-
 .../dashboard-app/services/user.service.js    |   2 +-
 .../dashboard-app/services/users.service.js   |   2 +-
 .../dashboard-app/services/utils.service.js   |   2 +-
 .../templates/home/account-link-dialog.html   |   2 +-
 .../templates/home/editpassword.html          |   2 +-
 .../templates/home/edituser.html              |   2 +-
 .../templates/loading-modal.html              |   2 +-
 .../templates/operation-result.html           |   2 +-
 .../templates/user/addusergroup.html          |   2 +-
 .../templates/user/addx509certificate.html    |   2 +-
 .../user/assign-vo-admin-privileges.html      |   2 +-
 .../templates/user/edituser.html              |   2 +-
 .../user/revoke-vo-admin-privileges.html      |   2 +-
 .../dashboard-app/templates/user/user.html    |   2 +-
 .../iam/apps/registration/aup.service.js      |   2 +-
 .../apps/registration/authn-info.service.js   |   2 +-
 .../registration/privacy-policy.service.js    |   2 +-
 .../iam/apps/registration/registration.app.js |   2 +-
 .../registration/registration.controller.js   |   2 +-
 .../registration/registration.directive.js    |   2 +-
 .../iam/apps/registration/registration.html   |   2 +-
 .../apps/registration/registration.service.js |   2 +-
 .../iam/apps/saml-discovery/discovery.app.js  |   2 +-
 .../saml-discovery/discovery.component.html   |   2 +-
 .../saml-discovery/discovery.component.js     |   2 +-
 .../webapp/resources/iam/css/AdminLTE.css     |   3 +-
 .../main/webapp/resources/iam/css/fonts.css   |   2 +-
 .../src/main/webapp/resources/iam/css/iam.css |   2 +-
 .../resources/iam/css/skins/skin-blue.css     |   2 +-
 .../webapp/resources/iam/css/toaster.min.css  |   2 +-
 .../main/webapp/resources/iam/js/adminLTE.js  |   2 +-
 .../js/controller/passwordreset.controller.js |   2 +-
 .../js/controller/registration.controller.js  |   2 +-
 .../js/directive/angular-relative-date.min.js |   2 +-
 .../js/directive/passwordreset.directive.js   |   2 +-
 .../js/directive/registration.directive.js    |   2 +-
 .../webapp/resources/iam/js/iam-login-app.js  |   2 +-
 .../resources/iam/js/passwordreset.app.js     |   2 +-
 .../resources/iam/js/registration.app.js      |   2 +-
 .../iam/js/service/passwordreset.service.js   |   2 +-
 .../iam/js/service/registration.service.js    |   2 +-
 .../resources/iam/js/toaster/toaster.min.js   |   2 +-
 .../resources/iam/template/confirm-modal.html |   2 +-
 .../iam/template/forgotPassword.html          |   2 +-
 .../template/idpSelectionModalContent.html    |   2 +-
 .../resources/iam/template/registration.html  |   2 +-
 .../infn/mw/iam/test/MockMvcTestSupport.java  |  13 +-
 .../test/java/it/infn/mw/iam/test/OidcId.java |   2 +-
 .../java/it/infn/mw/iam/test/OidcIdUtils.java |   2 +-
 .../infn/mw/iam/test/RegistrationUtils.java   |   2 +-
 .../test/java/it/infn/mw/iam/test/SamlId.java |   2 +-
 .../java/it/infn/mw/iam/test/SamlIdUtils.java |   2 +-
 .../it/infn/mw/iam/test/ScimRestUtils.java    |   2 +-
 .../test/java/it/infn/mw/iam/test/SshKey.java |   2 +-
 .../java/it/infn/mw/iam/test/SshKeyUtils.java |   2 +-
 .../java/it/infn/mw/iam/test/TestUtils.java   |   4 +-
 .../java/it/infn/mw/iam/test/X509Cert.java    |   2 +-
 .../java/it/infn/mw/iam/test/X509Utils.java   |   6 +-
 .../ActuatorDisabledEnpointsTests.java        |  81 ---
 .../test/actuator/ActuatorEndpointTests.java  |  79 +++
 .../test/actuator/ActuatorEndpointsTests.java | 282 -----------
 .../ActuatorEndpointsWithTokenAuthTests.java  | 171 -------
 .../test/actuator/ActuatorTestSupport.java    |  13 +-
 .../ExternalServiceActuatorEndpointTests.java | 113 -----
 .../ExternalServiceProbeActuatorTests.java    |  52 ++
 .../actuator/MailHealthEndpointsTests.java    | 140 ------
 .../it/infn/mw/iam/test/api/TestSupport.java  |   2 +-
 .../attributes/AccountAttributesTests.java    |  54 +-
 .../AccountAuthorityEndpointTests.java        | 100 ++--
 .../find/FindAccountIntegrationTests.java     |  32 +-
 .../group/GroupMembersIntegrationTests.java   |  27 +-
 .../GroupManagerIntegrationTests.java         |  29 +-
 .../account/labels/AccountLabelsTests.java    |  61 +--
 .../lifecycle/AccountLifecycleApiTests.java   |  25 +-
 .../ReadOnlyAccountEndTimeTests.java          |  27 +-
 .../password/PasswordEncodingTests.java       |  31 +-
 .../account/password/PasswordResetTests.java  |  31 +-
 .../password/PasswordUpdateServiceTests.java  |   6 +-
 .../account/password/PasswordUpdateTests.java |  13 +-
 .../AccountProxyCertificatesTests.java        |  29 +-
 .../AccountSearchControllerSortTests.java     |  16 +-
 .../search/AccountSearchControllerTests.java  |  16 +-
 .../GroupSearchControllerSortTests.java       |  24 +-
 .../search/GroupSearchControllerTests.java    |  24 +-
 .../search/service/AccountServiceUtils.java   |   4 +-
 .../DefaultPagedAccountsServiceTests.java     |  19 +-
 .../DefaultPagedGroupsServiceTests.java       |  19 +-
 .../search/service/GroupServiceUtils.java     |   4 +-
 .../mw/iam/test/api/aup/AupAuditTests.java    |  34 +-
 .../iam/test/api/aup/AupIntegrationTests.java |  18 +-
 .../AupSignatureCheckIntegrationTests.java    |  30 +-
 .../api/aup/AupSignatureIntegrationTests.java |  31 +-
 .../mw/iam/test/api/aup/AupTestSupport.java   |   2 +-
 ...nforceAupSignatureSuccessHandlerTests.java |  17 +-
 .../test/api/common/OffsetPageableTests.java  |   4 +-
 .../mw/iam/test/api/config/ConfigTests.java   |  30 +-
 .../api/config/OidcConfigurationTests.java    |  35 +-
 .../PrivacyPolicyConfigurationTests.java      |  33 +-
 .../mw/iam/test/api/group/FindGroupTests.java |  25 +-
 .../test/api/group/GroupAttributeTests.java   |  41 +-
 .../test/api/group/GroupCreationTests.java    |  59 +--
 .../iam/test/api/group/GroupLabelTests.java   |  62 +--
 .../proxy/ProxyCertificateClockConfig.java}   |  17 +-
 .../proxy/ProxyCertificateTestSupport.java    |  16 +-
 .../api/proxy/ProxyOAuthIntegrationTests.java |  44 +-
 .../proxy/ProxyServiceIntegrationTests.java   |  52 +-
 .../iam/test/api/proxy/ProxyServiceTests.java |  27 +-
 .../requests/GroupRequestsApproveTests.java   |  33 +-
 .../requests/GroupRequestsCreateTests.java    |  32 +-
 .../requests/GroupRequestsDeleteTests.java    |  34 +-
 .../GroupRequestsGetDetailsTests.java         |  35 +-
 .../GroupRequestsGroupManagerTests.java       |  33 +-
 .../api/requests/GroupRequestsListTests.java  |  30 +-
 .../GroupRequestsPaginationTests.java         |  37 +-
 .../requests/GroupRequestsRejectTests.java    |  39 +-
 .../api/requests/GroupRequestsTestUtils.java  |   2 +-
 .../api/tokens/AccessTokenAnonymousTests.java |  17 +-
 .../tokens/AccessTokenAuthenticatedTests.java |  16 +-
 .../api/tokens/AccessTokenGetListTests.java   |  20 +-
 .../api/tokens/AccessTokenGetRevokeTests.java |  20 +-
 .../test/api/tokens/MultiValueMapBuilder.java |  22 +-
 .../tokens/RefreshTokenAnonymousTests.java    |  17 +-
 .../RefreshTokenAuthenticatedTests.java       |  16 +-
 .../api/tokens/RefreshTokenGetListTests.java  |  22 +-
 .../tokens/RefreshTokenGetRevokeTests.java    |  18 +-
 .../iam/test/api/tokens/TestTokensUtils.java  |  20 +-
 .../it/infn/mw/iam/test/audit/AuditTests.java |  30 +-
 .../mw/iam/test/audit/event/EventTests.java   |  18 +-
 .../test/core/CoreControllerTestSupport.java  |   6 +-
 .../iam/test/core/IamCoreControllerTests.java |  27 +-
 .../mw/iam/test/core/JWKLoaderErrorTests.java |   2 +-
 .../mw/iam/test/core/MeControllerTests.java   |  28 +-
 ...xternalAuthenticationHintServiceTests.java |   6 +-
 ...ernalAuthenticationInfoProcessorTests.java |  11 +-
 ...alAuthenticationRegistrationInfoTests.java |  21 +-
 ...intAwareAuthenticationEntryPointTests.java |  10 +-
 .../InactiveAccountHandlerTests.java          |   4 +-
 .../RootIsDashboardSuccessHandlerTests.java   |  11 +-
 .../ext_authn/SessionTimeoutHelperTests.java  |   6 +-
 .../AccountLinkingDisabledTests.java          |  35 +-
 .../account_linking/AccountUnlinkTests.java   |  49 +-
 .../OidcAccountLinkingMultiProviderTests.java |  38 +-
 .../OidcAccountLinkingTests.java              |  41 +-
 .../SamlAccountLinkingTests.java              |  24 +-
 .../FullyMockedOidcClientConfiguration.java   |   2 +-
 .../oidc/OidcExternalAuthenticationTests.java |  20 +-
 ...idcExternalAuthenticationTestsSupport.java |  11 +-
 .../oidc/OidcMultiProviderTestConfig.java     |   2 +-
 .../test/ext_authn/oidc/OidcTestConfig.java   |   2 +-
 .../validator/ClaimPresentCheckTests.java     |   4 +-
 .../oidc/validator/ClaimRegexpMatchTests.java |   4 +-
 .../oidc/validator/JWTTestSupport.java        |   2 +-
 .../OidcValidatorIntegrationTests.java        |  21 +-
 .../saml/AttributeMetadataFilterTests.java    |   8 +-
 .../saml/EntityIdMetadataFilterTests.java     |   6 +-
 .../saml/LocalMetadataLoadingTests.java       |  23 +-
 .../ext_authn/saml/LoginShortcutsTests.java   |  28 +-
 .../saml/MetadataFilterIntegrationTests.java  |  39 +-
 ...adataInvalidSignatureIntegrationTests.java |  34 +-
 .../saml/MetadataLookupServiceTests.java      |   6 +-
 ...etadataValidSignatureIntegrationTests.java |  29 +-
 .../test/ext_authn/saml/ResolverTests.java    |  12 +-
 .../saml/SamlAuthenticationTestSupport.java   |  18 +-
 .../ext_authn/saml/SamlControllerTests.java   |  13 +-
 .../saml/SamlExternalAuthenticationTests.java |  15 +-
 .../test/ext_authn/saml/SamlTestConfig.java   |   2 +-
 .../ext_authn/saml/WayfLoginButtonTests.java  |  31 +-
 .../JitPropertiesTests.java                   |  14 +-
 .../JitTestConfig.java                        |   2 +-
 .../JitUserCleanupTests.java                  |  10 +-
 .../JitUserDetailServiceTests.java            |  30 +-
 .../JitUserDetailsServiceTestsSupport.java    |   2 +-
 .../SamlJitAccountProvisioningTests.java      |  21 +-
 .../saml/profile/IamSamlEntryPointTests.java  |  40 +-
 .../MappingPropertiesResolverTests.java       |   6 +-
 .../profile/OptionsProfileResolverTests.java  |   6 +-
 .../saml/validator/AttributeMatchesTests.java |   6 +-
 .../validator/HasAttributeCheckTests.java     |   6 +-
 .../SamlValidatorIntegrationTests.java        |  37 +-
 .../validator/SamlValidatorResolverTests.java |   6 +-
 .../validator/SamlValidatorTestSupport.java   |   2 +-
 .../validator/CompositeChecksTests.java       |   6 +-
 .../validator/ConfigParserTests.java          |   6 +-
 .../X509AuthenticationCredentialTests.java    |   4 +-
 .../X509AuthenticationIntegrationTests.java   |  33 +-
 .../x509/X509CertificateParserTests.java      |   4 +-
 .../x509/X509CredentialExtractorTests.java    |   9 +-
 .../test/ext_authn/x509/X509TestSupport.java  |  10 +-
 .../test/lifecycle/AccountLifecycleTests.java |  28 +-
 ...untLifecycleTestsNoRemovalGracePeriod.java |  25 +-
 ...LifecycleTestsNoSuspensionGracePeriod.java |  30 +-
 .../cern/CernAccountLifecycleTests.java       |  30 +-
 .../lifecycle/cern/LifecycleTestSupport.java  |   2 +-
 .../mw/iam/test/login/LoginDisabledTests.java |  30 +-
 .../login/LoginEnabledOnlyForAdminsTests.java |  32 +-
 .../mw/iam/test/login/LoginTestSupport.java   |   2 +-
 .../it/infn/mw/iam/test/login/LoginTests.java |  33 +-
 .../RegistrationButtonDisabledTests.java      |  19 +-
 ...gistrationButtonEnabledByDefaultTests.java |  16 +-
 .../mw/iam/test/model/OrphanTokensTests.java  |  54 --
 .../NotificationDisabledTests.java            |  33 +-
 .../notification/NotificationTestConfig.java  |   2 +-
 .../RegistrationFlowFailTests.java            |  21 +-
 .../RegistrationFlowNotificationTests.java    |  21 +-
 .../AddressResolutionServiceTestSupport.java  |   2 +-
 .../AddressResolutionServiceTests.java        |   6 +-
 .../CompositeNotificationPolicyTests.java     |   6 +-
 .../resolver/GmNotificationPolicyTests.java   |   6 +-
 .../test/oauth/AccessTokenEnhancerTests.java  |  24 +-
 .../oauth/AccessTokenIncludeScopeTests.java   |  23 +-
 .../infn/mw/iam/test/oauth/AudienceTests.java |  33 +-
 .../AuthorizationCodeIntegrationTests.java    |  19 +-
 .../test/oauth/AuthorizationCodeTests.java    |  45 +-
 .../oauth/ClientRegistrationAuthzTests.java   |  34 +-
 ...ClientRegistrationScopeFilteringTests.java |  31 +-
 .../oauth/ClientRegistrationTestSupport.java  |   2 +-
 .../test/oauth/ClientRegistrationTests.java   |  34 +-
 .../iam/test/oauth/DelegateUserInfoTests.java |   4 +-
 .../mw/iam/test/oauth/DeviceCodeTests.java    |  32 +-
 .../test/oauth/DiscoveryEndpointTests.java    |  31 +-
 .../mw/iam/test/oauth/EndpointsTestUtils.java |  15 +-
 .../iam/test/oauth/IdTokenEnhancerTests.java  |  36 +-
 .../mw/iam/test/oauth/ImplicitFlowTests.java  |  43 +-
 ...rospectionEndpointAuthenticationTests.java |  31 +-
 .../oauth/IntrospectionEndpointTests.java     |  35 +-
 .../infn/mw/iam/test/oauth/NbfTokenTests.java |  27 +-
 ...Auth2AuthenticationScopeResolverTests.java |   7 +-
 .../oauth/OpenIDConnectAudienceTests.java     |  38 +-
 .../iam/test/oauth/ParametricScopeTests.java  |  52 --
 ...ResourceOwnerPasswordCredentialsTests.java |  36 +-
 .../test/oauth/RevocationEndpointTests.java   |  41 +-
 ...okenEndpointClientAuthenticationTests.java |  34 +-
 .../mw/iam/test/oauth/TokenExchangeTests.java |  63 +--
 .../iam/test/oauth/UserInfoEndpointTests.java |  27 +-
 ...arerAuthenticationProviderTestSupport.java |  73 +++
 ...MJWTBearerAuthenticationProviderTests.java | 474 ++++++++++++++++++
 ...tAuthenticationIntegrationTestSupport.java |  91 ++++
 ...rClientAuthenticationIntegrationTests.java |  88 ++++
 .../AttributeOAuthEncodingTests.java          |  21 +-
 .../exchange/ClientMatcherFactoryTests.java   |   6 +-
 .../ExchangePolicyApiIntegrationTests.java    |  42 +-
 .../TokenExchagePolicyBuilderTests.java       |   6 +-
 .../oauth/exchange/TokenExchangePdPTests.java |  11 +-
 .../exchange/TokenExchangePdpTestSupport.java |   2 +-
 .../TokenExchangeWithPdpIntegrationTests.java |  36 +-
 .../{ => jwk}/JWKCacheSetServiceTests.java    |  34 +-
 .../test/oauth/jwk/JWKDefaultKeyTests.java    |  80 +++
 .../mw/iam/test/oauth/jwk/JWKECKeyTests.java  |  77 +++
 .../oauth/{ => jwk}/JWKEndpointTests.java     |  48 +-
 .../iam/test/oauth/jwk/JWKTestSupport.java}   |  23 +-
 .../labels/LabelsOAuthEncodingTests.java      |  22 +-
 .../profile/AarcClaimValueHelperTests.java    |  74 +--
 .../profile/AarcProfileIntegrationTests.java  |  40 +-
 .../profile/IamAccessTokenBuilderTests.java   |  11 +-
 .../oauth/profile/ProfileSelectorTests.java   |   7 +-
 .../oauth/profile/WLCGGroupHelperTests.java   |  13 +-
 .../profile/WLCGProfileIntegrationTests.java  |  79 ++-
 .../WLCGProfileUserinfoEndpointTests.java     | 117 +++++
 .../scope/DynClientScopeValidationTests.java  |  13 +-
 .../scope/OAuthRequestValidatorTests.java     |   7 +-
 .../oauth/scope/ScopeMatcherParsingTests.java |   6 +-
 .../test/oauth/scope/ScopeMatcherTests.java   |   6 +-
 .../test/oauth/scope/ScopeRegistryTests.java  |   7 +-
 ...tructuredScopeRequestIntegrationTests.java |  30 +-
 .../StructuredScopeTestSupportConstants.java  |   2 +-
 .../oauth/scope/pdp/NullScopeFilterTests.java |   6 +-
 .../pdp/ScopePolicyApiIntegrationTests.java   |  31 +-
 .../scope/pdp/ScopePolicyAuditTests.java      |  10 +-
 .../scope/pdp/ScopePolicyConverterTests.java  |   6 +-
 .../ScopePolicyFilteringIntegrationTests.java |  32 +-
 .../ScopePolicyJacksonSerializerTests.java    |   4 +-
 .../oauth/scope/pdp/ScopePolicyPdpTests.java  |  16 +-
 .../RCAuthCertificateRequestorTests.java      |  52 +-
 .../test/rcauth/RCAuthIntegrationTests.java   |  61 ++-
 .../mw/iam/test/rcauth/RCAuthTestConfig.java  |  63 +++
 .../mw/iam/test/rcauth/RCAuthTestSupport.java |  48 +-
 .../rcauth/RCAuthTokenRequestorTests.java     |  61 ++-
 .../iam/test/rcauth/RequestServiceTests.java  |   8 +-
 ...ternalAuthenticationRegistrationTests.java |  43 +-
 .../OidcExtAuthRegistrationTests.java         |  40 +-
 .../RegistrationLifecycleTests.java           |  34 +-
 .../RegistrationPrivilegedTests.java          |  52 +-
 .../RegistrationUnprivilegedTests.java        |  43 +-
 .../RegistrationUsernameTests.java            |  48 +-
 .../SamlExtAuthRegistrationTests.java         |  24 +-
 ...quiredAuthenticationRegistrationTests.java |  48 +-
 ...quiredAuthenticationRegistrationTests.java |  46 +-
 .../cern/CernHrDbApiClientTests.java          |  54 +-
 ...ernRegistrationValidationServiceTests.java |  39 +-
 .../registration/cern/CernTestSupport.java    |   2 +-
 .../repository/IamAccountRepositoryTests.java |  23 +-
 .../repository/IamAupRepositoryTests.java     |  26 +-
 .../IamAupSignatureRepositoryTests.java       |  27 +-
 .../repository/IamGroupRepositoryTests.java   |  20 +-
 .../IamScopePolicyRepositoryTests.java        |  29 +-
 .../repository/IamTokenRepositoryTests.java   |  30 +-
 .../test/repository/ScopePolicyTestUtils.java |   2 +-
 .../LocalResourcesDisabledByDefaultTests.java |  29 +-
 .../resources/LocalResourcesEnabledTests.java |  33 +-
 .../iam/test/saml/AssertionBuilderTests.java  |   4 +-
 .../it/infn/mw/iam/test/scim/RestUtils.java   |  25 +-
 .../mw/iam/test/scim/ScimRestUtilsMvc.java    |  12 +-
 .../it/infn/mw/iam/test/scim/ScimUtils.java   |   4 +-
 .../ScimAccountLabelConverterTests.java       |  39 +-
 .../ScimX509CertificateConverterTests.java    |   4 +-
 ...ngTests.java => ScimUserServiceTests.java} |  17 +-
 .../scim/group/ScimGroupManagerTests.java     |  34 +-
 ...GroupProvisioningAttributeFilterTests.java |  32 +-
 .../group/ScimGroupProvisioningListTests.java |  41 +-
 .../group/ScimGroupProvisioningTests.java     |  46 +-
 .../test/scim/group/ScimNestedGroupTests.java |  42 +-
 .../scim/group/patch/ScimGroupPatchUtils.java |   3 +-
 .../ScimGroupProvisioningPatchAddTests.java   |  26 +-
 ...ScimGroupProvisioningPatchRemoveTests.java |  30 +-
 ...cimGroupProvisioningPatchReplaceTests.java |  28 +-
 .../mw/iam/test/scim/me/ScimMeAupTests.java   |  26 +-
 .../iam/test/scim/me/ScimMeEndpointTests.java |  26 +-
 .../me/patch/ScimMeEndpointPatchAddTests.java |  42 +-
 .../patch/ScimMeEndpointPatchRemoveTests.java |  23 +-
 .../ScimMeEndpointPatchReplaceTests.java      |  23 +-
 .../scim/me/patch/ScimMeEndpointUtils.java    |   2 +-
 .../iam/test/scim/model/ScimAddressTests.java |   2 +-
 .../scim/updater/AccountUpdatersTests.java    |  47 +-
 .../DefaultAccountUpdaterFactoryTests.java    |  59 +--
 .../test/scim/user/ScimUserCreationTests.java |  56 ++-
 ...mUserProvisioningAttributeFilterTests.java |  25 +-
 .../user/ScimUserProvisioningListTests.java   |  25 +-
 .../ScimUserProvisioningPatchRemoveTests.java |  65 ++-
 ...ScimUserProvisioningPatchReplaceTests.java |  45 +-
 .../user/ScimUserProvisioningPatchTests.java  |  23 +-
 .../scim/user/ScimUserProvisioningTests.java  | 129 +++--
 .../test/scim/user/ScimUserTestSupport.java   |  55 +-
 .../scim/user/ScimUserValidationTests.java    |  22 +-
 .../test/scim/user/x509/ScimX509Tests.java    |  31 +-
 .../iam/test/service/AccountUtilsTests.java   |  13 +-
 .../DefaultNotificationStoreServiceTests.java |  59 +--
 .../service/IamAccountServiceTestSupport.java |   2 +-
 .../test/service/IamAccountServiceTests.java  |  22 +-
 .../JavamailNotificationDeliveryTests.java    |  37 +-
 .../mw/iam/test/util/AuthenticationUtils.java |   2 +-
 .../iam/test/util/DateEqualModulo1Second.java |   2 +-
 .../iam/test/util/IamTestProfileResolver.java |   2 +-
 .../infn/mw/iam/test/util/JacksonUtils.java   |   2 +-
 .../test/util/MockMailHealthIndicator.java    |  77 ---
 .../mw/iam/test/util/MockSmtpServerUtils.java |   2 +-
 .../mw/iam/test/util/MockTimeProvider.java    |   2 +-
 .../NullSafeSystemProfileValueSource.java     |   2 +-
 .../mw/iam/test/util/RSAPublicKeyTests.java   |  60 +--
 .../mw/iam/test/util/WithAnonymousUser.java   |   2 +-
 ...thAnonymousUserSecurityContextFactory.java |   2 +-
 .../mw/iam/test/util/WithMockOAuthUser.java   |   2 +-
 .../mw/iam/test/util/WithMockOIDCUser.java    |   2 +-
 .../util/WithMockPrivilegedOAuthUser.java     |   2 +-
 .../mw/iam/test/util/WithMockSAMLUser.java    |   2 +-
 .../util/WithMockUnprivilegedOAuthUser.java   |   2 +-
 .../annotation/IamMockMvcIntegrationTest.java |  40 ++
 .../test/util/annotation/IamNoMvcTest.java    |  35 ++
 .../IamRandomPortIntegrationTest.java         |  33 ++
 .../MockNotificationDelivery.java             |   2 +-
 .../iam/test/util/oauth/MockOAuth2Filter.java |   3 +-
 .../test/util/oauth/MockOAuth2Request.java    |   3 +-
 .../WithMockOAuth2SecurityContextFactory.java |   3 +-
 .../iam/test/util/oidc/CodeRequestHolder.java |   2 +-
 .../mw/iam/test/util/oidc/IdTokenBuilder.java |   5 +-
 .../iam/test/util/oidc/MockOIDCProvider.java  |   2 +-
 .../util/oidc/MockRestTemplateFactory.java    |   2 +-
 .../mw/iam/test/util/oidc/TokenResponse.java  |   2 +-
 ...ithMockOIDCUserSecurityContextFactory.java |   2 +-
 .../test/util/saml/SamlAssertionBuilder.java  |   2 +-
 .../test/util/saml/SamlResponseBuilder.java   |   2 +-
 .../infn/mw/iam/test/util/saml/SamlUtils.java |   2 +-
 .../WithSamlUserSecurityContextFactory.java   |   2 +-
 .../resources/client_auth/client-keys.jwk     |  16 +
 .../src/test/resources/jwk/ec.jwks            |  14 +
 .../src/test/resources/jwk/iam-keys.jwks      |  28 ++
 .../src/test/resources/oidc/mock_op_keys.jks  |  14 +-
 .../test/resources/saml/metadata/iam-md.xml   |   2 +-
 .../resources/spring.properties}              |  11 +-
 iam-persistence/pom.xml                       |  17 +-
 .../migration/h2/V10_1__Password_Update.java  |   7 +-
 .../h2/V10_2___CheckDuplicateEmails.java      |   7 +-
 .../V23___CreateGroupManagerAuthorities.java  |   9 +-
 .../h2/V34_2___RemoveOrphanTokens.java        |   7 +-
 .../mysql/V10_1__Password_Update.java         |   7 +-
 .../mysql/V10_2___CheckDuplicateEmails.java   |   7 +-
 .../V23___CreateGroupManagerAuthorities.java  |   9 +-
 .../mysql/V34_2___RemoveOrphanTokens.java     |   7 +-
 .../tasks}/CreateGroupManagerAuthorities.java |  11 +-
 .../migration/tasks/RemoveOrphanTokens.java   |   7 +-
 ...000_1___CreateGroupManagerAuthorities.java |   9 +-
 .../test/V100000_3___RemoveOrphanTokens.java  |   7 +-
 .../infn/mw/iam/core/IamDeliveryStatus.java   |   2 +-
 .../mw/iam/core/IamGroupRequestStatus.java    |   2 +-
 .../infn/mw/iam/core/IamNotificationType.java |   2 +-
 .../core/IamRegistrationRequestStatus.java    |   2 +-
 .../java/it/infn/mw/iam/core/NameUtils.java   |   2 +-
 .../BaseFlywayJavaMigrationAdapter.java       |  35 ++
 ...on.java => SpringJdbcFlywayMigration.java} |  13 +-
 .../mw/iam/persistence/model/Address.java     |   2 +-
 .../mw/iam/persistence/model/IamAccount.java  |   2 +-
 .../persistence/model/IamAccountGroupKey.java |   2 +-
 .../model/IamAccountGroupMembership.java      |   8 +-
 .../iam/persistence/model/IamAccountRef.java  |   2 +-
 .../mw/iam/persistence/model/IamAddress.java  |   2 +-
 .../iam/persistence/model/IamAttribute.java   |   2 +-
 .../infn/mw/iam/persistence/model/IamAup.java |   2 +-
 .../persistence/model/IamAupSignature.java    |   2 +-
 .../iam/persistence/model/IamAuthority.java   |   2 +-
 .../model/IamClientMatchingPolicy.java        |  13 +-
 .../model/IamEmailNotification.java           |   2 +-
 .../IamExternalAuthenticationAttribute.java   |   2 +-
 .../IamExternalAuthenticationDetails.java     |   2 +-
 .../mw/iam/persistence/model/IamGroup.java    |   2 +-
 .../persistence/model/IamGroupRequest.java    |   2 +-
 .../mw/iam/persistence/model/IamLabel.java    |   2 +-
 .../model/IamNotificationReceiver.java        |   2 +-
 .../mw/iam/persistence/model/IamOidcId.java   |   2 +-
 .../model/IamRegistrationRequest.java         |   2 +-
 .../mw/iam/persistence/model/IamSamlId.java   |   2 +-
 .../model/IamScopeMatchingPolicy.java         |   2 +-
 .../iam/persistence/model/IamScopePolicy.java |   2 +-
 .../mw/iam/persistence/model/IamSshKey.java   |   2 +-
 .../model/IamTokenExchangePolicyEntity.java   |  19 +-
 .../model/IamTokenExchangeScopePolicy.java    |   7 +-
 .../mw/iam/persistence/model/IamUserInfo.java |   2 +-
 .../persistence/model/IamX509Certificate.java |   2 +-
 .../model/IamX509ProxyCertificate.java        |   2 +-
 .../mw/iam/persistence/model/PolicyRule.java  |   2 +-
 .../repository/IamAccountRepository.java      |   2 +-
 .../IamAccountRepositoryCustom.java           |   2 +-
 .../repository/IamAccountRepositoryImpl.java  |   2 +-
 .../repository/IamAupRepository.java          |   2 +-
 .../repository/IamAupRepositoryCustom.java    |   2 +-
 .../repository/IamAupRepositoryImpl.java      |   2 +-
 .../IamAupSignatureNotFoundError.java         |   2 +-
 .../repository/IamAupSignatureRepository.java |   2 +-
 .../IamAupSignatureRepositoryCustom.java      |   2 +-
 .../IamAupSignatureRepositoryImpl.java        |   2 +-
 .../repository/IamAuthoritiesRepository.java  |   2 +-
 .../IamEmailNotificationRepository.java       |   2 +-
 ...ternalAuthenticationDetailsRepository.java |   2 +-
 .../repository/IamGroupRepository.java        |   2 +-
 .../repository/IamGroupRequestRepository.java |   2 +-
 .../IamNotificationReceiverRepository.java    |   2 +-
 .../repository/IamOidcIdRepository.java       |   2 +-
 .../IamRegistrationRequestRepository.java     |   2 +-
 .../repository/IamSamlIdRepository.java       |   2 +-
 .../repository/IamScopePolicyRepository.java  |   2 +-
 .../IamScopePolicyRepositoryCustom.java       |   2 +-
 .../IamScopePolicyRepositoryImpl.java         |   2 +-
 .../repository/IamSshKeyRepository.java       |   2 +-
 .../IamTokenExchangePolicyRepository.java     |   2 +-
 .../db/migration/h2/V40___aup_updates.sql     |   2 +-
 .../db/migration/test/V100000___test_data.sql |   9 +
 iam-test-client/docker/Dockerfile             |   4 +-
 iam-test-client/docker/Dockerfile.prod        |   4 +-
 iam-test-client/pom.xml                       |  15 +-
 .../main/java/it/infn/mw/tc/IamClient.java    |   7 +-
 .../IamDynamicServerConfigurationService.java |   4 +-
 .../it/infn/mw/tc/IamOIDCClientFilter.java    |   2 +-
 .../infn/mw/tc/IamTestClientApplication.java  |   6 +-
 .../it/infn/mw/tc/IamUserInfoFetcher.java     |   2 +-
 .../java/it/infn/mw/tc/LocalController.java   |   8 +-
 .../src/main/resources/application.properties |   4 +-
 iam-test-protected-resource/.gitignore        |   2 -
 iam-test-protected-resource/pom.xml           | 100 ----
 .../IamTestProtectedResourceApplication.java  |  13 -
 .../it/infn/mw/pr/InMemoryTaskService.java    |  44 --
 .../mw/pr/ProtectedResourceConfiguration.java |  80 ---
 .../src/main/java/it/infn/mw/pr/Task.java     |  68 ---
 .../java/it/infn/mw/pr/TaskController.java    |  59 ---
 .../main/java/it/infn/mw/pr/TaskService.java  |  15 -
 .../src/main/resources/application.yml        |  14 -
 pom.xml                                       | 113 +----
 1418 files changed, 6845 insertions(+), 7889 deletions(-)
 rename .github/workflows/{sonar.yaml.disabled => sonar.yaml} (88%)
 create mode 100644 compose/custom-logging/logback-spring.xml
 delete mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/actuator/IamHealthConfiguration.java
 delete mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/actuator/endpoint/ExternalServiceProbeEndpoint.java
 delete mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/actuator/endpoint/MailHealthEndpoint.java
 delete mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/actuator/endpoint/mvc/ExternalServiceHealthMvcEndpoint.java
 delete mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/actuator/endpoint/mvc/MailHealthMvcEndpoint.java
 create mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/actuator/health/ExternalConnectivityHealthIndicator.java
 delete mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/actuator/health/ExternalServiceProbeIndicator.java
 create mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/config/security/CorsConfig.java
 create mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/config/security/SpringHttpFirewallConfig.java
 rename iam-login-service/src/main/java/it/infn/mw/iam/{api/scim/model/ScimAttribute.java => core/client/ClientUserDetailsService.java} (67%)
 create mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/core/client/IAMClientUserDetailsService.java
 create mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/assertion/IAMJWTBearerAuthenticationProvider.java
 create mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/core/userinfo/IamUserInfoInterceptor.java
 delete mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/github/GithubAuthFilter.java
 delete mode 100644 iam-login-service/src/main/resources-filtered/application.properties
 rename iam-login-service/src/main/resources/{application-h2-test.yml => application-h2.yml} (64%)
 rename iam-login-service/src/main/resources/{templates => email-templates}/accountActivated.ftl (100%)
 rename iam-login-service/src/main/resources/{templates => email-templates}/adminHandleGroupRequest.ftl (100%)
 rename iam-login-service/src/main/resources/{templates => email-templates}/adminHandleRequest.ftl (100%)
 rename iam-login-service/src/main/resources/{templates => email-templates}/confirmRegistration.ftl (100%)
 rename iam-login-service/src/main/resources/{templates => email-templates}/groupMembershipApproved.ftl (100%)
 rename iam-login-service/src/main/resources/{templates => email-templates}/groupMembershipRejected.ftl (100%)
 rename iam-login-service/src/main/resources/{templates => email-templates}/requestRejected.ftl (100%)
 rename iam-login-service/src/main/resources/{templates => email-templates}/resetPassword.ftl (100%)
 delete mode 100644 iam-login-service/src/test/java/it/infn/mw/iam/test/actuator/ActuatorDisabledEnpointsTests.java
 create mode 100644 iam-login-service/src/test/java/it/infn/mw/iam/test/actuator/ActuatorEndpointTests.java
 delete mode 100644 iam-login-service/src/test/java/it/infn/mw/iam/test/actuator/ActuatorEndpointsTests.java
 delete mode 100644 iam-login-service/src/test/java/it/infn/mw/iam/test/actuator/ActuatorEndpointsWithTokenAuthTests.java
 delete mode 100644 iam-login-service/src/test/java/it/infn/mw/iam/test/actuator/ExternalServiceActuatorEndpointTests.java
 create mode 100644 iam-login-service/src/test/java/it/infn/mw/iam/test/actuator/ExternalServiceProbeActuatorTests.java
 delete mode 100644 iam-login-service/src/test/java/it/infn/mw/iam/test/actuator/MailHealthEndpointsTests.java
 rename iam-login-service/src/test/java/it/infn/mw/iam/test/{actuator/MailHealthEndpointsTestsConfig.java => api/proxy/ProxyCertificateClockConfig.java} (76%)
 delete mode 100644 iam-login-service/src/test/java/it/infn/mw/iam/test/model/OrphanTokensTests.java
 delete mode 100644 iam-login-service/src/test/java/it/infn/mw/iam/test/oauth/ParametricScopeTests.java
 create mode 100644 iam-login-service/src/test/java/it/infn/mw/iam/test/oauth/assertion/IAMJWTBearerAuthenticationProviderTestSupport.java
 create mode 100644 iam-login-service/src/test/java/it/infn/mw/iam/test/oauth/assertion/IAMJWTBearerAuthenticationProviderTests.java
 create mode 100644 iam-login-service/src/test/java/it/infn/mw/iam/test/oauth/assertion/JWTBearerClientAuthenticationIntegrationTestSupport.java
 create mode 100644 iam-login-service/src/test/java/it/infn/mw/iam/test/oauth/assertion/JWTBearerClientAuthenticationIntegrationTests.java
 rename iam-login-service/src/test/java/it/infn/mw/iam/test/oauth/{ => jwk}/JWKCacheSetServiceTests.java (81%)
 create mode 100644 iam-login-service/src/test/java/it/infn/mw/iam/test/oauth/jwk/JWKDefaultKeyTests.java
 create mode 100644 iam-login-service/src/test/java/it/infn/mw/iam/test/oauth/jwk/JWKECKeyTests.java
 rename iam-login-service/src/test/java/it/infn/mw/iam/test/oauth/{ => jwk}/JWKEndpointTests.java (50%)
 rename iam-login-service/src/{main/java/it/infn/mw/iam/actuator/endpoint/IamMailHealthIndicator.java => test/java/it/infn/mw/iam/test/oauth/jwk/JWKTestSupport.java} (57%)
 create mode 100644 iam-login-service/src/test/java/it/infn/mw/iam/test/oauth/profile/WLCGProfileUserinfoEndpointTests.java
 create mode 100644 iam-login-service/src/test/java/it/infn/mw/iam/test/rcauth/RCAuthTestConfig.java
 rename iam-login-service/src/test/java/it/infn/mw/iam/test/scim/core/provisioning/user/{ScimUserProvisioningTests.java => ScimUserServiceTests.java} (91%)
 delete mode 100644 iam-login-service/src/test/java/it/infn/mw/iam/test/util/MockMailHealthIndicator.java
 create mode 100644 iam-login-service/src/test/java/it/infn/mw/iam/test/util/annotation/IamMockMvcIntegrationTest.java
 create mode 100644 iam-login-service/src/test/java/it/infn/mw/iam/test/util/annotation/IamNoMvcTest.java
 create mode 100644 iam-login-service/src/test/java/it/infn/mw/iam/test/util/annotation/IamRandomPortIntegrationTest.java
 create mode 100644 iam-login-service/src/test/resources/client_auth/client-keys.jwk
 create mode 100644 iam-login-service/src/test/resources/jwk/ec.jwks
 create mode 100644 iam-login-service/src/test/resources/jwk/iam-keys.jwks
 rename iam-login-service/src/{main/resources/application-import.yml => test/resources/spring.properties} (79%)
 rename iam-persistence/src/main/java/{it/infn/mw/iam/persistence/migrations => db/migration/tasks}/CreateGroupManagerAuthorities.java (81%)
 create mode 100644 iam-persistence/src/main/java/it/infn/mw/iam/persistence/migrations/BaseFlywayJavaMigrationAdapter.java
 rename iam-persistence/src/main/java/it/infn/mw/iam/persistence/migrations/{BaseJdbcTemplateFlywayMigration.java => SpringJdbcFlywayMigration.java} (73%)
 delete mode 100644 iam-test-protected-resource/.gitignore
 delete mode 100644 iam-test-protected-resource/pom.xml
 delete mode 100644 iam-test-protected-resource/src/main/java/it/infn/mw/pr/IamTestProtectedResourceApplication.java
 delete mode 100644 iam-test-protected-resource/src/main/java/it/infn/mw/pr/InMemoryTaskService.java
 delete mode 100644 iam-test-protected-resource/src/main/java/it/infn/mw/pr/ProtectedResourceConfiguration.java
 delete mode 100644 iam-test-protected-resource/src/main/java/it/infn/mw/pr/Task.java
 delete mode 100644 iam-test-protected-resource/src/main/java/it/infn/mw/pr/TaskController.java
 delete mode 100644 iam-test-protected-resource/src/main/java/it/infn/mw/pr/TaskService.java
 delete mode 100644 iam-test-protected-resource/src/main/resources/application.yml

diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml
index 6794e9c93..09fad1749 100644
--- a/.github/workflows/maven.yml
+++ b/.github/workflows/maven.yml
@@ -4,6 +4,10 @@ on: [push, pull_request]
 
 jobs:
   build:
+    strategy:
+      matrix:
+        java-version: [11]
+
     runs-on: ubuntu-latest
 
     steps:
@@ -11,10 +15,12 @@ jobs:
       uses: actions/checkout@v2
       with:
         fetch-depth: 0
-    - name: Set up JDK 1.8
+
+    - name: Set up JDK ${{matrix.java-version}}
       uses: actions/setup-java@v1
       with:
-        java-version: 1.8
+        java-version: ${{matrix.java-version}}
+
     - name: Cache Maven packages
       uses: actions/cache@v1
       with:
@@ -34,6 +40,7 @@ jobs:
       run: |
         cp iam-login-service/target/iam-login-service.war iam-login-service/docker
         cp iam-test-client/target/iam-test-client.jar iam-test-client/docker
+
     - name: Build & push iam-login-service docker image
       uses: docker/build-push-action@v1
       with:
@@ -44,7 +51,8 @@ jobs:
         tag_with_sha: true
         dockerfile: iam-login-service/docker/Dockerfile.prod
         path: iam-login-service/docker
-        push: ${{ startsWith(github.ref, 'refs/tags/') }}
+        push: ${{ matrix.java-version == '11' && startsWith(github.ref, 'refs/tags/') }}
+
     - name: Build & push iam-test-client docker image
       uses: docker/build-push-action@v1
       with:
@@ -55,4 +63,4 @@ jobs:
         tag_with_sha: true
         dockerfile: iam-test-client/docker/Dockerfile.prod
         path: iam-test-client/docker
-        push: ${{ startsWith(github.ref, 'refs/tags/') }}
+        push: ${{ matrix.java-version == '11' && startsWith(github.ref, 'refs/tags/') }}
diff --git a/.github/workflows/sonar.yaml.disabled b/.github/workflows/sonar.yaml
similarity index 88%
rename from .github/workflows/sonar.yaml.disabled
rename to .github/workflows/sonar.yaml
index fc500d087..8814f160f 100644
--- a/.github/workflows/sonar.yaml.disabled
+++ b/.github/workflows/sonar.yaml
@@ -1,12 +1,15 @@
 name: Sonar analysis
 
 on: 
-  
   pull_request:
     types: [opened, edited, reopened, synchronize]
 
 jobs:
   build:
+    strategy:
+      matrix:
+        java-version: [11]
+
     runs-on: ubuntu-latest
 
     steps:
@@ -14,16 +17,19 @@ jobs:
       uses: actions/checkout@v2
       with:
         fetch-depth: 0
-    - name: Set up JDK 1.8
+
+    - name: Set up JDK ${{matrix.java-version}}
       uses: actions/setup-java@v1
       with:
-        java-version: 1.8
+        java-version: ${{matrix.java-version}}
+
     - name: Cache Maven packages
       uses: actions/cache@v1
       with:
         path: ~/.m2
         key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
         restore-keys: ${{ runner.os }}-m2
+
     - name: Sonar analysis
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/Jenkinsfile b/Jenkinsfile
index e20ea07f4..0be6fbcc2 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -4,6 +4,13 @@
 def kubeLabel = getKubeLabel()
 
 def maybeArchiveJUnitReports(){
+  def hasJunitReports = fileExists 'iam-login-service/target/surefire-reports'
+  if (hasJunitReports) {
+    junit '**/target/surefire-reports/TEST-*.xml'
+  }
+}
+
+def maybeArchiveJUnitReportsWithJacoco(){
   def hasJunitReports = fileExists 'iam-login-service/target/surefire-reports'
   if (hasJunitReports) {
     junit '**/target/surefire-reports/TEST-*.xml'
@@ -11,6 +18,7 @@ def maybeArchiveJUnitReports(){
   }
 }
 
+
 pipeline {
 
   agent any
@@ -45,7 +53,7 @@ pipeline {
           label "${kubeLabel}"
           cloud 'Kube mwdevel'
           defaultContainer 'runner'
-          inheritFrom 'iam-template'
+          inheritFrom 'iam-template-java11'
         }
       }
 
@@ -86,6 +94,14 @@ pipeline {
           steps {
             sh 'mvn -B test'
           }
+
+          post {
+            always {
+              script {
+                maybeArchiveJUnitReports()
+              }
+            }
+          }
         }
 
         stage('PR analysis'){
@@ -128,7 +144,7 @@ pipeline {
           post {
             always {
               script {
-                maybeArchiveJUnitReports()
+                maybeArchiveJUnitReportsWithJacoco()
               }
             }
             unsuccessful {
diff --git a/LICENSE b/LICENSE
index 417a67386..d628eaf0e 100644
--- a/LICENSE
+++ b/LICENSE
@@ -1,4 +1,4 @@
-Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
diff --git a/compose/custom-logging/logback-spring.xml b/compose/custom-logging/logback-spring.xml
new file mode 100644
index 000000000..c82cf980c
--- /dev/null
+++ b/compose/custom-logging/logback-spring.xml
@@ -0,0 +1,42 @@
+
+
+
+
+  
+  
+
+  
+
+    ${IAM_LOG_PATH:=/var/log/iam}/iam-audit.log
+
+    
+      ${IAM_LOG_PATH:-/var/log/iam}/iam-audit-%d{yyyy-MM-dd}.log.gz
+    
+
+    
+      ${FILE_LOG_PATTERN}
+    
+  
+
+  
+
+    ${IAM_LOG_PATH:-/var/log/iam}/iam-service.log
+
+    
+      ${IAM_LOG_PATH:-/var/log/iam}/iam-service-%d{yyyy-MM-dd}.log.gz
+    
+
+    
+      ${FILE_LOG_PATTERN}
+    
+  
+
+  
+    
+  
+
+  
+    
+    
+  
+
\ No newline at end of file
diff --git a/docker-compose.yml b/docker-compose.yml
index 173001a3d..1e666b7ae 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,6 +1,7 @@
 version: '3.5'
 
 volumes:
+  logs:
   db_data:
   trust:
 
@@ -14,8 +15,8 @@ services:
 
   db:
     image: ${DB_IMAGE}
-    volumes:
-      - db_data:/var/lib/mysql
+      # volumes:
+      #  - db_data:/var/lib/mysql
 
     # The setting below enables custom configuration
     # that turns on the MySQL query log
@@ -48,7 +49,7 @@ services:
 
     environment:
       TZ: Europe/Rome
-      IAM_JAVA_OPTS: -Djava.security.egd=file:/dev/./urandom -Xdebug -Xrunjdwp:server=y,transport=dt_socket,suspend=n,address=1044 -Dspring.profiles.active=mysql-test
+      IAM_JAVA_OPTS: -Djava.security.egd=file:/dev/./urandom -Xdebug -Xrunjdwp:server=y,transport=dt_socket,suspend=n,address=1044 -Dspring.profiles.active=mysql-test -debug
       IAM_JAR: /code/iam-login-service/target/iam-login-service.war
       IAM_HOST: iam.local.io
       IAM_BASE_URL: https://iam.local.io
@@ -85,8 +86,11 @@ services:
 
     volumes:
       - trust:/etc/grid-security/certificates
+      - logs:/var/log/iam
       - .:/code:ro
       - /dev/urandom:/dev/random
+      - ./compose/custom-logging/logback-spring.xml:/indigo-iam/logback-spring.xml:ro
+
         # - ./compose/metadata/iam.local.io.metadata.xml:/indigo-iam/iam.local.io.metadata.xml:ro
         # - ./compose/metadata/spid-idp.example.metadata.xml:/indigo-iam/spid-idp.example.metadata.xml:ro
         # - ./compose/custom-saml/application-saml.yml:/indigo-iam/config/application-saml.yml:ro
diff --git a/iam-common/pom.xml b/iam-common/pom.xml
index 2267dafed..a041919c6 100644
--- a/iam-common/pom.xml
+++ b/iam-common/pom.xml
@@ -7,7 +7,7 @@
   
     it.infn.mw
     iam-parent
-    1.7.1
+    1.8.0-spring-update-SNAPSHOT
   
 
   iam-common
diff --git a/iam-login-service/docker/Dockerfile b/iam-login-service/docker/Dockerfile
index d360f2f24..9b4b83a5c 100644
--- a/iam-login-service/docker/Dockerfile
+++ b/iam-login-service/docker/Dockerfile
@@ -1,8 +1,8 @@
-FROM openjdk:8
+FROM openjdk:11
 
 RUN mkdir /indigo-iam
 WORKDIR /indigo-iam
-CMD java -XX:+UnlockExperimentalVMOptions -XX:+UseCGroupMemoryLimitForHeap ${IAM_JAVA_OPTS} -jar ${IAM_JAR}
+CMD java ${IAM_JAVA_OPTS} -jar ${IAM_JAR}
 
 # Embed TINI since compose v3 syntax do not support the init 
 # option to run docker --init
diff --git a/iam-login-service/docker/Dockerfile.prod b/iam-login-service/docker/Dockerfile.prod
index 2d4210615..596c2631c 100644
--- a/iam-login-service/docker/Dockerfile.prod
+++ b/iam-login-service/docker/Dockerfile.prod
@@ -1,10 +1,10 @@
-FROM openjdk:8
+FROM openjdk:11
 
 RUN mkdir /indigo-iam
 WORKDIR /indigo-iam
 COPY iam-login-service.war /indigo-iam/
 
-CMD java -XX:MaxRAMFraction=1 -XX:+UnlockExperimentalVMOptions -XX:+UseCGroupMemoryLimitForHeap ${IAM_JAVA_OPTS} -jar iam-login-service.war 
+CMD java -XX:MaxRAMFraction=1 ${IAM_JAVA_OPTS} -jar iam-login-service.war 
 
 # Embed TINI since compose v3 syntax do not support the init 
 # option to run docker --init
diff --git a/iam-login-service/docker/build-prod-image.sh b/iam-login-service/docker/build-prod-image.sh
index 8aedbc3a0..feee6fef4 100644
--- a/iam-login-service/docker/build-prod-image.sh
+++ b/iam-login-service/docker/build-prod-image.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 #
-# Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+# Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
diff --git a/iam-login-service/docker/push-prod-image.sh b/iam-login-service/docker/push-prod-image.sh
index 2faa5682f..72da4c5fa 100644
--- a/iam-login-service/docker/push-prod-image.sh
+++ b/iam-login-service/docker/push-prod-image.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 #
-# Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+# Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
diff --git a/iam-login-service/pom.xml b/iam-login-service/pom.xml
index 1e7ec0a69..58e2c0632 100644
--- a/iam-login-service/pom.xml
+++ b/iam-login-service/pom.xml
@@ -1,7 +1,7 @@
 
 
     jacoco
@@ -53,6 +53,30 @@
       
     
 
+    
+    
+      org.springframework.boot
+      spring-boot-properties-migrator
+      runtime
+    
+
+    
+      org.springframework.boot
+      spring-boot-starter-validation
+    
+    
+    
+      org.junit.vintage
+      junit-vintage-engine
+      test
+      
+          
+              org.hamcrest
+              hamcrest-core
+          
+      
+    
+
     
     
       org.webjars
@@ -101,7 +125,7 @@
 
     
       org.webjars
-      webjars-locator
+      webjars-locator-core
     
 
     
@@ -111,7 +135,7 @@
     
 
     
-      org.hibernate
+      org.hibernate.validator
       hibernate-validator
     
 
@@ -166,20 +190,11 @@
       test
     
 
-    
-      org.springframework.security
-      spring-security-jwt
-      
-        
-          org.bouncycastle
-          bcpkix-jdk15on
-        
-      
-    
-
     
       org.springframework.boot
       spring-boot-devtools
+      runtime
+      true
     
 
     
@@ -222,12 +237,6 @@
       h2
     
 
-    
-      org.flywaydb.flyway-test-extensions
-      flyway-spring-test
-      test
-    
-
     
       mysql
       mysql-connector-java
@@ -251,11 +260,6 @@
     
 
     
-    
-      org.opensaml
-      opensaml
-    
-
     
       org.bouncycastle
       bcpkix-jdk15on
@@ -269,6 +273,12 @@
     
       org.springframework.security.extensions
       spring-security-saml2-core
+      
+        
+          xml-apis
+          xml-apis
+        
+      
     
 
     
@@ -299,21 +309,11 @@
       spring-boot-starter-mail
     
 
-    
-      org.apache.velocity
-      velocity
-    
-
     
       org.springframework.boot
       spring-boot-starter-freemarker
     
 
-    
-      cz.jirutka.validator
-      validator-collection
-    
-
     
       org.subethamail
       subethasmtp-wiser
@@ -411,7 +411,7 @@
         
           
             
-              repackage
+              build-info
             
           
         
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/IamLoginService.java b/iam-login-service/src/main/java/it/infn/mw/iam/IamLoginService.java
index 7c4431f33..0b869492d 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/IamLoginService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/IamLoginService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,16 +16,15 @@
 package it.infn.mw.iam;
 
 import org.mitre.discovery.web.DiscoveryEndpoint;
+import org.mitre.oauth2.web.CorsFilter;
 import org.mitre.openid.connect.web.JWKSetPublishingEndpoint;
 import org.mitre.openid.connect.web.RootController;
 import org.mitre.openid.connect.web.UserInfoEndpoint;
 import org.springframework.boot.SpringApplication;
-import org.springframework.boot.actuate.endpoint.HealthEndpoint;
 import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
 import org.springframework.boot.autoconfigure.h2.H2ConsoleAutoConfiguration;
-import org.springframework.boot.autoconfigure.security.SecurityAutoConfiguration;
-import org.springframework.boot.autoconfigure.security.oauth2.OAuth2AutoConfiguration;
+import org.springframework.boot.autoconfigure.security.servlet.SecurityAutoConfiguration;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.ComponentScan;
 import org.springframework.context.annotation.FilterType;
@@ -37,6 +36,7 @@
 
 @SpringBootApplication
 @EnableTransactionManagement
+
 // @formatter:off
 @ComponentScan(basePackages = {
     "it.infn.mw.iam.config", 
@@ -65,42 +65,33 @@
     @ComponentScan.Filter(type=FilterType.ASSIGNABLE_TYPE,
         value=DiscoveryEndpoint.class),
     @ComponentScan.Filter(type=FilterType.ASSIGNABLE_TYPE,
-        value=HealthEndpoint.class),
+        value=JWKSetPublishingEndpoint.class),
     @ComponentScan.Filter(type=FilterType.ASSIGNABLE_TYPE,
-        value=JWKSetPublishingEndpoint.class)
+    value=CorsFilter.class)
 })
-// @formatter:on
 
-@EnableAutoConfiguration(exclude = {SecurityAutoConfiguration.class, OAuth2AutoConfiguration.class,
-    H2ConsoleAutoConfiguration.class})
+@EnableAutoConfiguration(
+    exclude = {
+        SecurityAutoConfiguration.class,
+        H2ConsoleAutoConfiguration.class
+})
+//@formatter:on
 public class IamLoginService {
 
   public static void main(final String[] args) {
     SpringApplication iamLoginService = new SpringApplication(IamLoginService.class);
-
     iamLoginService.setBanner(new IamBanner(new ClassPathResource("iam-banner.txt")));
-
     iamLoginService.run(args);
 
   }
 
   @Bean
-  static PropertySourcesPlaceholderConfigurer iamVersionPlaceholderConfigurer() {
+  static PropertySourcesPlaceholderConfigurer iamPropertiesPlaceholderConfigurer() {
     PropertySourcesPlaceholderConfigurer propsConfig = new PropertySourcesPlaceholderConfigurer();
 
-    propsConfig.setLocation(new ClassPathResource("iam.version.properties"));
-    propsConfig.setIgnoreResourceNotFound(true);
-    propsConfig.setIgnoreUnresolvablePlaceholders(true);
-
-    return propsConfig;
-  }
-
-
-  @Bean
-  static PropertySourcesPlaceholderConfigurer gitCommitPlaceholderConfigurer() {
-    PropertySourcesPlaceholderConfigurer propsConfig = new PropertySourcesPlaceholderConfigurer();
+    propsConfig.setLocations(new ClassPathResource("iam.version.properties"),
+        new ClassPathResource("git.properties"));
 
-    propsConfig.setLocation(new ClassPathResource("git.properties"));
     propsConfig.setIgnoreResourceNotFound(true);
     propsConfig.setIgnoreUnresolvablePlaceholders(true);
 
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/actuator/IamHealthConfiguration.java b/iam-login-service/src/main/java/it/infn/mw/iam/actuator/IamHealthConfiguration.java
deleted file mode 100644
index 06f33f6aa..000000000
--- a/iam-login-service/src/main/java/it/infn/mw/iam/actuator/IamHealthConfiguration.java
+++ /dev/null
@@ -1,56 +0,0 @@
-/**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package it.infn.mw.iam.actuator;
-
-import java.util.HashMap;
-import java.util.Map;
-
-import javax.sql.DataSource;
-
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.actuate.endpoint.HealthEndpoint;
-import org.springframework.boot.actuate.health.DataSourceHealthIndicator;
-import org.springframework.boot.actuate.health.DiskSpaceHealthIndicator;
-import org.springframework.boot.actuate.health.DiskSpaceHealthIndicatorProperties;
-import org.springframework.boot.actuate.health.HealthAggregator;
-import org.springframework.boot.actuate.health.HealthIndicator;
-import org.springframework.boot.actuate.health.OrderedHealthAggregator;
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-
-@Configuration
-public class IamHealthConfiguration {
-
-  @Autowired(required = false)
-  private HealthAggregator healthAggregator = new OrderedHealthAggregator();
-
-  @Autowired
-  DataSource dataSource;
-
-  @Autowired
-  DiskSpaceHealthIndicatorProperties properties;
-
-  @Bean
-  public HealthEndpoint healthEndpoint() {
-    Map healthIndicators = new HashMap<>();
-
-    healthIndicators.put("db", new DataSourceHealthIndicator(dataSource));
-    healthIndicators.put("diskSpace", new DiskSpaceHealthIndicator(properties));
-
-    return new HealthEndpoint(this.healthAggregator, healthIndicators);
-  }
-
-}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/actuator/endpoint/ExternalServiceProbeEndpoint.java b/iam-login-service/src/main/java/it/infn/mw/iam/actuator/endpoint/ExternalServiceProbeEndpoint.java
deleted file mode 100644
index fc3a1504a..000000000
--- a/iam-login-service/src/main/java/it/infn/mw/iam/actuator/endpoint/ExternalServiceProbeEndpoint.java
+++ /dev/null
@@ -1,55 +0,0 @@
-/**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package it.infn.mw.iam.actuator.endpoint;
-
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.actuate.endpoint.AbstractEndpoint;
-import org.springframework.boot.actuate.health.CompositeHealthIndicator;
-import org.springframework.boot.actuate.health.Health;
-import org.springframework.boot.actuate.health.HealthAggregator;
-import org.springframework.boot.actuate.health.HealthIndicator;
-import org.springframework.boot.actuate.health.OrderedHealthAggregator;
-import org.springframework.boot.context.properties.ConfigurationProperties;
-import org.springframework.stereotype.Component;
-
-import it.infn.mw.iam.actuator.health.ExternalServiceProbeIndicator;
-
-@Component
-@ConfigurationProperties(prefix = "health.externalServiceProbe")
-public class ExternalServiceProbeEndpoint extends AbstractEndpoint {
-
-  private static final String ENDPOINT_ID = "healthExternalService";
-
-  private final HealthIndicator healthIndicator;
-
-  @Autowired
-  private HealthAggregator healthAggregator = new OrderedHealthAggregator();
-
-  @Autowired
-  public ExternalServiceProbeEndpoint(ExternalServiceProbeIndicator remoteHttpHostHealthIndicator) {
-    super(ENDPOINT_ID, false);
-
-    CompositeHealthIndicator indicator = new CompositeHealthIndicator(healthAggregator);
-    indicator.addHealthIndicator("external", remoteHttpHostHealthIndicator);
-
-    this.healthIndicator = indicator;
-  }
-
-  @Override
-  public Health invoke() {
-    return this.healthIndicator.health();
-  }
-}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/actuator/endpoint/MailHealthEndpoint.java b/iam-login-service/src/main/java/it/infn/mw/iam/actuator/endpoint/MailHealthEndpoint.java
deleted file mode 100644
index 403eda87d..000000000
--- a/iam-login-service/src/main/java/it/infn/mw/iam/actuator/endpoint/MailHealthEndpoint.java
+++ /dev/null
@@ -1,55 +0,0 @@
-/**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package it.infn.mw.iam.actuator.endpoint;
-
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.actuate.endpoint.AbstractEndpoint;
-import org.springframework.boot.actuate.health.CompositeHealthIndicator;
-import org.springframework.boot.actuate.health.Health;
-import org.springframework.boot.actuate.health.HealthAggregator;
-import org.springframework.boot.actuate.health.HealthIndicator;
-import org.springframework.boot.actuate.health.MailHealthIndicator;
-import org.springframework.boot.actuate.health.OrderedHealthAggregator;
-import org.springframework.boot.context.properties.ConfigurationProperties;
-import org.springframework.stereotype.Component;
-
-@Component
-@ConfigurationProperties(prefix = "health.mailProbe")
-public class MailHealthEndpoint extends AbstractEndpoint {
-
-  public static final String ENDPOINT_ID = "healthMail";
-
-  private final HealthIndicator healthIndicator;
-
-  @Autowired
-  private HealthAggregator healthAggregator = new OrderedHealthAggregator();
-
-  @Autowired
-  public MailHealthEndpoint(MailHealthIndicator mailHealthIndicator) {
-    super(ENDPOINT_ID, false);
-
-    CompositeHealthIndicator indicator = new CompositeHealthIndicator(healthAggregator);
-    indicator.addHealthIndicator("mail", mailHealthIndicator);
-
-    this.healthIndicator = indicator;
-  }
-
-  @Override
-  public Health invoke() {
-    return this.healthIndicator.health();
-  }
-
-}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/actuator/endpoint/mvc/ExternalServiceHealthMvcEndpoint.java b/iam-login-service/src/main/java/it/infn/mw/iam/actuator/endpoint/mvc/ExternalServiceHealthMvcEndpoint.java
deleted file mode 100644
index 200a6f378..000000000
--- a/iam-login-service/src/main/java/it/infn/mw/iam/actuator/endpoint/mvc/ExternalServiceHealthMvcEndpoint.java
+++ /dev/null
@@ -1,93 +0,0 @@
-/**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package it.infn.mw.iam.actuator.endpoint.mvc;
-
-import static org.springframework.http.MediaType.APPLICATION_JSON_VALUE;
-
-import java.util.Collection;
-import java.util.Map;
-
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.actuate.endpoint.mvc.AbstractEndpointMvcAdapter;
-import org.springframework.boot.actuate.health.Health;
-import org.springframework.boot.context.properties.ConfigurationProperties;
-import org.springframework.http.HttpStatus;
-import org.springframework.http.ResponseEntity;
-import org.springframework.security.authentication.AbstractAuthenticationToken;
-import org.springframework.security.core.GrantedAuthority;
-import org.springframework.stereotype.Component;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RequestMethod;
-import org.springframework.web.bind.annotation.ResponseBody;
-
-import com.google.common.collect.Maps;
-
-import it.infn.mw.iam.actuator.endpoint.ExternalServiceProbeEndpoint;
-
-@Component
-@ConfigurationProperties(prefix = "health.externalServiceProbe")
-public class ExternalServiceHealthMvcEndpoint
-    extends AbstractEndpointMvcAdapter {
-
-  private Map statusMapping = Maps.newLinkedHashMap();
-
-  @Autowired
-  public ExternalServiceHealthMvcEndpoint(ExternalServiceProbeEndpoint delegate) {
-    super(delegate);
-    statusMapping.put("DOWN", HttpStatus.SERVICE_UNAVAILABLE);
-  }
-
-  @RequestMapping(produces = APPLICATION_JSON_VALUE, method = RequestMethod.GET)
-  @ResponseBody
-  public Object getServiceHealth(AbstractAuthenticationToken auth) {
-    if (!getDelegate().isEnabled()) {
-      return getDisabledResponse();
-    }
-
-    Health health = getHealth(auth);
-    HttpStatus status = getStatus(health);
-
-    if (status != null) {
-      return new ResponseEntity(health, status);
-    }
-
-    return health;
-  }
-
-
-  private HttpStatus getStatus(Health health) {
-    return statusMapping.get(health.getStatus().getCode());
-  }
-
-  private Health getHealth(AbstractAuthenticationToken auth) {
-    Health health = getDelegate().invoke();
-
-    if (auth != null && isAdmin(auth.getAuthorities())) {
-      return health;
-    }
-    return Health.status(health.getStatus()).build();
-  }
-
-  private boolean isAdmin(Collection authorities) {
-    for (GrantedAuthority authority : authorities) {
-      if ("ROLE_ADMIN".equals(authority.getAuthority())) {
-        return true;
-      }
-    }
-    return false;
-  }
-
-}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/actuator/endpoint/mvc/MailHealthMvcEndpoint.java b/iam-login-service/src/main/java/it/infn/mw/iam/actuator/endpoint/mvc/MailHealthMvcEndpoint.java
deleted file mode 100644
index 7739c8d54..000000000
--- a/iam-login-service/src/main/java/it/infn/mw/iam/actuator/endpoint/mvc/MailHealthMvcEndpoint.java
+++ /dev/null
@@ -1,92 +0,0 @@
-/**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package it.infn.mw.iam.actuator.endpoint.mvc;
-
-import static org.springframework.http.MediaType.APPLICATION_JSON_VALUE;
-
-import java.util.Collection;
-import java.util.Map;
-
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.actuate.endpoint.mvc.AbstractEndpointMvcAdapter;
-import org.springframework.boot.actuate.health.Health;
-import org.springframework.boot.context.properties.ConfigurationProperties;
-import org.springframework.http.HttpStatus;
-import org.springframework.http.ResponseEntity;
-import org.springframework.security.authentication.AbstractAuthenticationToken;
-import org.springframework.security.core.GrantedAuthority;
-import org.springframework.stereotype.Component;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RequestMethod;
-import org.springframework.web.bind.annotation.ResponseBody;
-
-import com.google.common.collect.Maps;
-
-import it.infn.mw.iam.actuator.endpoint.MailHealthEndpoint;
-
-@Component
-@ConfigurationProperties(prefix = "health.mailProbe")
-public class MailHealthMvcEndpoint extends AbstractEndpointMvcAdapter {
-
-  private Map statusMapping = Maps.newLinkedHashMap();
-
-  @Autowired
-  public MailHealthMvcEndpoint(MailHealthEndpoint delegate) {
-    super(delegate);
-    statusMapping.put("DOWN", HttpStatus.SERVICE_UNAVAILABLE);
-  }
-
-  @RequestMapping(produces = APPLICATION_JSON_VALUE, method = RequestMethod.GET)
-  @ResponseBody
-  public Object getMailHealth(AbstractAuthenticationToken auth) {
-    if (!getDelegate().isEnabled()) {
-      return getDisabledResponse();
-    }
-
-    Health health = getHealth(auth);
-    HttpStatus status = getStatus(health);
-
-    if (status != null) {
-      return new ResponseEntity(health, status);
-    }
-
-    return health;
-  }
-
-
-  private HttpStatus getStatus(Health health) {
-    return statusMapping.get(health.getStatus().getCode());
-  }
-
-  private Health getHealth(AbstractAuthenticationToken auth) {
-    Health health = getDelegate().invoke();
-
-    if (auth != null && isAdmin(auth.getAuthorities())) {
-      return health;
-    }
-    return Health.status(health.getStatus()).build();
-  }
-
-  private boolean isAdmin(Collection authorities) {
-    for (GrantedAuthority authority : authorities) {
-      if ("ROLE_ADMIN".equals(authority.getAuthority())) {
-        return true;
-      }
-    }
-    return false;
-  }
-
-}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/actuator/health/ExternalConnectivityHealthIndicator.java b/iam-login-service/src/main/java/it/infn/mw/iam/actuator/health/ExternalConnectivityHealthIndicator.java
new file mode 100644
index 000000000..6af21d04f
--- /dev/null
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/actuator/health/ExternalConnectivityHealthIndicator.java
@@ -0,0 +1,70 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.infn.mw.iam.actuator.health;
+
+import java.io.IOException;
+import java.net.HttpURLConnection;
+import java.net.URL;
+import java.util.concurrent.TimeUnit;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.actuate.health.Health;
+import org.springframework.boot.actuate.health.HealthIndicator;
+import org.springframework.boot.actuate.health.Status;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.http.HttpMethod;
+import org.springframework.stereotype.Component;
+
+import it.infn.mw.iam.config.IamProperties;
+
+@Component
+@ConditionalOnProperty(name = "iam.external-connectivity-probe.enabled", havingValue = "true")
+public class ExternalConnectivityHealthIndicator implements HealthIndicator {
+
+  private static final String STATUS_WARNING = "WARNING";
+  private static final String STATUS_WARNING_MSG = "external endpoint unreachable";
+  private static final String ENDPOINT_KEY = "endpoint";
+
+  private final String endpoint;
+  private final int timeoutInSecs;
+
+  @Autowired
+  public ExternalConnectivityHealthIndicator(IamProperties properties) {
+    this.endpoint = properties.getExternalConnectivityProbe().getEndpoint();
+    this.timeoutInSecs = properties.getExternalConnectivityProbe().getTimeoutInSecs();
+  }
+
+  @Override
+  public Health health() {
+    try {
+      HttpURLConnection conn = (HttpURLConnection) new URL(endpoint).openConnection();
+      conn.setRequestMethod(HttpMethod.HEAD.name());
+      conn.setConnectTimeout((int) TimeUnit.SECONDS.toMillis(timeoutInSecs));
+
+      int responseCode = conn.getResponseCode();
+
+      if (responseCode == 200) {
+        return Health.up().withDetail(ENDPOINT_KEY, endpoint).build();
+      } else {
+        return Health.status(new Status(STATUS_WARNING, STATUS_WARNING_MSG))
+          .withDetail(ENDPOINT_KEY, endpoint)
+          .build();
+      }
+    } catch (IOException e) {
+      return Health.status(new Status(STATUS_WARNING, STATUS_WARNING_MSG)).withException(e).build();
+    }
+  }
+}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/actuator/health/ExternalServiceProbeIndicator.java b/iam-login-service/src/main/java/it/infn/mw/iam/actuator/health/ExternalServiceProbeIndicator.java
deleted file mode 100644
index 0aebe1ab3..000000000
--- a/iam-login-service/src/main/java/it/infn/mw/iam/actuator/health/ExternalServiceProbeIndicator.java
+++ /dev/null
@@ -1,55 +0,0 @@
-/**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package it.infn.mw.iam.actuator.health;
-
-import java.net.HttpURLConnection;
-import java.net.URL;
-
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.beans.factory.annotation.Value;
-import org.springframework.boot.actuate.health.AbstractHealthIndicator;
-import org.springframework.boot.actuate.health.Health.Builder;
-import org.springframework.stereotype.Component;
-
-@Component
-public class ExternalServiceProbeIndicator extends AbstractHealthIndicator {
-
-  private final String endpoint;
-  private final int timeout;
-
-  @Autowired
-  public ExternalServiceProbeIndicator(@Value("${health.externalServiceProbe.endpoint}") String endpoint,
-      @Value("${health.externalServiceProbe.timeout}") int timeout) {
-    this.endpoint = endpoint;
-    this.timeout = timeout;
-  }
-
-  @Override
-  protected void doHealthCheck(Builder builder) throws Exception {
-    builder.withDetail("location", endpoint);
-
-    HttpURLConnection conn = (HttpURLConnection) new URL(endpoint).openConnection();
-    conn.setRequestMethod("HEAD");
-    conn.setConnectTimeout(timeout);
-    int responseCode = conn.getResponseCode();
-    if (responseCode != 200) {
-      builder.down();
-    } else {
-      builder.up();
-    }
-  }
-
-}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/AccountUtils.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/AccountUtils.java
index 1f486a067..1ec400305 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/AccountUtils.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/AccountUtils.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -29,6 +29,7 @@
 import it.infn.mw.iam.persistence.model.IamAccount;
 import it.infn.mw.iam.persistence.repository.IamAccountRepository;
 
+@SuppressWarnings("deprecation")
 @Component
 public class AccountUtils {
   
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/attributes/AccountAttributesController.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/attributes/AccountAttributesController.java
index e5a4c5369..9c6924385 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/attributes/AccountAttributesController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/attributes/AccountAttributesController.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/authority/AccountAuthorityController.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/authority/AccountAuthorityController.java
index 918fe8a5b..5bee27e80 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/authority/AccountAuthorityController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/authority/AccountAuthorityController.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/authority/AccountAuthorityService.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/authority/AccountAuthorityService.java
index b5b311b35..6cd851933 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/authority/AccountAuthorityService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/authority/AccountAuthorityService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/authority/AuthorityAlreadyBoundError.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/authority/AuthorityAlreadyBoundError.java
index 22835e787..79e2f3f78 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/authority/AuthorityAlreadyBoundError.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/authority/AuthorityAlreadyBoundError.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/authority/AuthorityDTO.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/authority/AuthorityDTO.java
index d556e1fd3..138681093 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/authority/AuthorityDTO.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/authority/AuthorityDTO.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -15,10 +15,9 @@
  */
 package it.infn.mw.iam.api.account.authority;
 
+import javax.validation.constraints.NotBlank;
 import javax.validation.constraints.Size;
 
-import org.hibernate.validator.constraints.NotBlank;
-
 public class AuthorityDTO {
 
   @NotBlank(message = "Authority cannot be an empty string")
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/authority/AuthoritySetDTO.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/authority/AuthoritySetDTO.java
index c4c8ee470..53a2be4d6 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/authority/AuthoritySetDTO.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/authority/AuthoritySetDTO.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/authority/DefaultAccountAuthorityService.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/authority/DefaultAccountAuthorityService.java
index 8bc4a43f4..dccd38941 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/authority/DefaultAccountAuthorityService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/authority/DefaultAccountAuthorityService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/authority/InvalidAuthorityError.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/authority/InvalidAuthorityError.java
index 55efce55e..1e6aec81c 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/authority/InvalidAuthorityError.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/authority/InvalidAuthorityError.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/find/DefaultFindAccountService.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/find/DefaultFindAccountService.java
index 9f0ab9ec3..3553dbeda 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/find/DefaultFindAccountService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/find/DefaultFindAccountService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/find/FindAccountController.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/find/FindAccountController.java
index d1290e354..724849586 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/find/FindAccountController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/find/FindAccountController.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/find/FindAccountService.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/find/FindAccountService.java
index 4be6d939b..24314cca9 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/find/FindAccountService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/find/FindAccountService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/group/AccountGroupController.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/group/AccountGroupController.java
index 0f1b47c6e..1df7cd4b4 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/group/AccountGroupController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/group/AccountGroupController.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/group/AlreadyMemberError.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/group/AlreadyMemberError.java
index 221c91a1a..577c021a7 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/group/AlreadyMemberError.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/group/AlreadyMemberError.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/group/ErrorSuppliers.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/group/ErrorSuppliers.java
index 258791a36..3c5a9a11b 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/group/ErrorSuppliers.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/group/ErrorSuppliers.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/group/NotAMemberError.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/group/NotAMemberError.java
index 186ddaf06..af90575fa 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/group/NotAMemberError.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/group/NotAMemberError.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/group_manager/AccountGroupManagerController.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/group_manager/AccountGroupManagerController.java
index 09faf313d..124c6e9e8 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/group_manager/AccountGroupManagerController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/group_manager/AccountGroupManagerController.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/group_manager/AccountGroupManagerService.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/group_manager/AccountGroupManagerService.java
index 2939ec9ef..72241bc9f 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/group_manager/AccountGroupManagerService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/group_manager/AccountGroupManagerService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/group_manager/DefaultAccountGroupManagerService.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/group_manager/DefaultAccountGroupManagerService.java
index 03c878b06..861d87a83 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/group_manager/DefaultAccountGroupManagerService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/group_manager/DefaultAccountGroupManagerService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/group_manager/error/InvalidManagedGroupError.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/group_manager/error/InvalidManagedGroupError.java
index a513c0ba6..ecc89553c 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/group_manager/error/InvalidManagedGroupError.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/group_manager/error/InvalidManagedGroupError.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/group_manager/model/AccountManagedGroupsDTO.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/group_manager/model/AccountManagedGroupsDTO.java
index d5851a52f..142961820 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/group_manager/model/AccountManagedGroupsDTO.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/group_manager/model/AccountManagedGroupsDTO.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/labels/AccountLabelsController.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/labels/AccountLabelsController.java
index 25b9bce05..8314ad8e5 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/labels/AccountLabelsController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/labels/AccountLabelsController.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/lifecycle/AccountLifecycleController.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/lifecycle/AccountLifecycleController.java
index a8045333d..767379541 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/lifecycle/AccountLifecycleController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/lifecycle/AccountLifecycleController.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/lifecycle/AccountLifecycleDTO.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/lifecycle/AccountLifecycleDTO.java
index 6a92471ca..addb1ec52 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/lifecycle/AccountLifecycleDTO.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/lifecycle/AccountLifecycleDTO.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/lifecycle/InvalidLifecycleError.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/lifecycle/InvalidLifecycleError.java
index 52dc9377d..66c2c1548 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/lifecycle/InvalidLifecycleError.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/lifecycle/InvalidLifecycleError.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/password_reset/DefaultPasswordResetService.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/password_reset/DefaultPasswordResetService.java
index 1ef274d60..161e66458 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/password_reset/DefaultPasswordResetService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/password_reset/DefaultPasswordResetService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/password_reset/EmailDTO.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/password_reset/EmailDTO.java
index 2e0646810..078c13f88 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/password_reset/EmailDTO.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/password_reset/EmailDTO.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -15,10 +15,9 @@
  */
 package it.infn.mw.iam.api.account.password_reset;
 
+import javax.validation.constraints.Email;
 import javax.validation.constraints.NotNull;
 
-import org.hibernate.validator.constraints.Email;
-
 public class EmailDTO {
 
   @Email(message = "please specify a valid email address")
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/password_reset/PasswordDTO.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/password_reset/PasswordDTO.java
index 2cfc4aa39..53944e479 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/password_reset/PasswordDTO.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/password_reset/PasswordDTO.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -15,8 +15,9 @@
  */
 package it.infn.mw.iam.api.account.password_reset;
 
+import javax.validation.constraints.NotEmpty;
+
 import org.hibernate.validator.constraints.Length;
-import org.hibernate.validator.constraints.NotEmpty;
 
 public class PasswordDTO {
 
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/password_reset/PasswordResetController.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/password_reset/PasswordResetController.java
index dd0e2a924..66b113eb4 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/password_reset/PasswordResetController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/password_reset/PasswordResetController.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -42,9 +42,22 @@ public class PasswordResetController {
   public static final String BASE_RESOURCE = "/iam/password-reset";
   public static final String BASE_TOKEN_URL = BASE_RESOURCE + "/token";
 
+  private static final String EMAIL_FIELD = "email";
+  private static final String EMAIL_VALIDATION_ERROR_MSG = "invalid email address";
+
   @Autowired
   private PasswordResetService service;
 
+  private String nullSafeValidationErrorMessage(BindingResult validationResult) {
+    
+    if (validationResult.getFieldError(EMAIL_FIELD) == null) {
+      return EMAIL_VALIDATION_ERROR_MSG;
+    } else {
+      return validationResult.getFieldError(EMAIL_FIELD).getDefaultMessage();
+    }
+  }
+
+
   @RequestMapping(value = "/token", method = RequestMethod.POST,
       produces = MediaType.TEXT_PLAIN_VALUE)
   @ResponseBody
@@ -52,11 +65,11 @@ public void createPasswordResetToken(@Valid EmailDTO emailDTO, BindingResult val
 
     if (validationResult.hasErrors()) {
       throw new InvalidEmailAddressError(
-          "validation error: " + validationResult.getFieldError("email").getDefaultMessage());
+          String.format("validation error: %s", nullSafeValidationErrorMessage(validationResult)));
     }
 
     service.createPasswordResetToken(emailDTO.getEmail());
-    return;
+
   }
 
   @RequestMapping(value = "/token/{token}", method = RequestMethod.HEAD)
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/password_reset/PasswordResetService.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/password_reset/PasswordResetService.java
index 6bec9e556..e74b7a7a8 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/password_reset/PasswordResetService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/password_reset/PasswordResetService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/password_reset/PasswordUpdateController.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/password_reset/PasswordUpdateController.java
index c5a48b89f..2669eeb78 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/password_reset/PasswordUpdateController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/password_reset/PasswordUpdateController.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -40,6 +40,7 @@
 import it.infn.mw.iam.api.account.password_reset.error.UserNotActiveOrNotVerified;
 import it.infn.mw.iam.api.scim.controller.utils.ValidationErrorMessageHelper;
 
+@SuppressWarnings("deprecation")
 @RestController
 @Transactional
 public class PasswordUpdateController {
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/password_reset/error/BadUserPasswordError.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/password_reset/error/BadUserPasswordError.java
index 1a6dadb8e..254e7b60a 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/password_reset/error/BadUserPasswordError.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/password_reset/error/BadUserPasswordError.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/password_reset/error/InvalidEmailAddressError.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/password_reset/error/InvalidEmailAddressError.java
index 4a686e564..e772b5874 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/password_reset/error/InvalidEmailAddressError.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/password_reset/error/InvalidEmailAddressError.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/password_reset/error/InvalidPasswordError.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/password_reset/error/InvalidPasswordError.java
index 9ea9e6b86..9b6c075d1 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/password_reset/error/InvalidPasswordError.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/password_reset/error/InvalidPasswordError.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/password_reset/error/InvalidPasswordResetTokenError.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/password_reset/error/InvalidPasswordResetTokenError.java
index a835c6aa4..a7c6ebff9 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/password_reset/error/InvalidPasswordResetTokenError.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/password_reset/error/InvalidPasswordResetTokenError.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/password_reset/error/UserNotActiveOrNotVerified.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/password_reset/error/UserNotActiveOrNotVerified.java
index bf893c13d..318d96c77 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/password_reset/error/UserNotActiveOrNotVerified.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/password_reset/error/UserNotActiveOrNotVerified.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/password_reset/error/UserNotFoundError.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/password_reset/error/UserNotFoundError.java
index a948ab4b7..7353cf5c4 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/password_reset/error/UserNotFoundError.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/password_reset/error/UserNotFoundError.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/proxy_certificate/AccountProxyCertificatesController.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/proxy_certificate/AccountProxyCertificatesController.java
index 4a3e99bab..4524e901a 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/proxy_certificate/AccountProxyCertificatesController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/proxy_certificate/AccountProxyCertificatesController.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/search/AbstractSearchController.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/search/AbstractSearchController.java
index eae97ee9b..0fbb55845 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/search/AbstractSearchController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/search/AbstractSearchController.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/search/AccountSearchController.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/search/AccountSearchController.java
index bac85bae4..ec9076609 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/search/AccountSearchController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/search/AccountSearchController.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -87,18 +87,15 @@ public Sort getSort(String sortBy, String sortDirection) {
   }
 
   public static Sort getSortByName(Sort.Direction direction) {
-
-    return new Sort(new Order(direction, "userInfo.givenName").ignoreCase(),
+    return Sort.by(new Order(direction, "userInfo.givenName").ignoreCase(),
         new Order(direction, "userInfo.familyName").ignoreCase());
   }
 
   public static Sort getSortByCreationTime(Sort.Direction direction) {
-
-    return new Sort(new Order(direction, "creationTime").ignoreCase());
+    return Sort.by(new Order(direction, "creationTime").ignoreCase());
   }
 
   public static Sort getSortByEmail(Sort.Direction direction) {
-
-    return new Sort(new Order(direction, "userInfo.email").ignoreCase());
+    return Sort.by(new Order(direction, "userInfo.email").ignoreCase());
   }
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/search/GroupSearchController.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/search/GroupSearchController.java
index 88248b072..892b71af7 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/search/GroupSearchController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/search/GroupSearchController.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -83,7 +83,6 @@ public Sort getSort(String sortBy, String sortDirection) {
   }
 
   public static Sort getSortByName(Sort.Direction direction) {
-
-    return new Sort(new Order(direction, "name").ignoreCase());
+    return Sort.by(new Order(direction, "name").ignoreCase());
   }
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/search/service/DefaultPagedAccountsService.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/search/service/DefaultPagedAccountsService.java
index af1ab2ef1..9ba9d6378 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/search/service/DefaultPagedAccountsService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/search/service/DefaultPagedAccountsService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/search/service/DefaultPagedGroupsService.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/search/service/DefaultPagedGroupsService.java
index 8165b9a3e..6a76d41b4 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/search/service/DefaultPagedGroupsService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/search/service/DefaultPagedGroupsService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account_linking/AccountLinkingConstants.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account_linking/AccountLinkingConstants.java
index 062c12225..253935118 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account_linking/AccountLinkingConstants.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account_linking/AccountLinkingConstants.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,5 +16,5 @@
 package it.infn.mw.iam.api.account_linking;
 
 public interface AccountLinkingConstants {
-  String ACCOUNT_LINKING_DISABLE_PROPERTY = "${accountLinking.disable}";
+
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account_linking/AccountLinkingController.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account_linking/AccountLinkingController.java
index 3cd174b77..0c1b5f507 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account_linking/AccountLinkingController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account_linking/AccountLinkingController.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -49,8 +49,8 @@
 public class AccountLinkingController extends ExternalAuthenticationHandlerSupport {
   final AccountLinkingService linkingService;
 
-  @Value(ACCOUNT_LINKING_DISABLE_PROPERTY)
-  private Boolean accountLinkingDisabled;
+  @Value("${iam.account-linking.enable}")
+  private Boolean accountLinkingEnabled;
 
   @Autowired
   public AccountLinkingController(AccountLinkingService s) {
@@ -94,7 +94,7 @@ public String linkX509Certificate(HttpSession session, Principal principal,
 
 
   private void checkAccountLinkingEnabled(RedirectAttributes attributes) {
-    if (accountLinkingDisabled) {
+    if (!accountLinkingEnabled) {
       AccountLinkingDisabledException ex = new AccountLinkingDisabledException();
       saveAccountLinkingError(ex, attributes);
       throw ex;
@@ -123,7 +123,7 @@ public void linkAccount(@PathVariable ExternalAuthenticationType type,
   @RequestMapping(value = "/{type}/done", method = {RequestMethod.GET, RequestMethod.POST})
   public String finalizeAccountLinking(@PathVariable ExternalAuthenticationType type,
       Principal principal, final RedirectAttributes redirectAttributes, HttpServletRequest request,
-      HttpServletResponse response) throws IOException {
+      HttpServletResponse response) {
 
     checkAccountLinkingEnabled(redirectAttributes);
     HttpSession session = request.getSession();
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account_linking/AccountLinkingDisabledException.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account_linking/AccountLinkingDisabledException.java
index 05b7cbfa3..fe38ee7cf 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account_linking/AccountLinkingDisabledException.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account_linking/AccountLinkingDisabledException.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account_linking/AccountLinkingService.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account_linking/AccountLinkingService.java
index 6c2304629..b1b7a6cbf 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account_linking/AccountLinkingService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account_linking/AccountLinkingService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account_linking/DefaultAccountLinkingService.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account_linking/DefaultAccountLinkingService.java
index 38e21d188..1820f5519 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account_linking/DefaultAccountLinkingService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account_linking/DefaultAccountLinkingService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/AUPSignatureCheckService.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/AUPSignatureCheckService.java
index 4715c04e5..d66ac4b91 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/AUPSignatureCheckService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/AUPSignatureCheckService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/AupController.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/AupController.java
index 2dafc19c7..9cc974e9a 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/AupController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/AupController.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/AupService.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/AupService.java
index 48c99f760..613c84165 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/AupService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/AupService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/AupSignatureController.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/AupSignatureController.java
index 1b0168c40..3b3cd28a4 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/AupSignatureController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/AupSignatureController.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/AupSignaturePageController.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/AupSignaturePageController.java
index 81fc4fbb0..be6509cde 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/AupSignaturePageController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/AupSignaturePageController.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/DefaultAupService.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/DefaultAupService.java
index e86e7a05c..d6f53975c 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/DefaultAupService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/DefaultAupService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/DefaultAupSignatureCheckService.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/DefaultAupSignatureCheckService.java
index c82f18fb2..3d955cc92 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/DefaultAupSignatureCheckService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/DefaultAupSignatureCheckService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/error/AupAlreadyExistsError.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/error/AupAlreadyExistsError.java
index 4655d06bd..2fff0ed5d 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/error/AupAlreadyExistsError.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/error/AupAlreadyExistsError.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/error/AupNotFoundError.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/error/AupNotFoundError.java
index 76ed42c89..482221651 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/error/AupNotFoundError.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/error/AupNotFoundError.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/error/AupSignatureNotFoundError.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/error/AupSignatureNotFoundError.java
index 00d04bcd1..4ea5e66b0 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/error/AupSignatureNotFoundError.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/error/AupSignatureNotFoundError.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/error/InvalidAupError.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/error/InvalidAupError.java
index d8c8eb31c..192bae545 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/error/InvalidAupError.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/error/InvalidAupError.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/model/AccountDTO.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/model/AccountDTO.java
index 8274b9c43..7d23eae0a 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/model/AccountDTO.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/model/AccountDTO.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/model/AupConverter.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/model/AupConverter.java
index 1c6ebc9e4..d23a2b025 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/model/AupConverter.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/model/AupConverter.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/model/AupDTO.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/model/AupDTO.java
index 60e188012..af404ab61 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/model/AupDTO.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/model/AupDTO.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -18,10 +18,10 @@
 import java.util.Date;
 
 import javax.validation.constraints.Min;
+import javax.validation.constraints.NotBlank;
 import javax.validation.constraints.NotNull;
 import javax.validation.constraints.Size;
 
-import org.hibernate.validator.constraints.NotBlank;
 import org.hibernate.validator.constraints.URL;
 
 import com.fasterxml.jackson.annotation.JsonProperty;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/model/AupSignatureConverter.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/model/AupSignatureConverter.java
index d26e25a3b..2cf5b5ea9 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/model/AupSignatureConverter.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/model/AupSignatureConverter.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/model/AupSignatureDTO.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/model/AupSignatureDTO.java
index c78723150..9f240e092 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/model/AupSignatureDTO.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/aup/model/AupSignatureDTO.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/authn_info/AuthnInfoController.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/authn_info/AuthnInfoController.java
index 580e1ebfd..72b4b0aaf 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/authn_info/AuthnInfoController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/authn_info/AuthnInfoController.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/common/AttributeDTO.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/common/AttributeDTO.java
index fef73112a..8d69b95f2 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/common/AttributeDTO.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/common/AttributeDTO.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/common/AttributeDTOConverter.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/common/AttributeDTOConverter.java
index 50917a4cb..62f4144b6 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/common/AttributeDTOConverter.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/common/AttributeDTOConverter.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/common/ErrorDTO.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/common/ErrorDTO.java
index 3a4fd5cc2..fdf20b802 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/common/ErrorDTO.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/common/ErrorDTO.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/common/GroupDTO.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/common/GroupDTO.java
index 326f64793..de9830d13 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/common/GroupDTO.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/common/GroupDTO.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/common/LabelDTO.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/common/LabelDTO.java
index 6c39b0253..afa8b1fdf 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/common/LabelDTO.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/common/LabelDTO.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -19,7 +19,7 @@
 import javax.validation.constraints.Pattern;
 import javax.validation.constraints.Size;
 
-import org.hibernate.validator.constraints.NotBlank;
+import javax.validation.constraints.NotBlank;
 
 import com.fasterxml.jackson.annotation.JsonInclude;
 
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/common/LabelDTOConverter.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/common/LabelDTOConverter.java
index 2e23ea587..b8c35f268 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/common/LabelDTOConverter.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/common/LabelDTOConverter.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/common/ListResponseDTO.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/common/ListResponseDTO.java
index a094eb8db..d2d33e6aa 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/common/ListResponseDTO.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/common/ListResponseDTO.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -88,7 +88,7 @@ public static class Builder {
     public  Builder fromPage(Page page, Pageable op) {
       this.totalResults = page.getTotalElements();
       this.itemsPerPage = page.getNumberOfElements();
-      this.startIndex = op.getOffset() + 1;
+      this.startIndex = (int) op.getOffset() + 1;
       return this;
     }
 
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/common/NoSuchAccountError.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/common/NoSuchAccountError.java
index 9cc477354..f97d67edc 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/common/NoSuchAccountError.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/common/NoSuchAccountError.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/common/OffsetPageable.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/common/OffsetPageable.java
index bfd0b5e01..1c3e1eaef 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/common/OffsetPageable.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/common/OffsetPageable.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,7 +16,12 @@
 package it.infn.mw.iam.api.common;
 
 import static com.google.common.base.Preconditions.checkArgument;
+
+import java.util.Objects;
+
 import javax.annotation.Generated;
+
+import org.apache.commons.lang3.NotImplementedException;
 import org.springframework.data.domain.Pageable;
 import org.springframework.data.domain.Sort;
 
@@ -28,7 +33,7 @@ public class OffsetPageable implements Pageable {
 
   public OffsetPageable(int count) {
 
-    this(0, count, null);
+    this(0, count, Sort.unsorted());
   }
 
   public OffsetPageable(int count, Sort sort) {
@@ -48,7 +53,14 @@ public OffsetPageable(int offset, int count, Sort sort) {
 
     this.offset = offset;
     this.count = count;
-    this.sort = sort;
+
+    if (Objects.isNull(sort)) {
+      this.sort = Sort.unsorted();
+    } else {
+      this.sort = sort;
+    }
+
+
   }
 
   @Override
@@ -64,7 +76,7 @@ public int getPageSize() {
   }
 
   @Override
-  public int getOffset() {
+  public long getOffset() {
 
     return offset;
   }
@@ -132,10 +144,17 @@ public boolean equals(Object obj) {
     return true;
   }
 
+  @Override
+  public Pageable withPage(int pageNumber) {
+    throw new NotImplementedException();
+  }
+
   @Override
   public String toString() {
 
     return "OffsetPageable [offset=" + offset + ", count=" + count + "]";
   }
 
-}
\ No newline at end of file
+
+
+}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/common/PagedResourceService.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/common/PagedResourceService.java
index 809aa1573..c4e87cc69 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/common/PagedResourceService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/common/PagedResourceService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/common/PagingUtils.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/common/PagingUtils.java
index 35ce7e939..6ee0cf69a 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/common/PagingUtils.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/common/PagingUtils.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/common/error/InvalidAttributeError.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/common/error/InvalidAttributeError.java
index 38b5b1fff..ee93bc4db 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/common/error/InvalidAttributeError.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/common/error/InvalidAttributeError.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/common/error/InvalidLabelError.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/common/error/InvalidLabelError.java
index 9242b57bd..e981bf618 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/common/error/InvalidLabelError.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/common/error/InvalidLabelError.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/common/form/PaginatedRequestForm.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/common/form/PaginatedRequestForm.java
index 170c37d7c..6ae61819e 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/common/form/PaginatedRequestForm.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/common/form/PaginatedRequestForm.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/common/form/PaginatedRequestWithFilterForm.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/common/form/PaginatedRequestWithFilterForm.java
index d8b4074da..528a516b3 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/common/form/PaginatedRequestWithFilterForm.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/common/form/PaginatedRequestWithFilterForm.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/common/validator/NullableNonBlankString.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/common/validator/NullableNonBlankString.java
index 0743874ee..81852991a 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/common/validator/NullableNonBlankString.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/common/validator/NullableNonBlankString.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/common/validator/NullableNonBlankStringValidator.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/common/validator/NullableNonBlankStringValidator.java
index 56c043ffc..1a14d5bff 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/common/validator/NullableNonBlankStringValidator.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/common/validator/NullableNonBlankStringValidator.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -24,10 +24,12 @@ public class NullableNonBlankStringValidator
     implements ConstraintValidator {
 
   public NullableNonBlankStringValidator() {
+    // Empty on purpose
   }
 
   @Override
   public void initialize(NullableNonBlankString constraintAnnotation) {
+    // Empty on purpose
   }
 
   @Override
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/config/ConfigurationController.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/config/ConfigurationController.java
index 511856455..288f62ed3 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/config/ConfigurationController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/config/ConfigurationController.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/exchange_policy/ClientMatchingPolicyDTO.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/exchange_policy/ClientMatchingPolicyDTO.java
index 9df5bb2cd..5485d38e7 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/exchange_policy/ClientMatchingPolicyDTO.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/exchange_policy/ClientMatchingPolicyDTO.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/exchange_policy/DefaultTokenExchangePolicyService.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/exchange_policy/DefaultTokenExchangePolicyService.java
index f280bb0da..8e846ba3f 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/exchange_policy/DefaultTokenExchangePolicyService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/exchange_policy/DefaultTokenExchangePolicyService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -59,8 +59,7 @@ public Page getTokenExchangePolicies(Pageable page) {
 
   @Override
   public void deleteTokenExchangePolicyById(Long id) {
-    IamTokenExchangePolicyEntity policy =
-        Optional.ofNullable(repo.findOne(id)).orElseThrow(notFoundError(id));
+    IamTokenExchangePolicyEntity policy = repo.findById(id).orElseThrow(notFoundError(id));
 
     repo.delete(policy);
 
@@ -69,7 +68,7 @@ public void deleteTokenExchangePolicyById(Long id) {
 
   @Override
   public Optional getTokenExchangePolicyById(Long id) {
-    return Optional.ofNullable(repo.findOne(id)).map(converter::dtoFromEntity);
+    return repo.findById(id).map(converter::dtoFromEntity);
   }
 
   @Override
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/exchange_policy/ExchangePolicyController.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/exchange_policy/ExchangePolicyController.java
index bfe4b384a..5dc20ad6e 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/exchange_policy/ExchangePolicyController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/exchange_policy/ExchangePolicyController.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -21,7 +21,7 @@
 
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.data.domain.Page;
-import org.springframework.data.domain.PageRequest;
+import org.springframework.data.domain.Pageable;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.converter.HttpMessageNotReadableException;
 import org.springframework.security.access.prepost.PreAuthorize;
@@ -45,9 +45,7 @@ public class ExchangePolicyController {
 
   private static final int UNPAGED_PAGE_SIZE = 1000;
 
-  // Unfortunately the version of spring data used by IAM does not still support
-  // unpaged, so we mock an upaged request with a limit of UNPAGED_PAGE_SIZE results per page.
-  private static final PageRequest UNPAGED = new PageRequest(0, UNPAGED_PAGE_SIZE);
+  private static final Pageable UNPAGED = Pageable.unpaged();
 
   private static final String UNPAGED_ERROR_MSG = String.format(
       "More than %d exchange policies found, but only the first %d will be returned. it's time to properly implement pagination",
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/exchange_policy/ExchangePolicyConverter.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/exchange_policy/ExchangePolicyConverter.java
index cb6f4da43..3aaea06ae 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/exchange_policy/ExchangePolicyConverter.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/exchange_policy/ExchangePolicyConverter.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/exchange_policy/ExchangePolicyDTO.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/exchange_policy/ExchangePolicyDTO.java
index d61ac1266..57c9c97ac 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/exchange_policy/ExchangePolicyDTO.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/exchange_policy/ExchangePolicyDTO.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/exchange_policy/ExchangePolicyNotFoundError.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/exchange_policy/ExchangePolicyNotFoundError.java
index 34d06b347..1fa4ac4c0 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/exchange_policy/ExchangePolicyNotFoundError.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/exchange_policy/ExchangePolicyNotFoundError.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/exchange_policy/ExchangeScopePolicyDTO.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/exchange_policy/ExchangeScopePolicyDTO.java
index 9e48d3881..53674f7be 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/exchange_policy/ExchangeScopePolicyDTO.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/exchange_policy/ExchangeScopePolicyDTO.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/exchange_policy/InvalidExchangePolicyError.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/exchange_policy/InvalidExchangePolicyError.java
index 710718be2..fa70d7c9e 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/exchange_policy/InvalidExchangePolicyError.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/exchange_policy/InvalidExchangePolicyError.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/exchange_policy/TokenExchangePolicyService.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/exchange_policy/TokenExchangePolicyService.java
index c7e41e902..79ad61d97 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/exchange_policy/TokenExchangePolicyService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/exchange_policy/TokenExchangePolicyService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/group/GroupController.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/group/GroupController.java
index d8c9ca5ab..e464e0b20 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/group/GroupController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/group/GroupController.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -153,4 +153,4 @@ public ErrorDTO handleValidationError(InvalidGroupError e) {
   public ErrorDTO handleNotFoundError(NoSuchGroupError e) {
     return ErrorDTO.fromString(e.getMessage());
   }
-}
\ No newline at end of file
+}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/group/GroupDTOConverter.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/group/GroupDTOConverter.java
index 13b88cf8b..62b5d0493 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/group/GroupDTOConverter.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/group/GroupDTOConverter.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/group/GroupLabelsController.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/group/GroupLabelsController.java
index 6bc2f4c50..c07cc9a5c 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/group/GroupLabelsController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/group/GroupLabelsController.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/group/InvalidGroupError.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/group/InvalidGroupError.java
index 2180369bc..1eedbf39a 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/group/InvalidGroupError.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/group/InvalidGroupError.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/group/find/DefaultFindGroupService.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/group/find/DefaultFindGroupService.java
index dddbf2640..291e8f628 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/group/find/DefaultFindGroupService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/group/find/DefaultFindGroupService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/group/find/FindGroupController.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/group/find/FindGroupController.java
index 63750f005..92e997e55 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/group/find/FindGroupController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/group/find/FindGroupController.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/group/find/FindGroupService.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/group/find/FindGroupService.java
index 0b9afda7d..4b395af09 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/group/find/FindGroupService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/group/find/FindGroupService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/group/validator/GroupNameAssigned.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/group/validator/GroupNameAssigned.java
index 09364e4e2..88e18b9e6 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/group/validator/GroupNameAssigned.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/group/validator/GroupNameAssigned.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/group/validator/GroupNameAssignedValidator.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/group/validator/GroupNameAssignedValidator.java
index 6dfd0c6d6..514114c68 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/group/validator/GroupNameAssignedValidator.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/group/validator/GroupNameAssignedValidator.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/group/validator/ValidGroupName.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/group/validator/ValidGroupName.java
index bb63b5bb6..48f623ca6 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/group/validator/ValidGroupName.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/group/validator/ValidGroupName.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/group/validator/ValidGroupNameValidator.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/group/validator/ValidGroupNameValidator.java
index dfb5112e2..95982b980 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/group/validator/ValidGroupNameValidator.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/group/validator/ValidGroupNameValidator.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/proxy/DefaultProxyCertificateService.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/proxy/DefaultProxyCertificateService.java
index e4b6be49e..a65328e3d 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/proxy/DefaultProxyCertificateService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/proxy/DefaultProxyCertificateService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/proxy/InvalidProxyRequestError.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/proxy/InvalidProxyRequestError.java
index 2cec9aeb1..d3d0fb14c 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/proxy/InvalidProxyRequestError.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/proxy/InvalidProxyRequestError.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/proxy/ProxyCertificateDTO.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/proxy/ProxyCertificateDTO.java
index a1708b5c9..4da7b48ee 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/proxy/ProxyCertificateDTO.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/proxy/ProxyCertificateDTO.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -20,7 +20,7 @@
 import javax.validation.groups.Default;
 
 import org.hibernate.validator.constraints.Length;
-import org.hibernate.validator.constraints.NotBlank;
+import javax.validation.constraints.NotBlank;
 
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/proxy/ProxyCertificateProperties.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/proxy/ProxyCertificateProperties.java
index b93d5aece..db63bcac5 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/proxy/ProxyCertificateProperties.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/proxy/ProxyCertificateProperties.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/proxy/ProxyCertificateRequestDTO.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/proxy/ProxyCertificateRequestDTO.java
index dbbafcaa5..a8971e420 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/proxy/ProxyCertificateRequestDTO.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/proxy/ProxyCertificateRequestDTO.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/proxy/ProxyCertificateService.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/proxy/ProxyCertificateService.java
index fb915531d..696674404 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/proxy/ProxyCertificateService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/proxy/ProxyCertificateService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/proxy/ProxyCertificatesApiController.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/proxy/ProxyCertificatesApiController.java
index b68b2d950..92cec6e83 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/proxy/ProxyCertificatesApiController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/proxy/ProxyCertificatesApiController.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/proxy/ProxyNotFoundError.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/proxy/ProxyNotFoundError.java
index eeadcaa8b..be6fbbc62 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/proxy/ProxyNotFoundError.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/proxy/ProxyNotFoundError.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/registration/cern/CernHrDBApiService.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/registration/cern/CernHrDBApiService.java
index 2f63f86b1..4278548db 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/registration/cern/CernHrDBApiService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/registration/cern/CernHrDBApiService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/registration/cern/CernHrDbApiError.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/registration/cern/CernHrDbApiError.java
index 947664d2d..f1b642740 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/registration/cern/CernHrDbApiError.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/registration/cern/CernHrDbApiError.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/registration/cern/DefaultCernHrDBApiService.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/registration/cern/DefaultCernHrDBApiService.java
index 67f657942..61fe156bb 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/registration/cern/DefaultCernHrDBApiService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/registration/cern/DefaultCernHrDBApiService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/registration/cern/dto/ErrorDTO.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/registration/cern/dto/ErrorDTO.java
index ecc973206..a14eab36f 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/registration/cern/dto/ErrorDTO.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/registration/cern/dto/ErrorDTO.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/registration/cern/dto/InstituteDTO.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/registration/cern/dto/InstituteDTO.java
index 78dcd623d..0307f69f7 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/registration/cern/dto/InstituteDTO.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/registration/cern/dto/InstituteDTO.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/registration/cern/dto/ParticipationDTO.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/registration/cern/dto/ParticipationDTO.java
index c2f905627..b3b90afa8 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/registration/cern/dto/ParticipationDTO.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/registration/cern/dto/ParticipationDTO.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/registration/cern/dto/VOPersonDTO.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/registration/cern/dto/VOPersonDTO.java
index 4805c6f2f..d31cd1ba6 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/registration/cern/dto/VOPersonDTO.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/registration/cern/dto/VOPersonDTO.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/registration/cern/mock/MockCernAuthController.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/registration/cern/mock/MockCernAuthController.java
index b431bc344..720b7098e 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/registration/cern/mock/MockCernAuthController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/registration/cern/mock/MockCernAuthController.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/requests/GroupRequestConverter.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/requests/GroupRequestConverter.java
index a785d577d..336e33b2f 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/requests/GroupRequestConverter.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/requests/GroupRequestConverter.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/requests/GroupRequestUtils.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/requests/GroupRequestUtils.java
index ad7a2a6a1..5d1778c27 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/requests/GroupRequestUtils.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/requests/GroupRequestUtils.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/requests/GroupRequestsController.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/requests/GroupRequestsController.java
index e7e5f3a71..3fdaff918 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/requests/GroupRequestsController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/requests/GroupRequestsController.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -17,7 +17,7 @@
 
 import javax.validation.Valid;
 
-import org.hibernate.validator.constraints.NotEmpty;
+import javax.validation.constraints.NotEmpty;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.data.domain.Sort;
 import org.springframework.http.HttpStatus;
@@ -61,7 +61,7 @@ public ListResponseDTO listGroupRequest(
       @RequestParam(required = false) String status, @RequestParam(required = false) Integer count,
       @RequestParam(required = false) Integer startIndex) {
 
-    final Sort sort = new Sort("account.username", "group.name","creationTime");
+    final Sort sort = Sort.by("account.username", "group.name", "creationTime");
     
     OffsetPageable pageRequest =
         PagingUtils.buildPageRequest(count, startIndex, GROUP_REQUEST_MAX_PAGE_SIZE, sort);
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/requests/exception/GroupRequestExceptionHandler.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/requests/exception/GroupRequestExceptionHandler.java
index 6a0976fd2..06dc42711 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/requests/exception/GroupRequestExceptionHandler.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/requests/exception/GroupRequestExceptionHandler.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/requests/exception/GroupRequestValidationError.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/requests/exception/GroupRequestValidationError.java
index 279a15391..205959e3d 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/requests/exception/GroupRequestValidationError.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/requests/exception/GroupRequestValidationError.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/requests/exception/InvalidGroupRequestStatusError.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/requests/exception/InvalidGroupRequestStatusError.java
index 76983e56b..270d8ec03 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/requests/exception/InvalidGroupRequestStatusError.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/requests/exception/InvalidGroupRequestStatusError.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/requests/model/GroupRequestDto.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/requests/model/GroupRequestDto.java
index 1761ac4c5..d7e12b007 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/requests/model/GroupRequestDto.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/requests/model/GroupRequestDto.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -17,7 +17,7 @@
 
 import java.util.Date;
 
-import org.hibernate.validator.constraints.NotEmpty;
+import javax.validation.constraints.NotEmpty;
 
 import com.fasterxml.jackson.annotation.JsonCreator;
 import com.fasterxml.jackson.annotation.JsonInclude;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/requests/service/DefaultGroupRequestsService.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/requests/service/DefaultGroupRequestsService.java
index 96ef6beab..6ec3c4340 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/requests/service/DefaultGroupRequestsService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/requests/service/DefaultGroupRequestsService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -31,7 +31,6 @@
 import org.springframework.context.ApplicationEventPublisher;
 import org.springframework.data.domain.Page;
 import org.springframework.data.jpa.domain.Specification;
-import org.springframework.data.jpa.domain.Specifications;
 import org.springframework.stereotype.Service;
 
 import com.google.common.collect.ImmutableTable;
@@ -133,7 +132,7 @@ public GroupRequestDto createGroupRequest(GroupRequestDto groupRequest) {
   public void deleteGroupRequest(String requestId) {
     IamGroupRequest request = groupRequestUtils.getGroupRequest(requestId);
 
-    groupRequestRepository.delete(request.getId());
+    groupRequestRepository.deleteById(request.getId());
     eventPublisher.publishEvent(new GroupRequestDeletedEvent(this, request));
   }
 
@@ -144,7 +143,7 @@ public GroupRequestDto approveGroupRequest(String requestId) {
     IamAccount account = request.getAccount();
     IamGroup group = request.getGroup();
 
-    account = accountService.addToGroup(account, group);
+    accountService.addToGroup(account, group);
 
     request = updateGroupRequestStatus(request, APPROVED);
     notificationFactory.createGroupMembershipApprovedMessage(request);
@@ -239,7 +238,7 @@ private Page lookupGroupRequests(Optional usernameFilte
       Optional groupNameFilter, Optional statusFilter, Set managedGroups,
       OffsetPageable pageRequest) {
 
-    Specifications spec = Specifications.where(baseSpec());
+    Specification spec = baseSpec();
 
     if (!managedGroups.isEmpty()) {
       spec = spec.and(forGroupIds(managedGroups));
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/requests/service/GroupRequestsService.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/requests/service/GroupRequestsService.java
index 0b19f59fc..ba6c023bc 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/requests/service/GroupRequestsService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/requests/service/GroupRequestsService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/requests/validator/GroupRequest.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/requests/validator/GroupRequest.java
index 7c74a6688..8471ef863 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/requests/validator/GroupRequest.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/requests/validator/GroupRequest.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/requests/validator/GroupRequestValidator.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/requests/validator/GroupRequestValidator.java
index bdc9f9dd3..11c1d3fcb 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/requests/validator/GroupRequestValidator.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/requests/validator/GroupRequestValidator.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/controller/ScimControllerSupport.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/controller/ScimControllerSupport.java
index 59c9f9d68..86eb17b9e 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/controller/ScimControllerSupport.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/controller/ScimControllerSupport.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/controller/ScimExceptionHandler.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/controller/ScimExceptionHandler.java
index de53dc992..c774d4f1c 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/controller/ScimExceptionHandler.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/controller/ScimExceptionHandler.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/controller/ScimGroupController.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/controller/ScimGroupController.java
index b077dd746..b5ad9cf46 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/controller/ScimGroupController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/controller/ScimGroupController.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/controller/ScimMeController.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/controller/ScimMeController.java
index a2a6894fb..063e79c81 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/controller/ScimMeController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/controller/ScimMeController.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -69,6 +69,7 @@
 import it.infn.mw.iam.persistence.model.IamAccount;
 import it.infn.mw.iam.persistence.repository.IamAccountRepository;
 
+@SuppressWarnings("deprecation")
 @RestController
 @RequestMapping("/scim/Me")
 @Transactional
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/controller/ScimUserController.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/controller/ScimUserController.java
index 54efbf74a..a4684d22d 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/controller/ScimUserController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/controller/ScimUserController.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/controller/utils/JsonDateSerializer.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/controller/utils/JsonDateSerializer.java
index 53ebe4445..86d9b9577 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/controller/utils/JsonDateSerializer.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/controller/utils/JsonDateSerializer.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/controller/utils/ValidationErrorMessageHelper.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/controller/utils/ValidationErrorMessageHelper.java
index 83eae110a..521e1b92c 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/controller/utils/ValidationErrorMessageHelper.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/controller/utils/ValidationErrorMessageHelper.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/controller/utils/ValidationHelper.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/controller/utils/ValidationHelper.java
index eafe0dd14..bbb3672f6 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/controller/utils/ValidationHelper.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/controller/utils/ValidationHelper.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/converter/AddressConverter.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/converter/AddressConverter.java
index 52e4b74c6..04d4655cd 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/converter/AddressConverter.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/converter/AddressConverter.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/converter/Converter.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/converter/Converter.java
index a7f213b2e..523a4ab87 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/converter/Converter.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/converter/Converter.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/converter/DefaultScimResourceLocationProvider.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/converter/DefaultScimResourceLocationProvider.java
index 5d408f775..5be77807f 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/converter/DefaultScimResourceLocationProvider.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/converter/DefaultScimResourceLocationProvider.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/converter/GroupConverter.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/converter/GroupConverter.java
index b337cc597..a943030c2 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/converter/GroupConverter.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/converter/GroupConverter.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/converter/OidcIdConverter.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/converter/OidcIdConverter.java
index 6b902f9c7..f7a2d1ba3 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/converter/OidcIdConverter.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/converter/OidcIdConverter.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -43,4 +43,4 @@ public ScimOidcId dtoFromEntity(IamOidcId entity) {
 
     return builder.build();
   }
-}
\ No newline at end of file
+}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/converter/SamlIdConverter.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/converter/SamlIdConverter.java
index 29ba37eb6..5fdb38b88 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/converter/SamlIdConverter.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/converter/SamlIdConverter.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/converter/ScimResourceLocationProvider.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/converter/ScimResourceLocationProvider.java
index 20bd50cf9..8fb0944f1 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/converter/ScimResourceLocationProvider.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/converter/ScimResourceLocationProvider.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/converter/SshKeyConverter.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/converter/SshKeyConverter.java
index f33f0c45e..10c9ba94a 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/converter/SshKeyConverter.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/converter/SshKeyConverter.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -15,6 +15,8 @@
  */
 package it.infn.mw.iam.api.scim.converter;
 
+import java.util.Optional;
+
 import org.springframework.stereotype.Service;
 
 import it.infn.mw.iam.api.scim.model.ScimSshKey;
@@ -36,8 +38,7 @@ public IamSshKey entityFromDto(ScimSshKey scim) {
     if (scim.getValue() != null) {
       sshKey.setFingerprint(RSAPublicKeyUtils.getSHA256Fingerprint(scim.getValue()));
     }
-
-    sshKey.setPrimary(scim.isPrimary() != null ? scim.isPrimary() : false);
+    sshKey.setPrimary(Optional.ofNullable(scim.isPrimary()).orElse(Boolean.FALSE));
     sshKey.setAccount(null);
 
     return sshKey;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/converter/UserConverter.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/converter/UserConverter.java
index 3032bd68a..7611aa322 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/converter/UserConverter.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/converter/UserConverter.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -236,13 +236,12 @@ private ScimIndigoUser getScimIndigoUser(IamAccount entity) {
     }
 
     for (LabelDescriptor ld : properties.getIncludeLabels()) {
-      entity.getLabelByPrefixAndName(ld.getPrefix(), ld.getName()).ifPresent(el -> {
-        indigoUserBuilder.addLabel(ScimLabel.builder()
+      entity.getLabelByPrefixAndName(ld.getPrefix(), ld.getName())
+        .ifPresent(el -> indigoUserBuilder.addLabel(ScimLabel.builder()
           .withPrefix(el.getPrefix())
           .withName(el.getName())
           .withVaule(el.getValue())
-          .build());
-      });
+          .build()));
     }
 
     indigoUserBuilder.endTime(entity.getEndTime());
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/converter/X509CertificateConverter.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/converter/X509CertificateConverter.java
index c5294f868..6c5281273 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/converter/X509CertificateConverter.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/converter/X509CertificateConverter.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/exception/IllegalArgumentException.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/exception/IllegalArgumentException.java
index b6fef7a8d..d198ee4c6 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/exception/IllegalArgumentException.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/exception/IllegalArgumentException.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/exception/ScimException.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/exception/ScimException.java
index 2d08c99a4..cbf5c33dc 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/exception/ScimException.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/exception/ScimException.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/exception/ScimPatchOperationNotSupported.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/exception/ScimPatchOperationNotSupported.java
index 34a502e10..293720958 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/exception/ScimPatchOperationNotSupported.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/exception/ScimPatchOperationNotSupported.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/exception/ScimResourceExistsException.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/exception/ScimResourceExistsException.java
index 4e61a7ee2..f48e7ac62 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/exception/ScimResourceExistsException.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/exception/ScimResourceExistsException.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/exception/ScimResourceNotFoundException.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/exception/ScimResourceNotFoundException.java
index 21fdfe717..480a8399e 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/exception/ScimResourceNotFoundException.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/exception/ScimResourceNotFoundException.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/exception/ScimValidationException.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/exception/ScimValidationException.java
index b47d170b5..fcf0a1348 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/exception/ScimValidationException.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/exception/ScimValidationException.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimAddress.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimAddress.java
index efda36c5b..f9bdc9799 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimAddress.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimAddress.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimConstants.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimConstants.java
index 999e0e172..ecd4a9023 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimConstants.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimConstants.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -17,7 +17,7 @@
 
 public interface ScimConstants {
 
-  final String SCIM_CONTENT_TYPE = "application/scim+json";
+  final String SCIM_CONTENT_TYPE = "application/scim+json;charset=UTF-8";
   final String INDIGO_USER_SCHEMA = "urn:indigo-dc:scim:schemas:IndigoUser";
   final String INDIGO_GROUP_SCHEMA = "urn:indigo-dc:scim:schemas:IndigoGroup";
 
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimEmail.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimEmail.java
index 232742b25..a9bc84847 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimEmail.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimEmail.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -20,9 +20,9 @@
 import javax.annotation.Generated;
 import javax.validation.constraints.NotNull;
 
-import org.hibernate.validator.constraints.Email;
+import javax.validation.constraints.Email;
 import org.hibernate.validator.constraints.Length;
-import org.hibernate.validator.constraints.NotEmpty;
+import javax.validation.constraints.NotEmpty;
 
 import com.fasterxml.jackson.annotation.JsonCreator;
 import com.fasterxml.jackson.annotation.JsonProperty;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimErrorResponse.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimErrorResponse.java
index da1226968..8422cc23f 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimErrorResponse.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimErrorResponse.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimGroup.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimGroup.java
index 489384c74..32d243842 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimGroup.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimGroup.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -24,7 +24,7 @@
 import javax.validation.Valid;
 
 import org.hibernate.validator.constraints.Length;
-import org.hibernate.validator.constraints.NotBlank;
+import javax.validation.constraints.NotBlank;
 
 import com.fasterxml.jackson.annotation.JsonCreator;
 import com.fasterxml.jackson.annotation.JsonFilter;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimGroupPatchRequest.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimGroupPatchRequest.java
index db808016c..a95bbed35 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimGroupPatchRequest.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimGroupPatchRequest.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -22,7 +22,7 @@
 
 import javax.validation.Valid;
 
-import org.hibernate.validator.constraints.NotEmpty;
+import javax.validation.constraints.NotEmpty;
 
 import com.fasterxml.jackson.annotation.JsonCreator;
 import com.fasterxml.jackson.annotation.JsonInclude;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimGroupRef.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimGroupRef.java
index 8dd35c9dd..700793b3b 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimGroupRef.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimGroupRef.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimIndigoGroup.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimIndigoGroup.java
index 2070d10de..25bf64def 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimIndigoGroup.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimIndigoGroup.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimIndigoUser.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimIndigoUser.java
index de4be1067..27a62b064 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimIndigoUser.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimIndigoUser.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimLabel.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimLabel.java
index 5a6e26272..0aebb616d 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimLabel.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimLabel.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimListResponse.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimListResponse.java
index 029d4ae10..71180f9c7 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimListResponse.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimListResponse.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimMemberRef.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimMemberRef.java
index ba7c9c467..c8c5a24d2 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimMemberRef.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimMemberRef.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -15,7 +15,7 @@
  */
 package it.infn.mw.iam.api.scim.model;
 
-import org.hibernate.validator.constraints.NotEmpty;
+import javax.validation.constraints.NotEmpty;
 
 import com.fasterxml.jackson.annotation.JsonCreator;
 import com.fasterxml.jackson.annotation.JsonInclude;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimMeta.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimMeta.java
index 2766c6fe6..e819f7958 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimMeta.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimMeta.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimName.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimName.java
index 3368cae67..1cf56ac33 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimName.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimName.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@
 import javax.annotation.Generated;
 
 import org.hibernate.validator.constraints.Length;
-import org.hibernate.validator.constraints.NotBlank;
+import javax.validation.constraints.NotBlank;
 
 import com.fasterxml.jackson.annotation.JsonCreator;
 import com.fasterxml.jackson.annotation.JsonInclude;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimOidcId.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimOidcId.java
index 7f3dfc64b..e4836f61b 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimOidcId.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimOidcId.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -17,7 +17,7 @@
 
 import javax.annotation.Generated;
 
-import org.hibernate.validator.constraints.NotEmpty;
+import javax.validation.constraints.NotEmpty;
 
 import com.fasterxml.jackson.annotation.JsonCreator;
 import com.fasterxml.jackson.annotation.JsonInclude;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimPatchOperation.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimPatchOperation.java
index 9dde2b37b..0b0f2a8ca 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimPatchOperation.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimPatchOperation.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimPhoto.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimPhoto.java
index b30dd9d11..b1bdc85c3 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimPhoto.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimPhoto.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@
 import javax.annotation.Generated;
 import javax.validation.constraints.NotNull;
 
-import org.hibernate.validator.constraints.NotEmpty;
+import javax.validation.constraints.NotEmpty;
 import org.hibernate.validator.constraints.URL;
 
 import com.fasterxml.jackson.annotation.JsonCreator;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimResource.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimResource.java
index 7821ba33e..5360b64f5 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimResource.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimResource.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimSamlId.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimSamlId.java
index 9923f24fc..f03ff65a5 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimSamlId.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimSamlId.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@
 package it.infn.mw.iam.api.scim.model;
 
 import org.hibernate.validator.constraints.Length;
-import org.hibernate.validator.constraints.NotBlank;
+import javax.validation.constraints.NotBlank;
 
 import com.fasterxml.jackson.annotation.JsonCreator;
 import com.fasterxml.jackson.annotation.JsonInclude;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimSshKey.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimSshKey.java
index 84d14edb2..50f7e19c5 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimSshKey.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimSshKey.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@
 import java.util.Date;
 
 import org.hibernate.validator.constraints.Length;
-import org.hibernate.validator.constraints.NotBlank;
+import javax.validation.constraints.NotBlank;
 
 import com.fasterxml.jackson.annotation.JsonCreator;
 import com.fasterxml.jackson.annotation.JsonInclude;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimUser.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimUser.java
index d743db9f0..cec452873 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimUser.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimUser.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -26,8 +26,8 @@
 import javax.validation.groups.Default;
 
 import org.hibernate.validator.constraints.Length;
-import org.hibernate.validator.constraints.NotBlank;
-import org.hibernate.validator.constraints.NotEmpty;
+import javax.validation.constraints.NotBlank;
+import javax.validation.constraints.NotEmpty;
 
 import com.fasterxml.jackson.annotation.JsonCreator;
 import com.fasterxml.jackson.annotation.JsonFilter;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimUserPatchRequest.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimUserPatchRequest.java
index 30102f5d9..4a81e7043 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimUserPatchRequest.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimUserPatchRequest.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -22,7 +22,7 @@
 
 import javax.validation.Valid;
 
-import org.hibernate.validator.constraints.NotEmpty;
+import javax.validation.constraints.NotEmpty;
 
 import com.fasterxml.jackson.annotation.JsonCreator;
 import com.fasterxml.jackson.annotation.JsonInclude;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimX509Certificate.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimX509Certificate.java
index 060bfba51..1cb01fb28 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimX509Certificate.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimX509Certificate.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/provisioning/ScimGroupProvisioning.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/provisioning/ScimGroupProvisioning.java
index 6db023cdc..8aacf7b3b 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/provisioning/ScimGroupProvisioning.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/provisioning/ScimGroupProvisioning.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -27,8 +27,6 @@
 import javax.transaction.Transactional;
 
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.context.ApplicationEventPublisher;
-import org.springframework.context.ApplicationEventPublisherAware;
 import org.springframework.data.domain.Page;
 import org.springframework.stereotype.Service;
 
@@ -48,6 +46,7 @@
 import it.infn.mw.iam.api.scim.model.ScimPatchOperation;
 import it.infn.mw.iam.api.scim.model.ScimPatchOperation.ScimPatchOperationType;
 import it.infn.mw.iam.api.scim.provisioning.paging.ScimPageRequest;
+import it.infn.mw.iam.api.scim.updater.Updater;
 import it.infn.mw.iam.api.scim.updater.factory.DefaultGroupMembershipUpdaterFactory;
 import it.infn.mw.iam.core.group.IamGroupService;
 import it.infn.mw.iam.core.user.IamAccountService;
@@ -57,19 +56,18 @@
 @Service
 @Transactional
 public class ScimGroupProvisioning
-    implements ScimProvisioning>, ApplicationEventPublisherAware {
+    implements ScimProvisioning> {
 
   private static final int GROUP_NAME_MAX_LENGTH = 50;
   private static final int GROUP_FULLNAME_MAX_LENGTH = 512;
 
   private final IamGroupService groupService;
   private final IamAccountService accountService;
-  private final Clock clock;
 
   private final GroupConverter converter;
 
   private final DefaultGroupMembershipUpdaterFactory groupUpdaterFactory;
-  private ApplicationEventPublisher eventPublisher;
+
   private final ScimResourceLocationProvider locationProvider;
 
   @Autowired
@@ -79,7 +77,6 @@ public ScimGroupProvisioning(IamGroupService groupService, IamAccountService acc
     this.accountService = accountService;
     this.groupService = groupService;
     this.converter = converter;
-    this.clock = clock;
 
     this.groupUpdaterFactory = new DefaultGroupMembershipUpdaterFactory(accountService);
     this.locationProvider = locationProvider;
@@ -160,7 +157,7 @@ private void displayNameSanityChecks(String displayName) {
   private void executePatchOperation(IamGroup group, ScimPatchOperation> op) {
 
     patchOperationSanityChecks(op);
-    groupUpdaterFactory.getUpdatersForPatchOperation(group, op).forEach(u -> u.update());
+    groupUpdaterFactory.getUpdatersForPatchOperation(group, op).forEach(Updater::update);
 
   }
 
@@ -254,9 +251,6 @@ public ScimGroup replace(String id, ScimGroup scimItemToBeReplaced) {
     return converter.dtoFromEntity(newGroup);
   }
 
-  public void setApplicationEventPublisher(ApplicationEventPublisher publisher) {
-    this.eventPublisher = publisher;
-  }
 
   @Override
   public void update(String id, List>> operations) {
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/provisioning/ScimProvisioning.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/provisioning/ScimProvisioning.java
index c33f09e78..90044ddd3 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/provisioning/ScimProvisioning.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/provisioning/ScimProvisioning.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/provisioning/ScimQuery.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/provisioning/ScimQuery.java
index 923256331..2dc170aef 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/provisioning/ScimQuery.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/provisioning/ScimQuery.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/provisioning/ScimUserProvisioning.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/provisioning/ScimUserProvisioning.java
index 9aedb37ed..9cba41a9b 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/provisioning/ScimUserProvisioning.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/provisioning/ScimUserProvisioning.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/provisioning/paging/DefaultScimPageRequest.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/provisioning/paging/DefaultScimPageRequest.java
index 633d8215b..b99a3c72b 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/provisioning/paging/DefaultScimPageRequest.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/provisioning/paging/DefaultScimPageRequest.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/provisioning/paging/ScimPageRequest.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/provisioning/paging/ScimPageRequest.java
index af92ae2db..2e4c8e1c2 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/provisioning/paging/ScimPageRequest.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/provisioning/paging/ScimPageRequest.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/AccountEventBuilder.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/AccountEventBuilder.java
index 23ac8ac88..ccdf67099 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/AccountEventBuilder.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/AccountEventBuilder.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/AccountEventPublisher.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/AccountEventPublisher.java
index 81f05d52f..20cfdcbf0 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/AccountEventPublisher.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/AccountEventPublisher.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/AccountUpdater.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/AccountUpdater.java
index 3526f83be..54bd6b17a 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/AccountUpdater.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/AccountUpdater.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/AccountUpdaterBuilder.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/AccountUpdaterBuilder.java
index cb4b33c75..9e8cac79a 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/AccountUpdaterBuilder.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/AccountUpdaterBuilder.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/AccountUpdaterFactory.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/AccountUpdaterFactory.java
index 9abe9586d..85af3bf25 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/AccountUpdaterFactory.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/AccountUpdaterFactory.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/DefaultAccountUpdater.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/DefaultAccountUpdater.java
index 3ec99404f..6042abbea 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/DefaultAccountUpdater.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/DefaultAccountUpdater.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/DefaultUpdater.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/DefaultUpdater.java
index 9ad579896..26d1a2d93 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/DefaultUpdater.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/DefaultUpdater.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/Updater.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/Updater.java
index ed365e757..8e5dc5463 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/Updater.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/Updater.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/UpdaterType.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/UpdaterType.java
index c04cce132..b370099d5 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/UpdaterType.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/UpdaterType.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -48,4 +48,4 @@ public enum UpdaterType {
   public String getDescription() {
     return description;
   }
-}
\ No newline at end of file
+}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/builders/AccountBuilderSupport.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/builders/AccountBuilderSupport.java
index 7bcee7a5f..36e6847da 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/builders/AccountBuilderSupport.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/builders/AccountBuilderSupport.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/builders/AccountUpdaters.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/builders/AccountUpdaters.java
index fab6c9ecf..d57b61cfd 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/builders/AccountUpdaters.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/builders/AccountUpdaters.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -44,4 +44,4 @@ public static Replacers replacers(IamAccountRepository repo, IamAccountService a
   }
   
 
-}
\ No newline at end of file
+}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/builders/Adders.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/builders/Adders.java
index 1db71b545..63e25efcb 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/builders/Adders.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/builders/Adders.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -78,7 +78,7 @@ public Adders(IamAccountRepository repo, IamAccountService accountService,
     sshKeyAddChecks = buildSshKeyAddChecks();
     x509CertificateAddChecks = buildX509CertificateAddChecks();
 
-    linkSshKeys = (keys) -> {
+    linkSshKeys = keys -> {
       for (IamSshKey k : keys) {
         if (!isNull(k)) {
           accountService.addSshKey(account, k);
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/builders/GroupMembershipManagement.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/builders/GroupMembershipManagement.java
index 0774377f2..af4c014b4 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/builders/GroupMembershipManagement.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/builders/GroupMembershipManagement.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -43,10 +43,10 @@ public GroupMembershipManagement(IamAccount account, IamAccountService accountSe
     this.account = account;
     this.accountService = accountService;
 
-    groupAdder = (group) -> this.accountService.addToGroup(this.account, group);
-    groupRemover = (group) -> this.accountService.removeFromGroup(this.account, group);
+    groupAdder = group -> this.accountService.addToGroup(this.account, group);
+    groupRemover = group -> this.accountService.removeFromGroup(this.account, group);
 
-    accountIsMember = (group) -> {
+    accountIsMember = group -> {
       for (IamAccountGroupMembership m : this.account.getGroups()) {
         if (m.getGroup().equals(group)) {
           return true;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/builders/Removers.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/builders/Removers.java
index aedab3512..f94c220c8 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/builders/Removers.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/builders/Removers.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -48,7 +48,7 @@ public class Removers extends AccountBuilderSupport {
 
   public Removers(IamAccountRepository repo, IamAccountService accountService, IamAccount account) {
     super(repo, accountService, account);
-    unlinkSshKeys = (keys) -> {
+    unlinkSshKeys = keys -> {
       for (IamSshKey k : keys) {
         if (!isNull(k)) {
           accountService.removeSshKey(account, k);
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/builders/Replacers.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/builders/Replacers.java
index bec42944c..825d39479 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/builders/Replacers.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/builders/Replacers.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/factory/DefaultAccountUpdaterFactory.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/factory/DefaultAccountUpdaterFactory.java
index 1c3bed84b..7ef25001d 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/factory/DefaultAccountUpdaterFactory.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/factory/DefaultAccountUpdaterFactory.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/factory/DefaultGroupMembershipUpdaterFactory.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/factory/DefaultGroupMembershipUpdaterFactory.java
index c8912e0c1..aee212c23 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/factory/DefaultGroupMembershipUpdaterFactory.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/factory/DefaultGroupMembershipUpdaterFactory.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/util/AccountFinder.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/util/AccountFinder.java
index 8de8a44a1..4c00f98d6 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/util/AccountFinder.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/util/AccountFinder.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/util/CollectionHelpers.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/util/CollectionHelpers.java
index f323b0bc6..a45c3b4d4 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/util/CollectionHelpers.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/util/CollectionHelpers.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/util/IdNotBoundChecker.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/util/IdNotBoundChecker.java
index 8f9438140..1d3907ebd 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/util/IdNotBoundChecker.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/util/IdNotBoundChecker.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/util/NullSafeNotEqualsMatcher.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/util/NullSafeNotEqualsMatcher.java
index cd922ab58..83901417e 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/util/NullSafeNotEqualsMatcher.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/util/NullSafeNotEqualsMatcher.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/util/ScimCollectionConverter.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/util/ScimCollectionConverter.java
index 4f817b5fb..5ea5bde12 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/util/ScimCollectionConverter.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/util/ScimCollectionConverter.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/util/ScimToEntity.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/util/ScimToEntity.java
index dd3fb663f..5be8a8231 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/util/ScimToEntity.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/updater/util/ScimToEntity.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/DefaultScopePolicyConverter.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/DefaultScopePolicyConverter.java
index 39216b8ac..304bce934 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/DefaultScopePolicyConverter.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/DefaultScopePolicyConverter.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/DefaultScopePolicyService.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/DefaultScopePolicyService.java
index b623d254f..5b897509c 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/DefaultScopePolicyService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/DefaultScopePolicyService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/DuplicateScopePolicyError.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/DuplicateScopePolicyError.java
index e06047340..0977cec99 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/DuplicateScopePolicyError.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/DuplicateScopePolicyError.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/GroupRefDTO.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/GroupRefDTO.java
index 26e2f779c..e282de691 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/GroupRefDTO.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/GroupRefDTO.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -17,7 +17,7 @@
 
 import javax.validation.constraints.Size;
 
-import org.hibernate.validator.constraints.NotEmpty;
+import javax.validation.constraints.NotEmpty;
 
 import com.fasterxml.jackson.annotation.JsonInclude;
 
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/IamAccountRefDTO.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/IamAccountRefDTO.java
index 488bd3b49..c088a29dc 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/IamAccountRefDTO.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/IamAccountRefDTO.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -17,7 +17,7 @@
 
 import javax.validation.constraints.Size;
 
-import org.hibernate.validator.constraints.NotEmpty;
+import javax.validation.constraints.NotEmpty;
 
 import it.infn.mw.iam.api.scope_policy.validation.IamAccountId;
 
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/IamScopePolicyConverter.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/IamScopePolicyConverter.java
index 08e3af1ad..0bf950caa 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/IamScopePolicyConverter.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/IamScopePolicyConverter.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/InvalidScopePolicyError.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/InvalidScopePolicyError.java
index ba56b1946..4df5d028e 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/InvalidScopePolicyError.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/InvalidScopePolicyError.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/ScopePolicyController.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/ScopePolicyController.java
index 77dfe3188..518b17c52 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/ScopePolicyController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/ScopePolicyController.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/ScopePolicyDTO.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/ScopePolicyDTO.java
index 71578b848..ee520f080 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/ScopePolicyDTO.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/ScopePolicyDTO.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -22,13 +22,12 @@
 import javax.validation.constraints.Pattern;
 import javax.validation.constraints.Size;
 
-import org.hibernate.validator.constraints.NotBlank;
+import javax.validation.constraints.NotBlank;
 
 import com.fasterxml.jackson.annotation.JsonCreator;
 import com.fasterxml.jackson.annotation.JsonProperty;
 import com.fasterxml.jackson.databind.annotation.JsonSerialize;
 
-import cz.jirutka.validator.collection.constraints.EachSize;
 import it.infn.mw.iam.api.scim.controller.utils.JsonDateSerializer;
 import it.infn.mw.iam.api.scope_policy.validation.ScopePolicy;
 
@@ -63,8 +62,6 @@ public class ScopePolicyDTO {
   @Valid
   private GroupRefDTO group;
 
-  @EachSize(min = 1, max = 255,
-      message = "Invalid scope policy: scope length must be >= 1 and < 255 characters")
   private Set scopes;
 
   public ScopePolicyDTO() {}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/ScopePolicyNotFoundError.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/ScopePolicyNotFoundError.java
index 0115ee953..249e7816e 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/ScopePolicyNotFoundError.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/ScopePolicyNotFoundError.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/ScopePolicyService.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/ScopePolicyService.java
index 41e5b19c3..e3ca63f1b 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/ScopePolicyService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/ScopePolicyService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/validation/IamAccountId.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/validation/IamAccountId.java
index 28988a31c..3e448cbbc 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/validation/IamAccountId.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/validation/IamAccountId.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/validation/IamAccountIdValidator.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/validation/IamAccountIdValidator.java
index c5da79b8f..175aae67f 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/validation/IamAccountIdValidator.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/validation/IamAccountIdValidator.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/validation/IamGroupId.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/validation/IamGroupId.java
index e1024b46e..387a0d9c6 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/validation/IamGroupId.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/validation/IamGroupId.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/validation/IamGroupIdValidator.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/validation/IamGroupIdValidator.java
index 9a7f6d7fc..657b53278 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/validation/IamGroupIdValidator.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/validation/IamGroupIdValidator.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/validation/ScopePolicy.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/validation/ScopePolicy.java
index 8a3a55acc..1e329daf7 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/validation/ScopePolicy.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/validation/ScopePolicy.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/validation/ScopePolicyValidator.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/validation/ScopePolicyValidator.java
index 0a8cd5a7d..4320bbf02 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/validation/ScopePolicyValidator.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/scope_policy/validation/ScopePolicyValidator.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -26,12 +26,21 @@
 
 public class ScopePolicyValidator implements ConstraintValidator {
 
+  private static final String INVALID_SCOPE_LENGTH_MSG =
+      "{it.infn.mw.iam.api.scope_policy.validation.ScopePolicyValidator.invalidScopeLength.message}";
+
+  private static final String NULL_SCOPE_MSG =
+      "{it.infn.mw.iam.api.scope_policy.validation.ScopePolicyValidator.nullScope.message}";
+
   private static final String EMPTY_SCOPE_MSG =
       "{it.infn.mw.iam.api.scope_policy.validation.ScopePolicyValidator.emptyScope.message}";
-  
+
   private static final String NULL_MATCHING_POLICY_MSG =
       "{it.infn.mw.iam.api.scope_policy.validation.ScopePolicyValidator.nullMatchingPolicy.message}";
 
+  private static final int SCOPE_MIN_LENGTH = 1;
+  private static final int SCOPE_MAX_LENGTH = 255;
+
   public ScopePolicyValidator() {
     // empty
   }
@@ -42,13 +51,14 @@ public void initialize(ScopePolicy constraintAnnotation) {
   }
 
   private boolean isValidMatchingPolicy(ScopePolicyDTO value, ConstraintValidatorContext context) {
-    
-    if (isNull(value.getMatchingPolicy())){
+
+    if (isNull(value.getMatchingPolicy())) {
       context.disableDefaultConstraintViolation();
-      context.buildConstraintViolationWithTemplate(NULL_MATCHING_POLICY_MSG).addConstraintViolation();
+      context.buildConstraintViolationWithTemplate(NULL_MATCHING_POLICY_MSG)
+        .addConstraintViolation();
       return false;
     }
-    
+
     if ((value.getMatchingPolicy().equals(PATH.name())
         || value.getMatchingPolicy().equals(REGEXP.name()))
         && (isNull(value.getScopes()) || value.getScopes().isEmpty())) {
@@ -61,10 +71,37 @@ private boolean isValidMatchingPolicy(ScopePolicyDTO value, ConstraintValidatorC
     return true;
   }
 
+
+  private boolean hasValidScopes(ScopePolicyDTO value, ConstraintValidatorContext context) {
+
+    if (isNull(value.getScopes()) || value.getScopes().isEmpty()) {
+      return true;
+    }
+
+    for (String s : value.getScopes()) {
+      if (isNull(s)) {
+        context.disableDefaultConstraintViolation();
+        context.buildConstraintViolationWithTemplate(NULL_SCOPE_MSG).addConstraintViolation();
+        return false;
+      }
+
+      final int scopeLength = s.length();
+      if (scopeLength < SCOPE_MIN_LENGTH || scopeLength > SCOPE_MAX_LENGTH) {
+        context.disableDefaultConstraintViolation();
+        context.buildConstraintViolationWithTemplate(INVALID_SCOPE_LENGTH_MSG)
+          .addConstraintViolation();
+        return false;
+      }
+    }
+
+    return true;
+  }
+
   @Override
   public boolean isValid(ScopePolicyDTO value, ConstraintValidatorContext context) {
-    boolean nullChecks = !(value == null || (value.getAccount() != null && value.getGroup() != null));
-    return nullChecks && isValidMatchingPolicy(value, context);
+    boolean nullChecks =
+        !(value == null || (value.getAccount() != null && value.getGroup() != null));
+    return nullChecks && isValidMatchingPolicy(value, context) && hasValidScopes(value, context);
   }
 
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/AccessTokensController.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/AccessTokensController.java
index ae3c64745..3cea64d02 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/AccessTokensController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/AccessTokensController.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/Constants.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/Constants.java
index 759b47306..18b5b0907 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/Constants.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/Constants.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/DefaultTokensResourceLocationProvider.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/DefaultTokensResourceLocationProvider.java
index 60310271a..f05505284 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/DefaultTokensResourceLocationProvider.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/DefaultTokensResourceLocationProvider.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/RefreshTokensController.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/RefreshTokensController.java
index 09884e851..78f1517a7 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/RefreshTokensController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/RefreshTokensController.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/TokensControllerSupport.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/TokensControllerSupport.java
index 568e3adb9..2794bb1c0 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/TokensControllerSupport.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/TokensControllerSupport.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/TokensResourceLocationProvider.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/TokensResourceLocationProvider.java
index 4fc5d4b3a..82c396bbb 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/TokensResourceLocationProvider.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/TokensResourceLocationProvider.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/converter/TokensConverter.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/converter/TokensConverter.java
index 5686c0fb7..ad4712322 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/converter/TokensConverter.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/converter/TokensConverter.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/exception/TokenNotFoundException.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/exception/TokenNotFoundException.java
index aa1793a08..af942273d 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/exception/TokenNotFoundException.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/exception/TokenNotFoundException.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/model/AccessToken.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/model/AccessToken.java
index 7d57b53ba..e41a0ae30 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/model/AccessToken.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/model/AccessToken.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/model/ClientRef.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/model/ClientRef.java
index 2b3ab9f30..3e68addd5 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/model/ClientRef.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/model/ClientRef.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/model/IdTokenRef.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/model/IdTokenRef.java
index 629f5baeb..13c41d31f 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/model/IdTokenRef.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/model/IdTokenRef.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/model/RefreshToken.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/model/RefreshToken.java
index bf80cb28f..0973ecf94 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/model/RefreshToken.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/model/RefreshToken.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/model/TokensListResponse.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/model/TokensListResponse.java
index d719dcfd7..7ac556dad 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/model/TokensListResponse.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/model/TokensListResponse.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/model/UserRef.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/model/UserRef.java
index 88398edf8..7e20d0e79 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/model/UserRef.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/model/UserRef.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/service/AbstractTokenService.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/service/AbstractTokenService.java
index 9e6f66788..7699b026f 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/service/AbstractTokenService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/service/AbstractTokenService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,6 +16,7 @@
 package it.infn.mw.iam.api.tokens.service;
 
 import java.util.List;
+
 import it.infn.mw.iam.api.common.ListResponseDTO;
 import it.infn.mw.iam.api.common.OffsetPageable;
 import it.infn.mw.iam.api.tokens.service.paging.TokensPageRequest;
@@ -40,7 +41,7 @@ protected ListResponseDTO buildListResponse(List resources, OffsetPageable
     
     ListResponseDTO.Builder builder = ListResponseDTO.builder();
     builder.itemsPerPage(resources.size());
-    builder.startIndex(op.getOffset() + 1);
+    builder.startIndex((int) op.getOffset() + 1);
     builder.resources(resources);
     builder.totalResults(totalElements);
     return builder.build();
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/service/DefaultAccessTokenService.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/service/DefaultAccessTokenService.java
index 2c7aca0a7..45a87d297 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/service/DefaultAccessTokenService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/service/DefaultAccessTokenService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/service/DefaultRefreshTokenService.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/service/DefaultRefreshTokenService.java
index 317ff8501..7fd9c5bcb 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/service/DefaultRefreshTokenService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/service/DefaultRefreshTokenService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/service/TokenService.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/service/TokenService.java
index a081d6e3d..56a26f060 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/service/TokenService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/service/TokenService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/service/paging/DefaultTokensPageRequest.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/service/paging/DefaultTokensPageRequest.java
index 6b3e0ecf1..be1b9249d 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/service/paging/DefaultTokensPageRequest.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/service/paging/DefaultTokensPageRequest.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/service/paging/TokensPageRequest.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/service/paging/TokensPageRequest.java
index 765364973..4d3e64276 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/service/paging/TokensPageRequest.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/tokens/service/paging/TokensPageRequest.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/utils/FindUtils.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/utils/FindUtils.java
index 6dd36d768..cd21071ba 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/utils/FindUtils.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/utils/FindUtils.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -27,6 +27,8 @@
 
 public class FindUtils {
 
+  private FindUtils() {}
+
   public static  ScimListResponse responseFromPage(Page results,
       Converter converter,
       Pageable pageable) {
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/utils/ValidationErrorUtils.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/utils/ValidationErrorUtils.java
index acb445564..a76131b02 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/utils/ValidationErrorUtils.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/utils/ValidationErrorUtils.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/validators/HtmlEscapeCheck.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/validators/HtmlEscapeCheck.java
index 619622e2d..83bbe9568 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/validators/HtmlEscapeCheck.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/validators/HtmlEscapeCheck.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -34,4 +34,4 @@
   Class[] groups() default {};
 
   Class[] payload() default {};
-}
\ No newline at end of file
+}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/validators/HtmlEscapeCheckValidator.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/validators/HtmlEscapeCheckValidator.java
index 4f5dd5368..a8974f96b 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/validators/HtmlEscapeCheckValidator.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/validators/HtmlEscapeCheckValidator.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/validators/IamGroupName.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/validators/IamGroupName.java
index 8b59df97a..e3051ff5b 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/validators/IamGroupName.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/validators/IamGroupName.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/validators/IamGroupNameValidator.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/validators/IamGroupNameValidator.java
index 64fe66195..6174e2d54 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/validators/IamGroupNameValidator.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/validators/IamGroupNameValidator.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/validators/IamGroupRequestNotes.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/validators/IamGroupRequestNotes.java
index 48e0b26a6..a63e1bf90 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/validators/IamGroupRequestNotes.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/validators/IamGroupRequestNotes.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/validators/IamGroupRequestNotesValidator.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/validators/IamGroupRequestNotesValidator.java
index a480389d0..ac7cc3b98 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/validators/IamGroupRequestNotesValidator.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/validators/IamGroupRequestNotesValidator.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/validators/NoQueryParamsUrl.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/validators/NoQueryParamsUrl.java
index 449ad1ae6..733a896d3 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/validators/NoQueryParamsUrl.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/validators/NoQueryParamsUrl.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -34,4 +34,4 @@
   Class[] groups() default {};
 
   Class[] payload() default {};
-}
\ No newline at end of file
+}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/validators/NoQueryParamsUrlValidator.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/validators/NoQueryParamsUrlValidator.java
index d3d2664be..9f7630066 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/validators/NoQueryParamsUrlValidator.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/validators/NoQueryParamsUrlValidator.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/validators/NoSpecialCharacters.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/validators/NoSpecialCharacters.java
index d62b1aa7e..415a50682 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/validators/NoSpecialCharacters.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/validators/NoSpecialCharacters.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -34,4 +34,4 @@
   Class[] groups() default {};
 
   Class[] payload() default {};
-}
\ No newline at end of file
+}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/validators/NoSpecialCharactersValidator.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/validators/NoSpecialCharactersValidator.java
index 11f0bdb19..ede8b44f7 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/validators/NoSpecialCharactersValidator.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/validators/NoSpecialCharactersValidator.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/AuditDataSerializer.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/AuditDataSerializer.java
index 0ecc5f9c8..c9dd0dcd7 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/AuditDataSerializer.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/AuditDataSerializer.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/AuditEventLogger.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/AuditEventLogger.java
index 8575e5fb1..049299908 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/AuditEventLogger.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/AuditEventLogger.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/IamAuditEventLogger.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/IamAuditEventLogger.java
index af6ff226e..0465c149e 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/IamAuditEventLogger.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/IamAuditEventLogger.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/IamAuditField.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/IamAuditField.java
index 728612b88..28de0bc47 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/IamAuditField.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/IamAuditField.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/IamAuditLoggingListener.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/IamAuditLoggingListener.java
index 7e3bc6326..0cb13b413 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/IamAuditLoggingListener.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/IamAuditLoggingListener.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/IamAuthenticationFailureAuditListener.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/IamAuthenticationFailureAuditListener.java
index e52829414..0e4579fde 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/IamAuthenticationFailureAuditListener.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/IamAuthenticationFailureAuditListener.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/IamAuthenticationSuccessAuditListener.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/IamAuthenticationSuccessAuditListener.java
index 23957018d..2fb65bfdc 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/IamAuthenticationSuccessAuditListener.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/IamAuthenticationSuccessAuditListener.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/IamAuthorizationAuditListener.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/IamAuthorizationAuditListener.java
index d2cf27df7..5e2e49a97 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/IamAuthorizationAuditListener.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/IamAuthorizationAuditListener.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/IamAuditApplicationEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/IamAuditApplicationEvent.java
index 660f571cc..1f2761dbd 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/IamAuditApplicationEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/IamAuditApplicationEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/AccountCreatedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/AccountCreatedEvent.java
index 011d6a762..0c8267946 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/AccountCreatedEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/AccountCreatedEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/AccountDisabledEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/AccountDisabledEvent.java
index c1b19dba0..27689a604 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/AccountDisabledEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/AccountDisabledEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/AccountEndTimeUpdatedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/AccountEndTimeUpdatedEvent.java
index e5cbf0fe4..99f97f5b0 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/AccountEndTimeUpdatedEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/AccountEndTimeUpdatedEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/AccountEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/AccountEvent.java
index edbee5cbd..ad590e451 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/AccountEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/AccountEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/AccountLinkedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/AccountLinkedEvent.java
index 14bc0dbf0..2afb53e1f 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/AccountLinkedEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/AccountLinkedEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/AccountRemovedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/AccountRemovedEvent.java
index 6d6989a27..94afe0e81 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/AccountRemovedEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/AccountRemovedEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/AccountReplacedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/AccountReplacedEvent.java
index ffa045cd4..03e8586d7 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/AccountReplacedEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/AccountReplacedEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/AccountRestoredEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/AccountRestoredEvent.java
index 81839f5f6..025d25a9f 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/AccountRestoredEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/AccountRestoredEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/AccountUnlinkedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/AccountUnlinkedEvent.java
index 80c581e1b..c621ff85c 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/AccountUnlinkedEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/AccountUnlinkedEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/AccountUpdatedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/AccountUpdatedEvent.java
index 4b0735e58..e90292c5f 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/AccountUpdatedEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/AccountUpdatedEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/ActiveReplacedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/ActiveReplacedEvent.java
index 7f519721b..faca81c41 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/ActiveReplacedEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/ActiveReplacedEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/EmailReplacedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/EmailReplacedEvent.java
index 13d9a62f0..310ccb4ba 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/EmailReplacedEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/EmailReplacedEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/FamilyNameReplacedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/FamilyNameReplacedEvent.java
index 20b0b9d48..b8a760fc6 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/FamilyNameReplacedEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/FamilyNameReplacedEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/GivenNameReplacedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/GivenNameReplacedEvent.java
index 935945586..995421d18 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/GivenNameReplacedEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/GivenNameReplacedEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/PasswordReplacedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/PasswordReplacedEvent.java
index 9507e01dd..067b252b0 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/PasswordReplacedEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/PasswordReplacedEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/PictureRemovedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/PictureRemovedEvent.java
index f81e97ce4..4e6f2f2a8 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/PictureRemovedEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/PictureRemovedEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/PictureReplacedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/PictureReplacedEvent.java
index 877499264..2a06ef99e 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/PictureReplacedEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/PictureReplacedEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/UsernameReplacedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/UsernameReplacedEvent.java
index 74d74c2a2..15b97fa06 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/UsernameReplacedEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/UsernameReplacedEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/X509CertificateLinkedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/X509CertificateLinkedEvent.java
index 7a8e0812e..0604a29c9 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/X509CertificateLinkedEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/X509CertificateLinkedEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/X509CertificateUnlinkedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/X509CertificateUnlinkedEvent.java
index 27072195a..80159d66f 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/X509CertificateUnlinkedEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/X509CertificateUnlinkedEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/X509CertificateUpdatedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/X509CertificateUpdatedEvent.java
index 4cf0d60f1..fee6c70c4 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/X509CertificateUpdatedEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/X509CertificateUpdatedEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/attribute/AccountAttributeEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/attribute/AccountAttributeEvent.java
index 7137e2438..8718aaf4b 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/attribute/AccountAttributeEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/attribute/AccountAttributeEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/attribute/AccountAttributeRemovedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/attribute/AccountAttributeRemovedEvent.java
index cd6aec70c..8d7aa702e 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/attribute/AccountAttributeRemovedEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/attribute/AccountAttributeRemovedEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/attribute/AccountAttributeSetEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/attribute/AccountAttributeSetEvent.java
index 6838213b2..07140a317 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/attribute/AccountAttributeSetEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/attribute/AccountAttributeSetEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/authority/AuthorityAddedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/authority/AuthorityAddedEvent.java
index 499ff8327..1887f3eaa 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/authority/AuthorityAddedEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/authority/AuthorityAddedEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/authority/AuthorityEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/authority/AuthorityEvent.java
index bf782d91b..ce1b12d4a 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/authority/AuthorityEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/authority/AuthorityEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/authority/AuthorityRemovedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/authority/AuthorityRemovedEvent.java
index 8c1c578b6..4705075f8 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/authority/AuthorityRemovedEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/authority/AuthorityRemovedEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/group/GroupMembershipAddedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/group/GroupMembershipAddedEvent.java
index dae226546..6d162063e 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/group/GroupMembershipAddedEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/group/GroupMembershipAddedEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/group/GroupMembershipRemovedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/group/GroupMembershipRemovedEvent.java
index 850085685..90b2de4e5 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/group/GroupMembershipRemovedEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/group/GroupMembershipRemovedEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/group/GroupMembershipUpdatedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/group/GroupMembershipUpdatedEvent.java
index 055bb57ec..b814d5760 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/group/GroupMembershipUpdatedEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/group/GroupMembershipUpdatedEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/label/AccountLabelEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/label/AccountLabelEvent.java
index a52649793..b45ca8990 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/label/AccountLabelEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/label/AccountLabelEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/label/AccountLabelRemovedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/label/AccountLabelRemovedEvent.java
index 88cb5cec1..2c4008ef6 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/label/AccountLabelRemovedEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/label/AccountLabelRemovedEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/label/AccountLabelSetEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/label/AccountLabelSetEvent.java
index 3df73f350..2bd4cfba5 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/label/AccountLabelSetEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/label/AccountLabelSetEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/oidc/OidcAccountAddedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/oidc/OidcAccountAddedEvent.java
index ee2b23096..b3a9bab04 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/oidc/OidcAccountAddedEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/oidc/OidcAccountAddedEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/oidc/OidcAccountRemovedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/oidc/OidcAccountRemovedEvent.java
index 9b9f25f1e..e1b34b1ec 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/oidc/OidcAccountRemovedEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/oidc/OidcAccountRemovedEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/oidc/OidcAccountUpdatedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/oidc/OidcAccountUpdatedEvent.java
index b53931858..9d25f5aba 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/oidc/OidcAccountUpdatedEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/oidc/OidcAccountUpdatedEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/password/PasswordResetEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/password/PasswordResetEvent.java
index 8759c5e92..56e913967 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/password/PasswordResetEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/password/PasswordResetEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/password/PasswordUpdatedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/password/PasswordUpdatedEvent.java
index 6df6d2793..ec95697a9 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/password/PasswordUpdatedEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/password/PasswordUpdatedEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/saml/SamlAccountAddedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/saml/SamlAccountAddedEvent.java
index d17836b7c..e6e3e3a88 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/saml/SamlAccountAddedEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/saml/SamlAccountAddedEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/saml/SamlAccountRemovedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/saml/SamlAccountRemovedEvent.java
index 1797e2724..3d7b5f406 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/saml/SamlAccountRemovedEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/saml/SamlAccountRemovedEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/saml/SamlAccountUpdatedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/saml/SamlAccountUpdatedEvent.java
index 2f3a2ce16..d791ef849 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/saml/SamlAccountUpdatedEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/saml/SamlAccountUpdatedEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/ssh/SshKeyAddedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/ssh/SshKeyAddedEvent.java
index 1ae88c931..2611755d7 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/ssh/SshKeyAddedEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/ssh/SshKeyAddedEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/ssh/SshKeyRemovedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/ssh/SshKeyRemovedEvent.java
index 1f1bef283..cd2e37ab4 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/ssh/SshKeyRemovedEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/ssh/SshKeyRemovedEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/ssh/SshKeyUpdatedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/ssh/SshKeyUpdatedEvent.java
index 74ba8a29d..ce0eabf1e 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/ssh/SshKeyUpdatedEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/ssh/SshKeyUpdatedEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/x509/X509CertificateAddedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/x509/X509CertificateAddedEvent.java
index 2e50295b6..d06b5f276 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/x509/X509CertificateAddedEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/x509/X509CertificateAddedEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/x509/X509CertificateRemovedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/x509/X509CertificateRemovedEvent.java
index e0167d777..71022696c 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/x509/X509CertificateRemovedEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/x509/X509CertificateRemovedEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/x509/X509CertificateUpdatedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/x509/X509CertificateUpdatedEvent.java
index 5148f5024..44f00fa5f 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/x509/X509CertificateUpdatedEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/x509/X509CertificateUpdatedEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/aup/AupCreatedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/aup/AupCreatedEvent.java
index e6fe11368..459f35fa7 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/aup/AupCreatedEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/aup/AupCreatedEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/aup/AupDeletedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/aup/AupDeletedEvent.java
index e3dbccb03..fcf9a80c1 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/aup/AupDeletedEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/aup/AupDeletedEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/aup/AupEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/aup/AupEvent.java
index 31286de1e..933ec52a5 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/aup/AupEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/aup/AupEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/aup/AupSignedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/aup/AupSignedEvent.java
index e7e3568ad..972f9bbd1 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/aup/AupSignedEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/aup/AupSignedEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/aup/AupUpdatedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/aup/AupUpdatedEvent.java
index 0cbad30f0..3a4335cc2 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/aup/AupUpdatedEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/aup/AupUpdatedEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/auth/IamAuthenticationEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/auth/IamAuthenticationEvent.java
index 7939614af..d6354fc6c 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/auth/IamAuthenticationEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/auth/IamAuthenticationEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/auth/IamAuthenticationFailureEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/auth/IamAuthenticationFailureEvent.java
index 83082e9b6..f4159a693 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/auth/IamAuthenticationFailureEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/auth/IamAuthenticationFailureEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/auth/IamAuthenticationSuccessEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/auth/IamAuthenticationSuccessEvent.java
index 0b64cddad..bb7163507 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/auth/IamAuthenticationSuccessEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/auth/IamAuthenticationSuccessEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/auth/IamAuthorizationFailureEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/auth/IamAuthorizationFailureEvent.java
index 9451398ae..3c8438e17 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/auth/IamAuthorizationFailureEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/auth/IamAuthorizationFailureEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/group/GroupCreatedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/group/GroupCreatedEvent.java
index 1be47730d..4bdf3ed29 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/group/GroupCreatedEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/group/GroupCreatedEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/group/GroupEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/group/GroupEvent.java
index ac5e33a35..e2f60da6b 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/group/GroupEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/group/GroupEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/group/GroupRemovedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/group/GroupRemovedEvent.java
index eb911b479..a91fbd6a3 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/group/GroupRemovedEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/group/GroupRemovedEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/group/GroupReplacedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/group/GroupReplacedEvent.java
index 43df27cab..269cee3c4 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/group/GroupReplacedEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/group/GroupReplacedEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/group/label/GroupLabelEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/group/label/GroupLabelEvent.java
index d9035156a..68210fb64 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/group/label/GroupLabelEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/group/label/GroupLabelEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/group/label/GroupLabelRemovedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/group/label/GroupLabelRemovedEvent.java
index bda2d786b..6e149ffd5 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/group/label/GroupLabelRemovedEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/group/label/GroupLabelRemovedEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/group/label/GroupLabelSetEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/group/label/GroupLabelSetEvent.java
index e64fab9de..f3a7629ee 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/group/label/GroupLabelSetEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/group/label/GroupLabelSetEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/group/request/GroupRequestApprovedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/group/request/GroupRequestApprovedEvent.java
index ad8ded01b..feb17b52e 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/group/request/GroupRequestApprovedEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/group/request/GroupRequestApprovedEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/group/request/GroupRequestCreatedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/group/request/GroupRequestCreatedEvent.java
index 21e638d9a..5831d1610 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/group/request/GroupRequestCreatedEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/group/request/GroupRequestCreatedEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/group/request/GroupRequestDeletedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/group/request/GroupRequestDeletedEvent.java
index e0d6af889..8cc70e3b3 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/group/request/GroupRequestDeletedEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/group/request/GroupRequestDeletedEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/group/request/GroupRequestEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/group/request/GroupRequestEvent.java
index 8860e0f2a..4cb5b34b0 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/group/request/GroupRequestEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/group/request/GroupRequestEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/group/request/GroupRequestRejectedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/group/request/GroupRequestRejectedEvent.java
index 5605fcd0c..e02932555 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/group/request/GroupRequestRejectedEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/group/request/GroupRequestRejectedEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/registration/RegistrationApproveEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/registration/RegistrationApproveEvent.java
index 234742c22..d151ec414 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/registration/RegistrationApproveEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/registration/RegistrationApproveEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/registration/RegistrationConfirmEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/registration/RegistrationConfirmEvent.java
index bc20ee438..b2c399227 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/registration/RegistrationConfirmEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/registration/RegistrationConfirmEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/registration/RegistrationEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/registration/RegistrationEvent.java
index 83fb64df3..f1a1f319a 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/registration/RegistrationEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/registration/RegistrationEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/registration/RegistrationRejectEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/registration/RegistrationRejectEvent.java
index 9935f7210..5d14ae19e 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/registration/RegistrationRejectEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/registration/RegistrationRejectEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/registration/RegistrationRequestEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/registration/RegistrationRequestEvent.java
index 81aeb9e25..f9ee30fc7 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/registration/RegistrationRequestEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/registration/RegistrationRequestEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/scope_policy/ScopePolicyCreatedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/scope_policy/ScopePolicyCreatedEvent.java
index 6f0941046..0beeac0f7 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/scope_policy/ScopePolicyCreatedEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/scope_policy/ScopePolicyCreatedEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/scope_policy/ScopePolicyDeletedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/scope_policy/ScopePolicyDeletedEvent.java
index 7fb4950f3..9df951c85 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/scope_policy/ScopePolicyDeletedEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/scope_policy/ScopePolicyDeletedEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/scope_policy/ScopePolicyEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/scope_policy/ScopePolicyEvent.java
index 6dcea7a0f..d9b2708e6 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/scope_policy/ScopePolicyEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/scope_policy/ScopePolicyEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/scope_policy/ScopePolicyUpdatedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/scope_policy/ScopePolicyUpdatedEvent.java
index 68441ee5d..ed41f1ea7 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/scope_policy/ScopePolicyUpdatedEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/scope_policy/ScopePolicyUpdatedEvent.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamAccountSerializer.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamAccountSerializer.java
index 99342d565..260279b78 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamAccountSerializer.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamAccountSerializer.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamAttributeSerializer.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamAttributeSerializer.java
index d421c4b49..2efc06f8f 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamAttributeSerializer.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamAttributeSerializer.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -18,7 +18,6 @@
 import java.io.IOException;
 
 import com.fasterxml.jackson.core.JsonGenerator;
-import com.fasterxml.jackson.core.JsonProcessingException;
 import com.fasterxml.jackson.databind.JsonSerializer;
 import com.fasterxml.jackson.databind.SerializerProvider;
 
@@ -28,7 +27,7 @@ public class IamAttributeSerializer extends JsonSerializer {
 
   @Override
   public void serialize(IamAttribute value, JsonGenerator gen, SerializerProvider serializers)
-      throws IOException, JsonProcessingException {
+      throws IOException {
 
     gen.writeStartObject();
     gen.writeStringField("name", value.getName());
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamAupSignatureSerializer.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamAupSignatureSerializer.java
index 98460aaa7..aa5bc3a7f 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamAupSignatureSerializer.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamAupSignatureSerializer.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamAuthenticationFailureEventSerializer.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamAuthenticationFailureEventSerializer.java
index a9eb40c99..298ae7600 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamAuthenticationFailureEventSerializer.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamAuthenticationFailureEventSerializer.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamAuthenticationSuccessSerializer.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamAuthenticationSuccessSerializer.java
index 93c7f240f..a37f5ce14 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamAuthenticationSuccessSerializer.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamAuthenticationSuccessSerializer.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamAuthorizationFailureEventSerializer.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamAuthorizationFailureEventSerializer.java
index c3688790c..91d97e427 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamAuthorizationFailureEventSerializer.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamAuthorizationFailureEventSerializer.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamGroupCollectionSerializer.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamGroupCollectionSerializer.java
index 9cbd405fa..c891aba83 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamGroupCollectionSerializer.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamGroupCollectionSerializer.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamGroupRequestSerializer.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamGroupRequestSerializer.java
index 93ecb2f61..f6b2fd1e3 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamGroupRequestSerializer.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamGroupRequestSerializer.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamGroupSerializer.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamGroupSerializer.java
index e35adaae8..59007cc6d 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamGroupSerializer.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamGroupSerializer.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamLabelSerializer.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamLabelSerializer.java
index efd10bd79..ff4d723ad 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamLabelSerializer.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamLabelSerializer.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamOidcSerializer.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamOidcSerializer.java
index 71b5f146b..7371e300e 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamOidcSerializer.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamOidcSerializer.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamRegistrationRequestSerializer.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamRegistrationRequestSerializer.java
index f232fee58..482785845 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamRegistrationRequestSerializer.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamRegistrationRequestSerializer.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamSamlSerializer.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamSamlSerializer.java
index 31dab1f59..590beabe2 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamSamlSerializer.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamSamlSerializer.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamScopePolicySerializer.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamScopePolicySerializer.java
index a6228309f..453f2d478 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamScopePolicySerializer.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamScopePolicySerializer.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamSshKeySerializer.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamSshKeySerializer.java
index 46da5de52..fcd080b5b 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamSshKeySerializer.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamSshKeySerializer.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamX509CertificateSerializer.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamX509CertificateSerializer.java
index 8bd139e5e..22cedc7f9 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamX509CertificateSerializer.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/IamX509CertificateSerializer.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/Jackson2AuditDataSerializer.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/Jackson2AuditDataSerializer.java
index 2e3c3d3f8..9d9ffc39b 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/Jackson2AuditDataSerializer.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/Jackson2AuditDataSerializer.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/UpdaterTypeSerializer.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/UpdaterTypeSerializer.java
index 75ecce6ff..0c5efe092 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/UpdaterTypeSerializer.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/utils/UpdaterTypeSerializer.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/AbstractExternalAuthenticationToken.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/AbstractExternalAuthenticationToken.java
index 98033eaa9..e12992a2b 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/AbstractExternalAuthenticationToken.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/AbstractExternalAuthenticationToken.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/AuthenticationExceptionMessageHelper.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/AuthenticationExceptionMessageHelper.java
index ccaedf8c3..ac25b06f2 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/AuthenticationExceptionMessageHelper.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/AuthenticationExceptionMessageHelper.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/DefaultExternalAccountLinker.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/DefaultExternalAccountLinker.java
index 51ecb64f0..64e929581 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/DefaultExternalAccountLinker.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/DefaultExternalAccountLinker.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/DefaultExternalAuthenticationHintService.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/DefaultExternalAuthenticationHintService.java
index 638a78eda..2639c8a51 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/DefaultExternalAuthenticationHintService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/DefaultExternalAuthenticationHintService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/DefaultExternalAuthenticationInfoBuilder.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/DefaultExternalAuthenticationInfoBuilder.java
index 37c9c6445..93e278c00 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/DefaultExternalAuthenticationInfoBuilder.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/DefaultExternalAuthenticationInfoBuilder.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/DefaultExternalAuthenticationInfoProcessor.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/DefaultExternalAuthenticationInfoProcessor.java
index f7dbda93d..e925e57d3 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/DefaultExternalAuthenticationInfoProcessor.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/DefaultExternalAuthenticationInfoProcessor.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -23,6 +23,7 @@
 import org.springframework.stereotype.Component;
 
 @Component
+@SuppressWarnings("deprecation")
 public class DefaultExternalAuthenticationInfoProcessor
     implements ExternalAuthenticationInfoProcessor {
 
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/DefaultInactiveAccountAuthenticationHandler.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/DefaultInactiveAccountAuthenticationHandler.java
index 8b9f2aafd..92a43a864 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/DefaultInactiveAccountAuthenticationHandler.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/DefaultInactiveAccountAuthenticationHandler.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/EnforceAupSignatureSuccessHandler.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/EnforceAupSignatureSuccessHandler.java
index 1f426cb71..4fe3566c4 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/EnforceAupSignatureSuccessHandler.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/EnforceAupSignatureSuccessHandler.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -37,6 +37,7 @@
 import it.infn.mw.iam.persistence.model.IamAccount;
 import it.infn.mw.iam.persistence.repository.IamAccountRepository;
 
+@SuppressWarnings("deprecation")
 public class EnforceAupSignatureSuccessHandler implements AuthenticationSuccessHandler {
 
   private final AuthenticationSuccessHandler delegate;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/ExternalAccountLinker.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/ExternalAccountLinker.java
index 07975a2f8..3ec68fca0 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/ExternalAccountLinker.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/ExternalAccountLinker.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/ExternalAuthenticationFailureHandler.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/ExternalAuthenticationFailureHandler.java
index 6929c452c..b7e399f84 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/ExternalAuthenticationFailureHandler.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/ExternalAuthenticationFailureHandler.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,7 +16,6 @@
 package it.infn.mw.iam.authn;
 
 import java.io.IOException;
-import java.io.UnsupportedEncodingException;
 import java.nio.charset.StandardCharsets;
 
 import javax.servlet.ServletException;
@@ -45,11 +44,7 @@ public ExternalAuthenticationFailureHandler(AuthenticationExceptionMessageHelper
   private String buildRedirectURL(AuthenticationException exception) {
     String errorMessage = helper.buildErrorMessage(exception);
 
-    try {
-      errorMessage = UriUtils.encode(errorMessage, StandardCharsets.UTF_8.toString());
-    } catch (UnsupportedEncodingException uex) {
-      LOG.error(uex.getMessage(), uex);
-    }
+    errorMessage = UriUtils.encode(errorMessage, StandardCharsets.UTF_8.toString());
 
     return UriComponentsBuilder.fromPath("/login")
       .queryParam("error", "true")
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/ExternalAuthenticationHandlerSupport.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/ExternalAuthenticationHandlerSupport.java
index 21b72261f..f99a5ac1d 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/ExternalAuthenticationHandlerSupport.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/ExternalAuthenticationHandlerSupport.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/ExternalAuthenticationHintService.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/ExternalAuthenticationHintService.java
index e66b6a2d5..102a4560d 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/ExternalAuthenticationHintService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/ExternalAuthenticationHintService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/ExternalAuthenticationInfoBuilder.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/ExternalAuthenticationInfoBuilder.java
index 8896e70e8..c64181d72 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/ExternalAuthenticationInfoBuilder.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/ExternalAuthenticationInfoBuilder.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/ExternalAuthenticationInfoProcessor.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/ExternalAuthenticationInfoProcessor.java
index 08f640912..6d9bda8eb 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/ExternalAuthenticationInfoProcessor.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/ExternalAuthenticationInfoProcessor.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -19,6 +19,7 @@
 
 import org.springframework.security.oauth2.provider.OAuth2Authentication;
 @FunctionalInterface
+@SuppressWarnings("deprecation")
 public interface ExternalAuthenticationInfoProcessor {
 
   Map process(OAuth2Authentication authentication);
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/ExternalAuthenticationRegistrationInfo.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/ExternalAuthenticationRegistrationInfo.java
index c159d681c..fd83cf314 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/ExternalAuthenticationRegistrationInfo.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/ExternalAuthenticationRegistrationInfo.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/ExternalAuthenticationSuccessHandler.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/ExternalAuthenticationSuccessHandler.java
index e9cb27af7..9e9396074 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/ExternalAuthenticationSuccessHandler.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/ExternalAuthenticationSuccessHandler.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/HintAwareAuthenticationEntryPoint.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/HintAwareAuthenticationEntryPoint.java
index b1cceea6d..8fccfa6d1 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/HintAwareAuthenticationEntryPoint.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/HintAwareAuthenticationEntryPoint.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/InactiveAccountAuthenticationHander.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/InactiveAccountAuthenticationHander.java
index 78e0f3057..f8f3fbabb 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/InactiveAccountAuthenticationHander.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/InactiveAccountAuthenticationHander.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/RootIsDashboardSuccessHandler.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/RootIsDashboardSuccessHandler.java
index 4040a2188..6ab1a1d0c 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/RootIsDashboardSuccessHandler.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/RootIsDashboardSuccessHandler.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/TimestamperSuccessHandler.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/TimestamperSuccessHandler.java
index 1df4e5652..2f1a27530 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/TimestamperSuccessHandler.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/TimestamperSuccessHandler.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -34,6 +34,7 @@
 import it.infn.mw.iam.core.util.IamAuthenticationLogger;
 import it.infn.mw.iam.persistence.repository.IamAccountRepository;
 
+@SuppressWarnings("deprecation")
 public class TimestamperSuccessHandler implements AuthenticationSuccessHandler {
 
   public static final Logger LOG = getLogger(TimestamperSuccessHandler.class);
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/BaseValidatorCheck.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/BaseValidatorCheck.java
index 083a10beb..3fc188cf3 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/BaseValidatorCheck.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/BaseValidatorCheck.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/CompositeValidatorCheck.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/CompositeValidatorCheck.java
index 00c8df299..05f6aa85c 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/CompositeValidatorCheck.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/CompositeValidatorCheck.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/Conjunction.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/Conjunction.java
index e1653dac7..ddaa4d470 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/Conjunction.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/Conjunction.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/Disjunction.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/Disjunction.java
index 7ec338daf..a8ff07952 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/Disjunction.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/Disjunction.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/Error.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/Error.java
index 573ebcae6..00c1828e2 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/Error.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/Error.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/Fail.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/Fail.java
index 74f704f8c..494ba2121 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/Fail.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/Fail.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/Negation.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/Negation.java
index b202efc4d..52060172d 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/Negation.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/Negation.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/Success.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/Success.java
index 070b27fa8..9d5e12b83 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/Success.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/Success.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/ValidatorCheck.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/ValidatorCheck.java
index 1ebf25b9f..a9c5fb569 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/ValidatorCheck.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/ValidatorCheck.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/ValidatorError.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/ValidatorError.java
index fbda4ae6e..733ab0306 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/ValidatorError.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/ValidatorError.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/ValidatorResolver.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/ValidatorResolver.java
index 23dc96b0c..571f78d07 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/ValidatorResolver.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/ValidatorResolver.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/ValidatorResult.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/ValidatorResult.java
index c7abb84db..34fea922e 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/ValidatorResult.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/ValidatorResult.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/config/AuthenticationValidator.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/config/AuthenticationValidator.java
index a8f7a3931..e051deedd 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/config/AuthenticationValidator.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/config/AuthenticationValidator.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/config/DefaultValidatorConfigParser.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/config/DefaultValidatorConfigParser.java
index 1dd7b84c3..ae634627d 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/config/DefaultValidatorConfigParser.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/config/DefaultValidatorConfigParser.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -26,8 +26,6 @@
 
 import org.springframework.stereotype.Component;
 
-import com.google.common.collect.ImmutableSet;
-
 import it.infn.mw.iam.authn.common.Conjunction;
 import it.infn.mw.iam.authn.common.Disjunction;
 import it.infn.mw.iam.authn.common.Fail;
@@ -46,7 +44,7 @@ public class DefaultValidatorConfigParser implements ValidatorConfigParser {
   public static final String CLAIM_NAME_PARAM = "claimName";
   public static final String REGEXP_PARAM = "regexp";
 
-  private static final Set KIND = ImmutableSet.of("or", "and", "not", "hasAttr",
+  private static final Set KIND = Set.of("or", "and", "not", "hasAttr",
       "attrValueMatches", "hasClaim", "claimValueMatches", "true", "false");
 
   @SuppressWarnings({"unchecked", "rawtypes"})
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/config/ValidatorConfigError.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/config/ValidatorConfigError.java
index 42924132b..a0716badf 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/config/ValidatorConfigError.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/config/ValidatorConfigError.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/config/ValidatorConfigParser.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/config/ValidatorConfigParser.java
index 25b709ef5..e28a29905 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/config/ValidatorConfigParser.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/config/ValidatorConfigParser.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/config/ValidatorProperties.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/config/ValidatorProperties.java
index 48a87efb5..23f406a18 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/config/ValidatorProperties.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/common/config/ValidatorProperties.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -25,7 +25,7 @@
 import java.util.Map;
 import java.util.Objects;
 
-import org.hibernate.validator.constraints.NotBlank;
+import javax.validation.constraints.NotBlank;
 
 import com.google.common.collect.Lists;
 import com.google.common.collect.Maps;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/error/AccountAlreadyLinkedError.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/error/AccountAlreadyLinkedError.java
index 41fc6e34f..cd89574e8 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/error/AccountAlreadyLinkedError.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/error/AccountAlreadyLinkedError.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/error/InvalidExternalAuthenticationHintError.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/error/InvalidExternalAuthenticationHintError.java
index 721687b61..f77b181f1 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/error/InvalidExternalAuthenticationHintError.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/error/InvalidExternalAuthenticationHintError.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/error/InvalidExternalAuthenticationTokenError.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/error/InvalidExternalAuthenticationTokenError.java
index c41361f39..8136eea9e 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/error/InvalidExternalAuthenticationTokenError.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/error/InvalidExternalAuthenticationTokenError.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/DefaultOidcTokenRequestor.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/DefaultOidcTokenRequestor.java
index bf00ddcb7..f26d6532e 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/DefaultOidcTokenRequestor.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/DefaultOidcTokenRequestor.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -30,6 +30,7 @@
 import org.springframework.security.authentication.AuthenticationServiceException;
 import org.springframework.util.MultiValueMap;
 import org.springframework.web.client.HttpClientErrorException;
+import org.springframework.web.client.RestClientException;
 import org.springframework.web.client.RestOperations;
 
 import com.fasterxml.jackson.databind.ObjectMapper;
@@ -140,26 +141,22 @@ public String requestTokens(OidcProviderConfiguration conf,
 
     } catch (HttpClientErrorException e) {
 
-      if (e.getStatusCode() != null && e.getStatusCode().equals(BAD_REQUEST)) {
+      if (e.getStatusCode().equals(BAD_REQUEST)) {
         parseErrorResponse(e).ifPresent(er -> {
 
-
           String errorMessage = String.format("Token request error: %s '%s'", er.getError(),
               er.getErrorDescription());
-          LOG.error(errorMessage);
 
-          throw new OidcClientError(e.getMessage(), er.getError(), er.getErrorDescription(),
+          throw new OidcClientError(errorMessage, er.getError(), er.getErrorDescription(),
               er.getErrorUri());
 
         });
       }
 
       String errorMessage = String.format("Token request error: %s", e.getMessage());
-      LOG.error(errorMessage, e);
       throw new OidcClientError(errorMessage, e);
-    } catch (Exception e) {
+    } catch (RestClientException e) {
       String errorMessage = String.format("Token request error: %s", e.getMessage());
-      LOG.error(errorMessage, e);
       throw new OidcClientError(errorMessage, e);
     }
 
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/DefaultRestTemplateFactory.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/DefaultRestTemplateFactory.java
index 3d5457b36..cc7253ef3 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/DefaultRestTemplateFactory.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/DefaultRestTemplateFactory.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/OidcAuthenticationProvider.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/OidcAuthenticationProvider.java
index 736904644..158726223 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/OidcAuthenticationProvider.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/OidcAuthenticationProvider.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/OidcClientError.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/OidcClientError.java
index bc7248456..d449cdafc 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/OidcClientError.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/OidcClientError.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/OidcClientFilter.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/OidcClientFilter.java
index 51e1f6f5b..680dc2c8e 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/OidcClientFilter.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/OidcClientFilter.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -32,6 +32,7 @@
 import org.mitre.openid.connect.model.PendingOIDCAuthenticationToken;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
+import org.springframework.http.client.ClientHttpRequestFactory;
 import org.springframework.security.authentication.AuthenticationServiceException;
 import org.springframework.security.core.Authentication;
 import org.springframework.util.LinkedMultiValueMap;
@@ -55,6 +56,7 @@
  * providers that use EUGridPMA certificates.
  *
  */
+@SuppressWarnings("deprecation")
 public class OidcClientFilter extends OIDCAuthenticationFilter {
 
   public static class OidcProviderConfiguration {
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/OidcExceptionMessageHelper.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/OidcExceptionMessageHelper.java
index fd85c11e7..2dfb63adf 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/OidcExceptionMessageHelper.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/OidcExceptionMessageHelper.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/OidcExternalAuthenticationToken.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/OidcExternalAuthenticationToken.java
index fe7883cbb..7bf56d69e 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/OidcExternalAuthenticationToken.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/OidcExternalAuthenticationToken.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/OidcTokenRequestor.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/OidcTokenRequestor.java
index 5095e09ef..7dc0c3792 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/OidcTokenRequestor.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/OidcTokenRequestor.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/RestTemplateFactory.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/RestTemplateFactory.java
index 0497e886d..423e29f4a 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/RestTemplateFactory.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/RestTemplateFactory.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/model/TokenEndpointErrorResponse.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/model/TokenEndpointErrorResponse.java
index 87629a369..4fa1fed3a 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/model/TokenEndpointErrorResponse.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/model/TokenEndpointErrorResponse.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/service/DefaultOidcUserDetailsService.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/service/DefaultOidcUserDetailsService.java
index 9775cc22b..1654503df 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/service/DefaultOidcUserDetailsService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/service/DefaultOidcUserDetailsService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/service/NullClientConfigurationService.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/service/NullClientConfigurationService.java
index 6a8be958f..3edef2da8 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/service/NullClientConfigurationService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/service/NullClientConfigurationService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/service/OidcUserDetailsService.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/service/OidcUserDetailsService.java
index ad8c37026..3ccabbda1 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/service/OidcUserDetailsService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/service/OidcUserDetailsService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/validator/DefaultOidcTokenValidator.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/validator/DefaultOidcTokenValidator.java
index ae6028864..d2cacb44f 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/validator/DefaultOidcTokenValidator.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/validator/DefaultOidcTokenValidator.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/validator/DefaultOidcValidatorResolver.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/validator/DefaultOidcValidatorResolver.java
index 767a1a16f..be94fad9c 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/validator/DefaultOidcValidatorResolver.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/validator/DefaultOidcValidatorResolver.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/validator/check/ClaimPresentCheck.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/validator/check/ClaimPresentCheck.java
index ef852229d..590db2113 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/validator/check/ClaimPresentCheck.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/validator/check/ClaimPresentCheck.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/validator/check/ClaimRegexpMatch.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/validator/check/ClaimRegexpMatch.java
index 9c579d0bd..0dcabd8e6 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/validator/check/ClaimRegexpMatch.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/oidc/validator/check/ClaimRegexpMatch.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/CleanInactiveProvisionedAccounts.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/CleanInactiveProvisionedAccounts.java
index dc6588389..783738d5c 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/CleanInactiveProvisionedAccounts.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/CleanInactiveProvisionedAccounts.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/DefaultMappingPropertiesResolver.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/DefaultMappingPropertiesResolver.java
index 0b184c415..df9cd25c4 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/DefaultMappingPropertiesResolver.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/DefaultMappingPropertiesResolver.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/DefaultMetadataLookupService.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/DefaultMetadataLookupService.java
index 3cd7792a3..8d0272bd0 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/DefaultMetadataLookupService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/DefaultMetadataLookupService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -44,7 +44,6 @@
 import org.springframework.stereotype.Component;
 
 import com.google.common.base.Strings;
-import com.google.common.collect.ImmutableList;
 
 import it.infn.mw.iam.authn.saml.model.IdpDescription;
 
@@ -127,7 +126,7 @@ private Optional> lookupByEntityId(String text) {
 
       EntityDescriptor entityDescriptor = metadataManager.getEntityDescriptor(text);
       if (entityDescriptor != null) {
-        return Optional.of(ImmutableList.of(descriptionFromMetadata(entityDescriptor)));
+        return Optional.of(List.of(descriptionFromMetadata(entityDescriptor)));
       }
 
     } catch (MetadataProviderException e) {
@@ -175,7 +174,6 @@ public List listIdps() {
 
       } catch (MetadataProviderException e) {
         LOG.warn("Error accessing metadata for entity: {}", idpName, e);
-        continue;
       }
 
     }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/DefaultSAMLUserDetailsService.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/DefaultSAMLUserDetailsService.java
index 910ab9392..c31e7c613 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/DefaultSAMLUserDetailsService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/DefaultSAMLUserDetailsService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/IamCachingMetadataManager.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/IamCachingMetadataManager.java
index 63006a56b..f2521f3d2 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/IamCachingMetadataManager.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/IamCachingMetadataManager.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/IamExtendedMetadataDelegate.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/IamExtendedMetadataDelegate.java
index e7e28a84a..085ec17bf 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/IamExtendedMetadataDelegate.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/IamExtendedMetadataDelegate.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/IamSamlAuthenticationProvider.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/IamSamlAuthenticationProvider.java
index 494f05246..a84a37516 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/IamSamlAuthenticationProvider.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/IamSamlAuthenticationProvider.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/JustInTimeProvisioningSAMLUserDetailsService.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/JustInTimeProvisioningSAMLUserDetailsService.java
index 038de2135..7863ef355 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/JustInTimeProvisioningSAMLUserDetailsService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/JustInTimeProvisioningSAMLUserDetailsService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/MappingPropertiesResolver.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/MappingPropertiesResolver.java
index 9eebbdd36..ae2d5f6f5 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/MappingPropertiesResolver.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/MappingPropertiesResolver.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/MetadataLookupService.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/MetadataLookupService.java
index f96f94801..7ebec6fef 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/MetadataLookupService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/MetadataLookupService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/SAMLUserDetailsServiceSupport.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/SAMLUserDetailsServiceSupport.java
index 1fa56f616..4b1771704 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/SAMLUserDetailsServiceSupport.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/SAMLUserDetailsServiceSupport.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/SamlExceptionMessageHelper.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/SamlExceptionMessageHelper.java
index efa1de356..be417a2dd 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/SamlExceptionMessageHelper.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/SamlExceptionMessageHelper.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/SamlExternalAuthenticationToken.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/SamlExternalAuthenticationToken.java
index 149c18b4c..0de3dc718 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/SamlExternalAuthenticationToken.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/SamlExternalAuthenticationToken.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/SamlMetadataError.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/SamlMetadataError.java
index 0432f5396..dd6e8fe68 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/SamlMetadataError.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/SamlMetadataError.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/model/IdpDescription.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/model/IdpDescription.java
index 4946ab4a5..039b3572f 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/model/IdpDescription.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/model/IdpDescription.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/profile/DefaultSSOProfileOptionsResolver.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/profile/DefaultSSOProfileOptionsResolver.java
index 4f8f13453..4e62ed9d0 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/profile/DefaultSSOProfileOptionsResolver.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/profile/DefaultSSOProfileOptionsResolver.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/profile/IamSSOProfile.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/profile/IamSSOProfile.java
index 6bbbbe964..f1d0e1b3c 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/profile/IamSSOProfile.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/profile/IamSSOProfile.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/profile/IamSSOProfileOptions.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/profile/IamSSOProfileOptions.java
index 1ceec617d..3f8b972a6 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/profile/IamSSOProfileOptions.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/profile/IamSSOProfileOptions.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/profile/SSOProfileOptionsResolver.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/profile/SSOProfileOptionsResolver.java
index d9eecbf95..2cd6a5e5e 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/profile/SSOProfileOptionsResolver.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/profile/SSOProfileOptionsResolver.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/AbstractSamlUserIdentifierResolver.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/AbstractSamlUserIdentifierResolver.java
index f7ad2ac96..4c571fa1d 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/AbstractSamlUserIdentifierResolver.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/AbstractSamlUserIdentifierResolver.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/AttributeUserIdentifierResolver.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/AttributeUserIdentifierResolver.java
index d5278d162..3d6493c60 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/AttributeUserIdentifierResolver.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/AttributeUserIdentifierResolver.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/EPTIDUserIdentifierResolver.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/EPTIDUserIdentifierResolver.java
index 7e1151621..a984bde3d 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/EPTIDUserIdentifierResolver.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/EPTIDUserIdentifierResolver.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/FirstApplicableChainedSamlIdResolver.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/FirstApplicableChainedSamlIdResolver.java
index bd48ba180..7dec627bb 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/FirstApplicableChainedSamlIdResolver.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/FirstApplicableChainedSamlIdResolver.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/IamSamlBootstrap.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/IamSamlBootstrap.java
index 1522f8b03..f1bfe8b41 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/IamSamlBootstrap.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/IamSamlBootstrap.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/IamSamlEntryPoint.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/IamSamlEntryPoint.java
index 0baeabb8f..7c21fcba2 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/IamSamlEntryPoint.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/IamSamlEntryPoint.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/NameIdUserIdentifierResolver.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/NameIdUserIdentifierResolver.java
index d53d7a6b3..e7f6e8d6c 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/NameIdUserIdentifierResolver.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/NameIdUserIdentifierResolver.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/NamedSamlUserIdentifierResolver.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/NamedSamlUserIdentifierResolver.java
index 7d00d2333..3c76e920e 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/NamedSamlUserIdentifierResolver.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/NamedSamlUserIdentifierResolver.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/PersistentNameIdUserIdentifierResolver.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/PersistentNameIdUserIdentifierResolver.java
index f6a023bf0..6ba3bc18e 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/PersistentNameIdUserIdentifierResolver.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/PersistentNameIdUserIdentifierResolver.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/Saml2Attribute.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/Saml2Attribute.java
index b345797fe..d421becab 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/Saml2Attribute.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/Saml2Attribute.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/SamlAttributeNames.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/SamlAttributeNames.java
index 952648212..084b507b1 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/SamlAttributeNames.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/SamlAttributeNames.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/SamlIdResolvers.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/SamlIdResolvers.java
index a31419cc6..2a72fad7a 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/SamlIdResolvers.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/SamlIdResolvers.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/SamlUserIdentifierResolutionResult.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/SamlUserIdentifierResolutionResult.java
index c9df4b8ab..2c8b0b6e6 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/SamlUserIdentifierResolutionResult.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/SamlUserIdentifierResolutionResult.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/SamlUserIdentifierResolver.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/SamlUserIdentifierResolver.java
index 2d1320cf1..cfae55f02 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/SamlUserIdentifierResolver.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/SamlUserIdentifierResolver.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/metadata/AbstractMetadataFilter.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/metadata/AbstractMetadataFilter.java
index c9043f884..fd37c78be 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/metadata/AbstractMetadataFilter.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/metadata/AbstractMetadataFilter.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/metadata/AttributeValueMetadataFilter.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/metadata/AttributeValueMetadataFilter.java
index bf454c8e2..fb4deeabb 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/metadata/AttributeValueMetadataFilter.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/metadata/AttributeValueMetadataFilter.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/metadata/EntityIdWhitelistMetadataFilter.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/metadata/EntityIdWhitelistMetadataFilter.java
index b4b68650a..178cdbca9 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/metadata/EntityIdWhitelistMetadataFilter.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/metadata/EntityIdWhitelistMetadataFilter.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/metadata/ResearchAndScholarshipMetadataFilter.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/metadata/ResearchAndScholarshipMetadataFilter.java
index 75a4be281..8abcff342 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/metadata/ResearchAndScholarshipMetadataFilter.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/metadata/ResearchAndScholarshipMetadataFilter.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/metadata/SirtfiAttributeMetadataFilter.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/metadata/SirtfiAttributeMetadataFilter.java
index e9e6824fd..8d0b787c6 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/metadata/SirtfiAttributeMetadataFilter.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/metadata/SirtfiAttributeMetadataFilter.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/metadata/ValidationResult.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/metadata/ValidationResult.java
index 546314f65..2f40b1a5b 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/metadata/ValidationResult.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/util/metadata/ValidationResult.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/validator/DefaultSamlValidator.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/validator/DefaultSamlValidator.java
index 77097cfed..98a950756 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/validator/DefaultSamlValidator.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/validator/DefaultSamlValidator.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/validator/DefaultSamlValidatorResolver.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/validator/DefaultSamlValidatorResolver.java
index 896ec9327..30d1fcb7f 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/validator/DefaultSamlValidatorResolver.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/validator/DefaultSamlValidatorResolver.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/validator/check/SamlAttributeValueRegexpMatch.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/validator/check/SamlAttributeValueRegexpMatch.java
index ec1320522..3b2e417d2 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/validator/check/SamlAttributeValueRegexpMatch.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/validator/check/SamlAttributeValueRegexpMatch.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/validator/check/SamlHasAttributeCheck.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/validator/check/SamlHasAttributeCheck.java
index 003efdb15..b628543de 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/validator/check/SamlHasAttributeCheck.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/validator/check/SamlHasAttributeCheck.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/web/SamlRefreshMetadataController.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/web/SamlRefreshMetadataController.java
index 1edae1512..40944bf2a 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/web/SamlRefreshMetadataController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/web/SamlRefreshMetadataController.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/web/SamlSsoController.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/web/SamlSsoController.java
index 147969466..9509bdd6e 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/web/SamlSsoController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/saml/web/SamlSsoController.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/util/AuthenticationUtils.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/util/AuthenticationUtils.java
index 92f5adcbb..51cc17483 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/util/AuthenticationUtils.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/util/AuthenticationUtils.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,6 +16,7 @@
 package it.infn.mw.iam.authn.util;
 
 import java.util.List;
+import java.util.Set;
 import java.util.stream.Collectors;
 
 import org.mitre.oauth2.model.SavedUserAuthentication;
@@ -24,16 +25,14 @@
 import org.springframework.security.core.authority.SimpleGrantedAuthority;
 import org.springframework.security.core.userdetails.User;
 
-import com.google.common.collect.ImmutableSet;
-
 import it.infn.mw.iam.authn.oidc.OidcExternalAuthenticationToken;
 import it.infn.mw.iam.authn.saml.SamlExternalAuthenticationToken;
 import it.infn.mw.iam.persistence.model.IamAccount;
 
 public class AuthenticationUtils {
 
-  private static final ImmutableSet SUPPORTED_EXTERNAL_AUTHN_TOKENS =
-      ImmutableSet.of(SamlExternalAuthenticationToken.class.getName(),
+  private static final Set SUPPORTED_EXTERNAL_AUTHN_TOKENS =
+      Set.of(SamlExternalAuthenticationToken.class.getName(),
           OidcExternalAuthenticationToken.class.getName());
 
   private AuthenticationUtils() {}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/util/JwtUtils.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/util/JwtUtils.java
index 4a258814a..0b40f0e88 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/util/JwtUtils.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/util/JwtUtils.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/util/SamlMetadataFetchTimer.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/util/SamlMetadataFetchTimer.java
index 58990f2ce..972c9cbbf 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/util/SamlMetadataFetchTimer.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/util/SamlMetadataFetchTimer.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -42,14 +42,17 @@ public boolean equals(Object obj) {
     return delegate.equals(obj);
   }
 
+  @Override
   public void schedule(TimerTask task, long delay) {
     delegate.schedule(task, delay);
   }
 
+  @Override
   public void schedule(TimerTask task, Date time) {
     delegate.schedule(task, time);
   }
 
+  @Override
   public void schedule(TimerTask task, long delay, long period) {
     delegate.schedule(task, delay, period);
   }
@@ -58,22 +61,27 @@ public String toString() {
     return delegate.toString();
   }
 
+  @Override
   public void schedule(TimerTask task, Date firstTime, long period) {
     delegate.schedule(task, firstTime, period);
   }
 
+  @Override
   public void scheduleAtFixedRate(TimerTask task, long delay, long period) {
     delegate.scheduleAtFixedRate(task, delay, period);
   }
 
+  @Override
   public void scheduleAtFixedRate(TimerTask task, Date firstTime, long period) {
     delegate.scheduleAtFixedRate(task, firstTime, period);
   }
 
+  @Override
   public void cancel() {
     delegate.cancel();
   }
 
+  @Override
   public int purge() {
     return delegate.purge();
   }
@@ -82,6 +90,7 @@ public int purge() {
   @Override
   public void destroy() throws Exception {
     LOG.debug("in destroy");
+    delegate.purge();
     delegate.cancel();
   }
 
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/util/SessionTimeoutHelper.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/util/SessionTimeoutHelper.java
index 6fefa2ad4..a0e1e0ea5 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/util/SessionTimeoutHelper.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/util/SessionTimeoutHelper.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -34,7 +34,7 @@ public class SessionTimeoutHelper {
   final long timeoutInSecs;
 
   @Autowired
-  public SessionTimeoutHelper(Clock clock, @Value("${server.session.timeout}")long timeoutInSecs) {
+  public SessionTimeoutHelper(Clock clock, @Value("${spring.session.timeout}") long timeoutInSecs) {
     this.clock = clock;
     this.timeoutInSecs = timeoutInSecs;
   }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/util/SessionUtils.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/util/SessionUtils.java
index 28f5b953d..c96877f77 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/util/SessionUtils.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/util/SessionUtils.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/x509/CertificateParsingError.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/x509/CertificateParsingError.java
index 9e8b09fff..41a687405 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/x509/CertificateParsingError.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/x509/CertificateParsingError.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/x509/DefaultX509AuthenticationCredentialExtractor.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/x509/DefaultX509AuthenticationCredentialExtractor.java
index 7728f9310..c4c8a0f33 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/x509/DefaultX509AuthenticationCredentialExtractor.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/x509/DefaultX509AuthenticationCredentialExtractor.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/x509/IamX509AuthenticationCredential.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/x509/IamX509AuthenticationCredential.java
index 599d117d2..e6d117012 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/x509/IamX509AuthenticationCredential.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/x509/IamX509AuthenticationCredential.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/x509/IamX509AuthenticationProvider.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/x509/IamX509AuthenticationProvider.java
index 556a8adf5..4bf63ffbb 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/x509/IamX509AuthenticationProvider.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/x509/IamX509AuthenticationProvider.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/x509/IamX509AuthenticationUserDetailService.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/x509/IamX509AuthenticationUserDetailService.java
index 280abc4b5..f7acbc668 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/x509/IamX509AuthenticationUserDetailService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/x509/IamX509AuthenticationUserDetailService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/x509/IamX509PreauthenticationProcessingFilter.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/x509/IamX509PreauthenticationProcessingFilter.java
index 8cf40aa6a..0bbda35cb 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/x509/IamX509PreauthenticationProcessingFilter.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/x509/IamX509PreauthenticationProcessingFilter.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -121,9 +121,9 @@ protected void successfulAuthentication(HttpServletRequest request, HttpServletR
     request.setAttribute(X509_CAN_LOGIN_KEY, Boolean.TRUE);
     
     if (x509AuthenticationRequested(request)) {
-      super.successfulAuthentication(request, response, authentication);
       
       try {
+        super.successfulAuthentication(request, response, authentication);
         successHandler.onAuthenticationSuccess(request, response, authentication);
         
       } catch (IOException | ServletException e) {
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/x509/MockX509AuthenticationCredentialExtractor.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/x509/MockX509AuthenticationCredentialExtractor.java
index 51dab8f73..9b695c626 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/x509/MockX509AuthenticationCredentialExtractor.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/x509/MockX509AuthenticationCredentialExtractor.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/x509/PEMX509CertificateChainParser.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/x509/PEMX509CertificateChainParser.java
index e4ce651ce..dbc43e640 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/x509/PEMX509CertificateChainParser.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/x509/PEMX509CertificateChainParser.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/x509/X509AuthenticationCredentialExtractor.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/x509/X509AuthenticationCredentialExtractor.java
index 2c8fe527a..1953e01ba 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/x509/X509AuthenticationCredentialExtractor.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/x509/X509AuthenticationCredentialExtractor.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/x509/X509AuthenticationError.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/x509/X509AuthenticationError.java
index 73f7b90c7..dc2a98bbc 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/x509/X509AuthenticationError.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/x509/X509AuthenticationError.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/x509/X509CertificateChainParser.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/x509/X509CertificateChainParser.java
index 3c8af6d0a..f1d1df524 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/x509/X509CertificateChainParser.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/x509/X509CertificateChainParser.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/x509/X509CertificateChainParsingResult.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/x509/X509CertificateChainParsingResult.java
index 856779aec..e4e4a9a03 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/x509/X509CertificateChainParsingResult.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/x509/X509CertificateChainParsingResult.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/x509/X509CertificateVerificationResult.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/x509/X509CertificateVerificationResult.java
index ea3f8403c..d8531d4df 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/x509/X509CertificateVerificationResult.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/x509/X509CertificateVerificationResult.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/AssertionConfig.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/AssertionConfig.java
index 27b813772..5b4860d6c 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/AssertionConfig.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/AssertionConfig.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/AuthorizationServerConfig.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/AuthorizationServerConfig.java
index 5559ef7d2..dc4fa04c2 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/AuthorizationServerConfig.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/AuthorizationServerConfig.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -34,6 +34,7 @@
 import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
 import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.crypto.password.PasswordEncoder;
+import org.springframework.security.oauth2.common.exceptions.OAuth2Exception;
 import org.springframework.security.oauth2.config.annotation.configurers.ClientDetailsServiceConfigurer;
 import org.springframework.security.oauth2.config.annotation.web.configuration.AuthorizationServerConfigurerAdapter;
 import org.springframework.security.oauth2.config.annotation.web.configuration.EnableAuthorizationServer;
@@ -60,6 +61,7 @@
 import it.infn.mw.iam.core.oauth.granters.TokenExchangeTokenGranter;
 import it.infn.mw.iam.core.util.IamAuthenticationEventPublisher;
 
+@SuppressWarnings("deprecation")
 @Configuration
 @EnableAuthorizationServer
 public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {
@@ -103,7 +105,7 @@ public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdap
   private TokenExchangePdp tokenExchangePdp;
 
   @Bean
-  WebResponseExceptionTranslator webResponseExceptionTranslator() {
+  WebResponseExceptionTranslator webResponseExceptionTranslator() {
 
     return new DefaultWebResponseExceptionTranslator();
   }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/CustomAuthenticationEntryPoint.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/CustomAuthenticationEntryPoint.java
index de7eab917..6c2e499a4 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/CustomAuthenticationEntryPoint.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/CustomAuthenticationEntryPoint.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -18,7 +18,6 @@
 import java.io.IOException;
 import java.io.PrintWriter;
 
-import javax.servlet.ServletException;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
@@ -32,11 +31,11 @@ public class CustomAuthenticationEntryPoint extends BasicAuthenticationEntryPoin
 
   @Override
   public void commence(HttpServletRequest request, HttpServletResponse response,
-      AuthenticationException authException) throws IOException, ServletException {
+      AuthenticationException authException) throws IOException {
 
     response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
     response.setHeader("WWW-Authenticate", "Basic realm=" + getRealmName());
-    response.setContentType(MediaType.APPLICATION_JSON_UTF8_VALUE);
+    response.setContentType(MediaType.APPLICATION_JSON_VALUE);
 
     PrintWriter writer = response.getWriter();
     writer.println("HTTP Status 401 : " + authException.getMessage());
@@ -44,7 +43,7 @@ public void commence(HttpServletRequest request, HttpServletResponse response,
   }
 
   @Override
-  public void afterPropertiesSet() throws Exception {
+  public void afterPropertiesSet() {
     setRealmName("IndigoIAM");
     super.afterPropertiesSet();
   }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/IamConfig.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/IamConfig.java
index 86da67c1d..2f8d7b1c7 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/IamConfig.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/IamConfig.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -33,8 +33,8 @@
 import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Qualifier;
 import org.springframework.beans.factory.annotation.Value;
-import org.springframework.boot.context.embedded.FilterRegistrationBean;
-import org.springframework.boot.context.embedded.ServletRegistrationBean;
+import org.springframework.boot.web.servlet.FilterRegistrationBean;
+import org.springframework.boot.web.servlet.ServletRegistrationBean;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.context.annotation.Primary;
@@ -89,6 +89,7 @@
 import it.infn.mw.iam.persistence.repository.IamAccountRepository;
 import it.infn.mw.iam.persistence.repository.IamAupRepository;
 
+@SuppressWarnings("deprecation")
 @Configuration
 public class IamConfig {
   public static final Logger LOG = LoggerFactory.getLogger(IamConfig.class);
@@ -238,10 +239,11 @@ public PasswordEncoder passwordEncoder() {
   }
 
   @Bean
-  FilterRegistrationBean aupSignatureCheckFilter(AUPSignatureCheckService service,
+  FilterRegistrationBean aupSignatureCheckFilter(AUPSignatureCheckService service,
       AccountUtils utils, IamAupRepository repo) {
     EnforceAupFilter aupFilter = new EnforceAupFilter(service, utils, repo);
-    FilterRegistrationBean frb = new FilterRegistrationBean(aupFilter);
+    FilterRegistrationBean frb =
+        new FilterRegistrationBean<>(aupFilter);
     frb.setOrder(Ordered.LOWEST_PRECEDENCE);
     return frb;
   }
@@ -256,8 +258,9 @@ ScopeMatcherRegistry customScopeMatchersRegistry(ScopeMatchersProperties propert
 
   @Bean
   @Profile("dev")
-  ServletRegistrationBean h2Console() {
+  ServletRegistrationBean h2Console() {
     WebServlet h2Servlet = new WebServlet();
-    return new ServletRegistrationBean(h2Servlet, "/h2-console/*");
+    return new ServletRegistrationBean<>(h2Servlet, "/h2-console/*");
   }
+
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/IamProperties.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/IamProperties.java
index d14254d5d..661c3c624 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/IamProperties.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/IamProperties.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -23,6 +23,8 @@
 
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.google.common.collect.Lists;
+import com.nimbusds.jose.JWEAlgorithm;
+import com.nimbusds.jose.JWSAlgorithm;
 
 import it.infn.mw.iam.authn.ExternalAuthenticationRegistrationInfo.ExternalAuthenticationType;
 import it.infn.mw.iam.config.login.LoginButtonProperties;
@@ -32,17 +34,92 @@
 public class IamProperties {
 
   public enum EditableFields {
-    NAME, SURNAME, EMAIL, PICTURE
+    NAME,
+    SURNAME,
+    EMAIL,
+    PICTURE
   }
 
   public enum LocalAuthenticationAllowedUsers {
-    ALL, VO_ADMINS, NONE
+    ALL,
+    VO_ADMINS,
+    NONE
   }
 
   public enum LocalAuthenticationLoginPageMode {
-    VISIBLE, HIDDEN, HIDDEN_WITH_LINK
+    VISIBLE,
+    HIDDEN,
+    HIDDEN_WITH_LINK
   }
 
+  public static class AccountLinkingProperties {
+    boolean enable = true;
+
+    public void setEnable(boolean enable) {
+      this.enable = enable;
+    }
+
+    public boolean isEnable() {
+      return enable;
+    }
+  }
+
+  public static class ActuatorUserProperties {
+
+    String username;
+    String password;
+
+    public String getUsername() {
+      return username;
+    }
+
+    public void setUsername(String username) {
+      this.username = username;
+    }
+
+    public String getPassword() {
+      return password;
+    }
+
+    public void setPassword(String password) {
+      this.password = password;
+    }
+
+  }
+
+
+  public static class ExternalConnectivityProbeProperties {
+
+    private boolean enabled = true;
+
+    private String endpoint = "https://www.google.com";
+    private int timeoutInSecs = 10;
+
+
+    public boolean isEnabled() {
+      return enabled;
+    }
+
+    public void setEnabled(boolean enabled) {
+      this.enabled = enabled;
+    }
+
+    public String getEndpoint() {
+      return endpoint;
+    }
+
+    public int getTimeoutInSecs() {
+      return timeoutInSecs;
+    }
+
+    public void setEndpoint(String endpoint) {
+      this.endpoint = endpoint;
+    }
+
+    public void setTimeoutInSecs(int timeoutInSecs) {
+      this.timeoutInSecs = timeoutInSecs;
+    }
+  }
 
   public static class VersionedStaticResourcesProperties {
     boolean enableVersioning = true;
@@ -217,6 +294,12 @@ public static class JWKProperties {
     String keystoreLocation;
     String defaultKeyId = "rsa1";
 
+    String defaultJwsAlgorithm = JWSAlgorithm.RS256.getName();
+    String defaultJweAlgorithm = JWEAlgorithm.RSA_OAEP_256.getName();
+
+    String defaultJweDecryptKeyId = "rsa1";
+    String defaultJweEncryptKeyId = "rsa1";
+
     public String getKeystoreLocation() {
       return keystoreLocation;
     }
@@ -228,46 +311,63 @@ public void setKeystoreLocation(String keystoreLocation) {
     public String getDefaultKeyId() {
       return defaultKeyId;
     }
-  }
 
-  public static class JWTProfile {
+    public void setDefaultKeyId(String defaultKeyId) {
+      this.defaultKeyId = defaultKeyId;
+    }
 
-    public enum Profile {
-      IAM, WLCG, AARC
+    public String getDefaultJwsAlgorithm() {
+      return defaultJwsAlgorithm;
     }
 
-    Profile defaultProfile = Profile.IAM;
+    public void setDefaultJwsAlgorithm(String defaultJwsAlgorithm) {
+      this.defaultJwsAlgorithm = defaultJwsAlgorithm;
+    }
 
-    public Profile getDefaultProfile() {
-      return defaultProfile;
+    public String getDefaultJweAlgorithm() {
+      return defaultJweAlgorithm;
     }
 
-    public void setDefaultProfile(Profile defaultProfile) {
-      this.defaultProfile = defaultProfile;
+    public void setDefaultJweAlgorithm(String defaultJweAlgorithm) {
+      this.defaultJweAlgorithm = defaultJweAlgorithm;
     }
-  }
 
+    public String getDefaultJweDecryptKeyId() {
+      return defaultJweDecryptKeyId;
+    }
 
-  public static class SuperUser {
-    String username;
-    String password;
+    public void setDefaultJweDecryptKeyId(String defaultJweDecryptKeyId) {
+      this.defaultJweDecryptKeyId = defaultJweDecryptKeyId;
+    }
 
-    public String getUsername() {
-      return username;
+    public String getDefaultJweEncryptKeyId() {
+      return defaultJweEncryptKeyId;
     }
 
-    public void setUsername(String username) {
-      this.username = username;
+    public void setDefaultJweEncryptKeyId(String defaultJweEncryptKeyId) {
+      this.defaultJweEncryptKeyId = defaultJweEncryptKeyId;
     }
+  }
 
-    public String getPassword() {
-      return password;
+  public static class JWTProfile {
+
+    public enum Profile {
+      IAM,
+      WLCG,
+      AARC
     }
 
-    public void setPassword(String password) {
-      this.password = password;
+    Profile defaultProfile = Profile.IAM;
+
+    public Profile getDefaultProfile() {
+      return defaultProfile;
+    }
+
+    public void setDefaultProfile(Profile defaultProfile) {
+      this.defaultProfile = defaultProfile;
     }
   }
+
   public static class PrivacyPolicy {
     String url;
     String text = "Privacy policy";
@@ -444,7 +544,7 @@ public void setUrnNamespace(String urnNamespace) {
 
   private PrivacyPolicy privacyPolicy = new PrivacyPolicy();
 
-  private SuperUser superuser = new SuperUser();
+  private ActuatorUserProperties actuatorUser = new ActuatorUserProperties();
 
   private JWTProfile jwtProfile = new JWTProfile();
 
@@ -469,6 +569,11 @@ public void setUrnNamespace(String urnNamespace) {
   private VersionedStaticResourcesProperties versionedStaticResources =
       new VersionedStaticResourcesProperties();
 
+  private ExternalConnectivityProbeProperties externalConnectivityProbe =
+      new ExternalConnectivityProbeProperties();
+
+  private AccountLinkingProperties accountLinking = new AccountLinkingProperties();
+
   public String getBaseUrl() {
     return baseUrl;
   }
@@ -565,12 +670,12 @@ public void setToken(RegistractionAccessToken token) {
     this.token = token;
   }
 
-  public SuperUser getSuperuser() {
-    return superuser;
+  public ActuatorUserProperties getActuatorUser() {
+    return actuatorUser;
   }
 
-  public void setSuperuser(SuperUser superuser) {
-    this.superuser = superuser;
+  public void setActuatorUser(ActuatorUserProperties actuatorUser) {
+    this.actuatorUser = actuatorUser;
   }
 
   public JWTProfile getJwtProfile() {
@@ -662,4 +767,21 @@ public void setVersionedStaticResources(
     this.versionedStaticResources = versionedStaticResources;
   }
 
+  public ExternalConnectivityProbeProperties getExternalConnectivityProbe() {
+    return externalConnectivityProbe;
+  }
+
+  public void setExternalConnectivityProbe(
+      ExternalConnectivityProbeProperties externalConnectivityProbe) {
+    this.externalConnectivityProbe = externalConnectivityProbe;
+  }
+
+  public AccountLinkingProperties getAccountLinking() {
+    return accountLinking;
+  }
+
+  public void setAccountLinking(AccountLinkingProperties accountLinking) {
+    this.accountLinking = accountLinking;
+  }
+
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/IamTokenEnhancerProperties.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/IamTokenEnhancerProperties.java
index 9347dce96..fe9c9a5de 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/IamTokenEnhancerProperties.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/IamTokenEnhancerProperties.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -22,7 +22,7 @@
 import javax.validation.constraints.NotNull;
 import javax.validation.constraints.Size;
 
-import org.hibernate.validator.constraints.NotBlank;
+import javax.validation.constraints.NotBlank;
 
 import com.google.common.collect.Lists;
 
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/JWTCriptoConfig.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/JWTCriptoConfig.java
index 9596e3407..f841b5b27 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/JWTCriptoConfig.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/JWTCriptoConfig.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -18,22 +18,22 @@
 import org.mitre.jose.keystore.JWKSetKeyStore;
 import org.mitre.jwt.encryption.service.impl.DefaultJWTEncryptionAndDecryptionService;
 import org.mitre.jwt.signer.service.impl.DefaultJWTSigningAndValidationService;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.core.io.ResourceLoader;
 
 import com.nimbusds.jose.JWEAlgorithm;
-import com.nimbusds.jose.JWSAlgorithm;
 
 import it.infn.mw.iam.config.error.IAMJWTKeystoreError;
 import it.infn.mw.iam.util.JWKKeystoreLoader;
 
 @Configuration
 public class JWTCriptoConfig {
-  
-  public static final String DEFAULT_JWK_SIGN_ALGO = JWSAlgorithm.RS256.getName();
-  public static final JWEAlgorithm DEFAULT_JWE_ENC_ALGO = JWEAlgorithm.RSA_OAEP_256;
+
+  public static final Logger LOG = LoggerFactory.getLogger(JWTCriptoConfig.class);
 
   @Autowired
   IamProperties iamProperties;
@@ -48,6 +48,7 @@ public JWKKeystoreLoader loader() {
 
   @Bean(name = "defaultKeyStore")
   public JWKSetKeyStore defaultKeyStore(JWKKeystoreLoader loader) {
+    LOG.info("Loading JWT keystore from: {}", iamProperties.getJwk().getKeystoreLocation());
     return loader.loadKeystoreFromLocation(iamProperties.getJwk().getKeystoreLocation());
   }
 
@@ -56,8 +57,12 @@ public DefaultJWTSigningAndValidationService defaultSignerService(JWKSetKeyStore
     try {
       DefaultJWTSigningAndValidationService signerService =
           new DefaultJWTSigningAndValidationService(keystore);
+
+      LOG.info("Default JWK key id: {}", iamProperties.getJwk().getDefaultKeyId());
+      LOG.info("Default JWS algorithm: {}", iamProperties.getJwk().getDefaultJwsAlgorithm());
+
       signerService.setDefaultSignerKeyId(iamProperties.getJwk().getDefaultKeyId());
-      signerService.setDefaultSigningAlgorithmName(DEFAULT_JWK_SIGN_ALGO);
+      signerService.setDefaultSigningAlgorithmName(iamProperties.getJwk().getDefaultJwsAlgorithm());
       return signerService;
     } catch (Exception e) {
       throw new IAMJWTKeystoreError("Error creating JWT signing and validation service", e);
@@ -71,9 +76,21 @@ public DefaultJWTEncryptionAndDecryptionService defaultEncryptionService(
     try {
       DefaultJWTEncryptionAndDecryptionService encryptionService =
           new DefaultJWTEncryptionAndDecryptionService(keystore);
-      encryptionService.setDefaultAlgorithm(DEFAULT_JWE_ENC_ALGO);
-      encryptionService.setDefaultDecryptionKeyId(iamProperties.getJwk().getDefaultKeyId());
-      encryptionService.setDefaultEncryptionKeyId(iamProperties.getJwk().getDefaultKeyId());
+
+      JWEAlgorithm algo = JWEAlgorithm.parse(iamProperties.getJwk().getDefaultJweAlgorithm()); 
+      encryptionService
+        .setDefaultAlgorithm(algo);
+
+      LOG.info("Default JWE key encrypt key id: {}",
+          iamProperties.getJwk().getDefaultJweEncryptKeyId());
+      LOG.info("Default JWE key decrypt key id: {}",
+          iamProperties.getJwk().getDefaultJweDecryptKeyId());
+      LOG.info("Default JWE algorithm: {}", algo.getName());
+
+      encryptionService
+        .setDefaultDecryptionKeyId(iamProperties.getJwk().getDefaultJweDecryptKeyId());
+      encryptionService
+        .setDefaultEncryptionKeyId(iamProperties.getJwk().getDefaultJweEncryptKeyId());
       return encryptionService;
     } catch (Exception e) {
       throw new IAMJWTKeystoreError("Error creating JWT encryption/decription service", e);
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/JacksonConfig.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/JacksonConfig.java
index 19684c0cf..700c34794 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/JacksonConfig.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/JacksonConfig.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/JpaConfig.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/JpaConfig.java
index cf9cfc754..696b69365 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/JpaConfig.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/JpaConfig.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -20,9 +20,11 @@
 
 import javax.sql.DataSource;
 
+import org.springframework.beans.factory.ObjectProvider;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.autoconfigure.flyway.FlywayMigrationStrategy;
 import org.springframework.boot.autoconfigure.orm.jpa.JpaBaseConfiguration;
+import org.springframework.boot.autoconfigure.orm.jpa.JpaProperties;
 import org.springframework.boot.orm.jpa.EntityManagerFactoryBuilder;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
@@ -33,11 +35,20 @@
 import org.springframework.orm.jpa.vendor.EclipseLinkJpaVendorAdapter;
 import org.springframework.transaction.PlatformTransactionManager;
 import org.springframework.transaction.annotation.EnableTransactionManagement;
+import org.springframework.transaction.jta.JtaTransactionManager;
 
 @Configuration
 @EnableTransactionManagement
 public class JpaConfig extends JpaBaseConfiguration {
 
+  public static final String ECLIPSELINK_LOGGING_LEVEL = "eclipselink.logging.level";
+  public static final String ECLIPSELINK_LOGGING_LEVEL_SQL = "eclipselink.logging.level.sql";
+
+  protected JpaConfig(DataSource dataSource, JpaProperties properties,
+      ObjectProvider jtaTransactionManager) {
+    super(dataSource, properties, jtaTransactionManager);
+  }
+
   @Autowired
   DataSource dataSource;
 
@@ -53,18 +64,18 @@ protected Map getVendorProperties() {
     Map map = new HashMap<>();
 
     map.put("eclipselink.weaving", "false");
-    map.put("eclipselink.logging.level", "WARNING");
-    map.put("eclipselink.logging.level.sql", "OFF");
+    map.put(ECLIPSELINK_LOGGING_LEVEL, "WARNING");
+    map.put(ECLIPSELINK_LOGGING_LEVEL_SQL, "OFF");
     map.put("eclipselink.cache.shared.default", "false");
 
     if (System.getProperty("iam.show_sql") != null) {
-      map.put("eclipselink.logging.level", "FINE");
-      map.put("eclipselink.logging.level.sql", "FINE");
+      map.put(ECLIPSELINK_LOGGING_LEVEL, "FINE");
+      map.put(ECLIPSELINK_LOGGING_LEVEL_SQL, "FINE");
       map.put("eclipselink.logging.parameters", "true");
     }
 
     if (System.getProperty("iam.generate-ddl-sql-script") != null) {
-      map.put("eclipselink.logging.level", "FINE");
+      map.put(ECLIPSELINK_LOGGING_LEVEL, "FINE");
       map.put("eclipselink.ddl-generation.output-mode", "sql-script");
       map.put("eclipselink.ddl-generation", "create-tables");
       map.put("eclipselink.create-ddl-jdbc-file-name", "ddl.sql");
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/MitreRepositoryConfig.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/MitreRepositoryConfig.java
index ad35d57b5..057b4a64d 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/MitreRepositoryConfig.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/MitreRepositoryConfig.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/MitreServicesConfig.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/MitreServicesConfig.java
index 7502e8e8d..95eb4a23b 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/MitreServicesConfig.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/MitreServicesConfig.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -29,11 +29,9 @@
 import org.mitre.oauth2.service.OAuth2TokenEntityService;
 import org.mitre.oauth2.service.SystemScopeService;
 import org.mitre.oauth2.service.impl.BlacklistAwareRedirectResolver;
-import org.mitre.oauth2.service.impl.DefaultClientUserDetailsService;
 import org.mitre.oauth2.service.impl.DefaultDeviceCodeService;
 import org.mitre.oauth2.service.impl.DefaultOAuth2ClientDetailsEntityService;
 import org.mitre.oauth2.service.impl.DefaultOAuth2ProviderTokenService;
-import org.mitre.oauth2.web.CorsFilter;
 import org.mitre.openid.connect.config.ConfigurationPropertiesBean;
 import org.mitre.openid.connect.config.UIConfiguration;
 import org.mitre.openid.connect.filter.AuthorizationRequestFilter;
@@ -64,15 +62,12 @@
 import org.mitre.openid.connect.token.TofuUserApprovalHandler;
 import org.mitre.openid.connect.web.AuthenticationTimeStamper;
 import org.mitre.openid.connect.web.ServerConfigInterceptor;
-import org.mitre.openid.connect.web.UserInfoInterceptor;
 import org.mitre.uma.service.ResourceSetService;
 import org.springframework.beans.factory.annotation.Qualifier;
 import org.springframework.beans.factory.annotation.Value;
-import org.springframework.boot.context.embedded.FilterRegistrationBean;
+import org.springframework.boot.web.servlet.FilterRegistrationBean;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
-import org.springframework.context.annotation.Primary;
-import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.oauth2.provider.OAuth2RequestFactory;
 import org.springframework.security.oauth2.provider.OAuth2RequestValidator;
 import org.springframework.security.oauth2.provider.approval.UserApprovalHandler;
@@ -80,11 +75,12 @@
 import org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint;
 import org.springframework.security.oauth2.provider.token.TokenEnhancer;
 import org.springframework.security.web.authentication.Http403ForbiddenEntryPoint;
-import org.springframework.web.servlet.AsyncHandlerInterceptor;
 
 import com.google.common.collect.Sets;
 
 import it.infn.mw.iam.authn.oidc.RestTemplateFactory;
+import it.infn.mw.iam.core.client.ClientUserDetailsService;
+import it.infn.mw.iam.core.client.IAMClientUserDetailsService;
 import it.infn.mw.iam.core.oauth.IamJWKSetCacheService;
 import it.infn.mw.iam.core.oauth.IamOAuth2RequestFactory;
 import it.infn.mw.iam.core.oauth.profile.JWTProfileResolver;
@@ -93,7 +89,9 @@
 import it.infn.mw.iam.core.oauth.scope.matchers.ScopeMatcherRegistry;
 import it.infn.mw.iam.core.oauth.scope.pdp.IamScopeFilter;
 import it.infn.mw.iam.core.oidc.IamClientValidationService;
+import it.infn.mw.iam.core.userinfo.IamUserInfoInterceptor;
 
+@SuppressWarnings("deprecation")
 @Configuration
 public class MitreServicesConfig {
 
@@ -191,21 +189,23 @@ OAuth2TokenEntityService tokenServices() {
 
 
   @Bean(name = "mitreUserInfoInterceptor")
-  public AsyncHandlerInterceptor userInfoInterceptor() {
+  public IamUserInfoInterceptor userInfoInterceptor(UserInfoService service) {
 
-    return new UserInfoInterceptor();
+    return new IamUserInfoInterceptor(service);
   }
 
   @Bean(name = "mitreServerConfigInterceptor")
-  public AsyncHandlerInterceptor serverConfigInterceptor() {
+  public ServerConfigInterceptor serverConfigInterceptor() {
 
     return new ServerConfigInterceptor();
   }
 
   @Bean
-  public FilterRegistrationBean disabledMitreFilterRegistration(AuthorizationRequestFilter f) {
+  public FilterRegistrationBean disabledMitreFilterRegistration(
+      AuthorizationRequestFilter f) {
 
-    FilterRegistrationBean b = new FilterRegistrationBean(f);
+    FilterRegistrationBean b =
+        new FilterRegistrationBean<>(f);
     b.setEnabled(false);
     return b;
   }
@@ -228,21 +228,6 @@ public Http403ForbiddenEntryPoint http403ForbiddenEntryPoint() {
     return new Http403ForbiddenEntryPoint();
   }
 
-  @Bean
-  public FilterRegistrationBean disabledCorsFilterRegistration(CorsFilter c) {
-
-    FilterRegistrationBean b = new FilterRegistrationBean(c);
-    b.setEnabled(false);
-    return b;
-  }
-
-  @Primary
-  @Bean
-  public CorsFilter corsFilter() {
-
-    return new CorsFilter();
-  }
-
   @Bean
   public OAuth2AuthenticationEntryPoint oauth2AuthenticationEntryPoint() {
 
@@ -258,9 +243,10 @@ public TokenEnhancer defaultTokenEnhancer() {
   }
 
   @Bean(name = "clientUserDetailsService")
-  public UserDetailsService defaultClientUserDetailsService() {
+  public ClientUserDetailsService defaultClientUserDetailsService(
+      ClientDetailsEntityService clientService) {
 
-    return new DefaultClientUserDetailsService();
+    return new IAMClientUserDetailsService(clientService);
   }
 
   @Bean
@@ -275,19 +261,19 @@ public DynamicClientValidationService clientValidationService(ScopeMatcherRegist
   }
 
   @Bean
-  MITREidDataService_1_0 mitreDataService1_0() {
+  MITREidDataService_1_0 mitreDataService10() {
 
     return new MITREidDataService_1_0();
   }
 
   @Bean
-  MITREidDataService_1_1 mitreDataService1_1() {
+  MITREidDataService_1_1 mitreDataService11() {
 
     return new MITREidDataService_1_1();
   }
 
   @Bean
-  MITREidDataService_1_2 mitreDataService1_2() {
+  MITREidDataService_1_2 mitreDataService12() {
 
     return new MITREidDataService_1_2();
   }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/MvcConfig.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/MvcConfig.java
index 08099994b..96c0f657f 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/MvcConfig.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/MvcConfig.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -20,6 +20,7 @@
 import java.util.Locale;
 import java.util.concurrent.TimeUnit;
 
+import org.mitre.openid.connect.web.ServerConfigInterceptor;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Autowired;
@@ -30,38 +31,38 @@
 import org.springframework.context.annotation.Configuration;
 import org.springframework.core.io.DefaultResourceLoader;
 import org.springframework.http.CacheControl;
-import org.springframework.web.servlet.AsyncHandlerInterceptor;
 import org.springframework.web.servlet.LocaleResolver;
 import org.springframework.web.servlet.config.annotation.CorsRegistry;
 import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
 import org.springframework.web.servlet.config.annotation.ResourceHandlerRegistry;
 import org.springframework.web.servlet.config.annotation.ViewControllerRegistry;
 import org.springframework.web.servlet.config.annotation.ViewResolverRegistry;
-import org.springframework.web.servlet.config.annotation.WebMvcConfigurerAdapter;
+import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
 import org.springframework.web.servlet.i18n.SessionLocaleResolver;
 import org.springframework.web.servlet.resource.VersionResourceResolver;
 import org.springframework.web.servlet.view.BeanNameViewResolver;
 import org.springframework.web.servlet.view.InternalResourceViewResolver;
 import org.springframework.web.servlet.view.JstlView;
 
+import it.infn.mw.iam.core.userinfo.IamUserInfoInterceptor;
 import it.infn.mw.iam.core.util.PoliteJsonMessageSource;
+import it.infn.mw.iam.core.web.IamViewInfoInterceptor;
 
 @Configuration
-// @EnableConfigurationProperties({IamProperties.class})
-public class MvcConfig extends WebMvcConfigurerAdapter {
+public class MvcConfig implements WebMvcConfigurer {
 
   public static final Logger LOG = LoggerFactory.getLogger(MvcConfig.class);
 
   @Autowired
   @Qualifier("mitreUserInfoInterceptor")
-  AsyncHandlerInterceptor userInfoInterceptor;
+  IamUserInfoInterceptor userInfoInterceptor;
 
   @Autowired
   @Qualifier("mitreServerConfigInterceptor")
-  AsyncHandlerInterceptor serverConfigInterceptor;
+  ServerConfigInterceptor serverConfigInterceptor;
 
   @Autowired
-  AsyncHandlerInterceptor iamViewInfoInterceptor;
+  IamViewInfoInterceptor iamViewInfoInterceptor;
 
   @Autowired
   IamProperties iamProperties;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/ResourceServerConfig.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/ResourceServerConfig.java
index ab93eb33e..d4aa7e4e5 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/ResourceServerConfig.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/ResourceServerConfig.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -17,7 +17,7 @@
 
 import org.mitre.oauth2.service.OAuth2TokenEntityService;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.context.embedded.FilterRegistrationBean;
+import org.springframework.boot.web.servlet.FilterRegistrationBean;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.core.annotation.Order;
@@ -25,6 +25,7 @@
 import org.springframework.security.oauth2.provider.authentication.OAuth2AuthenticationProcessingFilter;
 import org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint;
 
+@SuppressWarnings("deprecation")
 @Configuration
 @Order(9) // This is important! Do not remove
 public class ResourceServerConfig {
@@ -36,10 +37,11 @@ public class ResourceServerConfig {
   private OAuth2TokenEntityService tokenService;
 
   @Bean
-  public FilterRegistrationBean disabledAutomaticFilterRegistration(
+  public FilterRegistrationBean disabledAutomaticFilterRegistration(
       final OAuth2AuthenticationProcessingFilter f) {
 
-    FilterRegistrationBean b = new FilterRegistrationBean(f);
+    FilterRegistrationBean b =
+        new FilterRegistrationBean<>(f);
     b.setEnabled(false);
     return b;
   }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/SecurityExpressionHandlerConfiguration.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/SecurityExpressionHandlerConfiguration.java
index 3aff72818..2f5d23d50 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/SecurityExpressionHandlerConfiguration.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/SecurityExpressionHandlerConfiguration.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/TaskConfig.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/TaskConfig.java
index 224eea6d2..cab0ed0ae 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/TaskConfig.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/TaskConfig.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/X509TrustConfig.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/X509TrustConfig.java
index ab234f1da..75e2c173c 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/X509TrustConfig.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/X509TrustConfig.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/cern/CernProperties.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/cern/CernProperties.java
index 6d47b15fa..0d7667694 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/cern/CernProperties.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/cern/CernProperties.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@
 import javax.validation.Valid;
 import javax.validation.constraints.Min;
 
-import org.hibernate.validator.constraints.NotBlank;
+import javax.validation.constraints.NotBlank;
 import org.springframework.boot.context.properties.ConfigurationProperties;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.validation.annotation.Validated;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/client_registration/ClientRegistrationProperties.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/client_registration/ClientRegistrationProperties.java
index 928af6299..517df570a 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/client_registration/ClientRegistrationProperties.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/client_registration/ClientRegistrationProperties.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -20,7 +20,7 @@
 import org.springframework.boot.context.properties.ConfigurationProperties;
 import org.springframework.context.annotation.Configuration;
 
-@ConfigurationProperties("clientRegistration")
+@ConfigurationProperties("client-registration")
 @Configuration
 public class ClientRegistrationProperties {
 
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/error/IAMJWTKeystoreError.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/error/IAMJWTKeystoreError.java
index 040c7e0a8..4946d8861 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/error/IAMJWTKeystoreError.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/error/IAMJWTKeystoreError.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/lifecycle/LifecycleProperties.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/lifecycle/LifecycleProperties.java
index 2c36d0be4..1bba2440c 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/lifecycle/LifecycleProperties.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/lifecycle/LifecycleProperties.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/login/LoginButtonImage.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/login/LoginButtonImage.java
index f1cc1a2a5..34f10bc09 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/login/LoginButtonImage.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/login/LoginButtonImage.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/login/LoginButtonProperties.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/login/LoginButtonProperties.java
index 789175603..4dc9056a2 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/login/LoginButtonProperties.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/login/LoginButtonProperties.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -17,7 +17,7 @@
 
 import javax.validation.Valid;
 
-import org.hibernate.validator.constraints.NotBlank;
+import javax.validation.constraints.NotBlank;
 
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonInclude.Include;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/oidc/OidcClient.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/oidc/OidcClient.java
index cd41594a6..091a5ba39 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/oidc/OidcClient.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/oidc/OidcClient.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/oidc/OidcConfiguration.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/oidc/OidcConfiguration.java
index 8ceb4fde6..6f7339bd0 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/oidc/OidcConfiguration.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/oidc/OidcConfiguration.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -38,7 +38,7 @@
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Qualifier;
 import org.springframework.beans.factory.annotation.Value;
-import org.springframework.boot.context.embedded.FilterRegistrationBean;
+import org.springframework.boot.web.servlet.FilterRegistrationBean;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.context.annotation.Profile;
@@ -94,9 +94,10 @@ public class OidcConfiguration {
   public static final String DEFINE_ME_PLEASE = "define_me_please";
 
   @Bean
-  public FilterRegistrationBean disabledAutomaticOidcFilterRegistration(OidcClientFilter f) {
+  public FilterRegistrationBean disabledAutomaticOidcFilterRegistration(
+      OidcClientFilter f) {
 
-    FilterRegistrationBean b = new FilterRegistrationBean(f);
+    FilterRegistrationBean b = new FilterRegistrationBean<>(f);
     b.setEnabled(false);
     return b;
   }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/oidc/OidcProvider.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/oidc/OidcProvider.java
index 92624b140..db1be44bf 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/oidc/OidcProvider.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/oidc/OidcProvider.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -17,7 +17,7 @@
 
 import javax.validation.Valid;
 
-import org.hibernate.validator.constraints.NotBlank;
+import javax.validation.constraints.NotBlank;
 
 import com.fasterxml.jackson.annotation.JsonIgnore;
 import com.fasterxml.jackson.annotation.JsonInclude;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/oidc/OidcProviderProperties.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/oidc/OidcProviderProperties.java
index 0a22db8af..aaa51478a 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/oidc/OidcProviderProperties.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/oidc/OidcProviderProperties.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/oidc/OidcProviderValidatorCheckProperties.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/oidc/OidcProviderValidatorCheckProperties.java
index 9305879d9..2dd4ac003 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/oidc/OidcProviderValidatorCheckProperties.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/oidc/OidcProviderValidatorCheckProperties.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -17,7 +17,7 @@
 
 import java.util.Map;
 
-import org.hibernate.validator.constraints.NotBlank;
+import javax.validation.constraints.NotBlank;
 
 import com.google.common.collect.Maps;
 
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/oidc/OidcProviderValidatorProperties.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/oidc/OidcProviderValidatorProperties.java
index d41f040a8..8c5023945 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/oidc/OidcProviderValidatorProperties.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/oidc/OidcProviderValidatorProperties.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/oidc/OidcValidatedProviders.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/oidc/OidcValidatedProviders.java
index 3df433cb3..c743655e3 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/oidc/OidcValidatedProviders.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/oidc/OidcValidatedProviders.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/saml/IamSamlIdpMetadataProperties.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/saml/IamSamlIdpMetadataProperties.java
index 3ff04aa57..12071d231 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/saml/IamSamlIdpMetadataProperties.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/saml/IamSamlIdpMetadataProperties.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -17,9 +17,11 @@
 
 import static java.lang.Boolean.FALSE;
 
-import org.hibernate.validator.constraints.NotBlank;
+import javax.validation.constraints.NotBlank;
 import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.validation.annotation.Validated;
 
+@Validated
 @ConfigurationProperties(prefix = "saml.idp-metadata")
 public class IamSamlIdpMetadataProperties {
 
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/saml/IamSamlJITAccountProvisioningProperties.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/saml/IamSamlJITAccountProvisioningProperties.java
index 1521cb8f4..676ebf936 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/saml/IamSamlJITAccountProvisioningProperties.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/saml/IamSamlJITAccountProvisioningProperties.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -25,11 +25,13 @@
 import javax.validation.constraints.Min;
 
 import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.validation.annotation.Validated;
 
 import com.google.common.base.Splitter;
 import com.google.common.collect.Lists;
 import com.google.common.collect.Sets;
 
+@Validated
 @ConfigurationProperties(prefix = "saml.jit-account-provisioning")
 public class IamSamlJITAccountProvisioningProperties {
 
@@ -191,4 +193,4 @@ public List getEntityMapping() {
   public void setEntityMapping(List entityMapping) {
     this.entityMapping = entityMapping;
   }
-}
\ No newline at end of file
+}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/saml/IamSamlLoginShortcut.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/saml/IamSamlLoginShortcut.java
index b608449a0..6fefa97ce 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/saml/IamSamlLoginShortcut.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/saml/IamSamlLoginShortcut.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -17,7 +17,7 @@
 
 import javax.validation.Valid;
 
-import org.hibernate.validator.constraints.NotBlank;
+import javax.validation.constraints.NotBlank;
 
 import it.infn.mw.iam.config.login.LoginButtonProperties;
 
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/saml/IamSamlProperties.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/saml/IamSamlProperties.java
index 20b95654f..1f28dc949 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/saml/IamSamlProperties.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/saml/IamSamlProperties.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -20,10 +20,11 @@
 
 import javax.validation.Valid;
 
-import org.hibernate.validator.constraints.NotBlank;
+import javax.validation.constraints.NotBlank;
 import org.opensaml.saml2.core.NameIDType;
 import org.opensaml.xml.signature.SignatureConstants;
 import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.validation.annotation.Validated;
 
 import com.google.common.collect.Lists;
 
@@ -33,8 +34,10 @@
 import it.infn.mw.iam.config.saml.IamSamlJITAccountProvisioningProperties.AttributeMappingProperties;
 
 @ConfigurationProperties(prefix = "saml")
+@Validated
 public class IamSamlProperties {
   
+  @Validated
   public static class IssuerValidationProperties {
     
     @NotBlank
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/saml/SamlConfig.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/saml/SamlConfig.java
index 53ebcca68..c8b311d3d 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/saml/SamlConfig.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/saml/SamlConfig.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -52,6 +52,8 @@
 import org.opensaml.xml.signature.SignatureConstants;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.DisposableBean;
+import org.springframework.beans.factory.InitializingBean;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Qualifier;
 import org.springframework.boot.context.properties.ConfigurationProperties;
@@ -101,6 +103,7 @@
 import org.springframework.security.saml.trust.httpclient.TLSProtocolConfigurer;
 import org.springframework.security.saml.trust.httpclient.TLSProtocolSocketFactory;
 import org.springframework.security.saml.userdetails.SAMLUserDetailsService;
+import org.springframework.security.saml.util.VelocityFactory;
 import org.springframework.security.saml.websso.ArtifactResolutionProfile;
 import org.springframework.security.saml.websso.ArtifactResolutionProfileImpl;
 import org.springframework.security.saml.websso.SingleLogoutProfile;
@@ -140,7 +143,6 @@
 import it.infn.mw.iam.authn.saml.IamSamlAuthenticationProvider;
 import it.infn.mw.iam.authn.saml.JustInTimeProvisioningSAMLUserDetailsService;
 import it.infn.mw.iam.authn.saml.MappingPropertiesResolver;
-import it.infn.mw.iam.authn.saml.MetadataLookupService;
 import it.infn.mw.iam.authn.saml.SamlExceptionMessageHelper;
 import it.infn.mw.iam.authn.saml.profile.DefaultSSOProfileOptionsResolver;
 import it.infn.mw.iam.authn.saml.profile.IamSSOProfile;
@@ -166,48 +168,43 @@
 @Profile("saml")
 @EnableConfigurationProperties({IamSamlProperties.class,
     IamSamlJITAccountProvisioningProperties.class, ServerProperties.class})
-public class SamlConfig extends WebSecurityConfigurerAdapter implements SchedulingConfigurer {
+public class SamlConfig extends WebSecurityConfigurerAdapter
+    implements SchedulingConfigurer, InitializingBean, DisposableBean {
 
   public static final Logger LOG = LoggerFactory.getLogger(SamlConfig.class);
 
   @Autowired
-  ResourceLoader resourceLoader;
+  private ResourceLoader resourceLoader;
 
   @Autowired
-  SessionTimeoutHelper sessionTimeoutHelper;
+  private SessionTimeoutHelper sessionTimeoutHelper;
 
   @Autowired
-  SamlUserIdentifierResolver resolver;
+  private SamlUserIdentifierResolver resolver;
 
   @Autowired
-  MappingPropertiesResolver mappingResolver;
+  private MappingPropertiesResolver mappingResolver;
 
   @Autowired
-  AuthenticationValidator validator;
+  private AuthenticationValidator validator;
 
   @Autowired
-  IamAccountRepository repo;
+  private IamAccountRepository repo;
 
   @Autowired
-  IamAccountService accountService;
+  private IamAccountService accountService;
 
   @Autowired
-  IamProperties iamProperties;
+  private IamProperties iamProperties;
 
   @Autowired
-  IamSamlProperties samlProperties;
+  private IamSamlProperties samlProperties;
 
   @Autowired
-  IamSamlJITAccountProvisioningProperties jitProperties;
+  private IamSamlJITAccountProvisioningProperties jitProperties;
 
   @Autowired
-  InactiveAccountAuthenticationHander inactiveAccountHandler;
-
-  @Autowired
-  MetadataLookupService metadataLookupService;
-
-  @Autowired
-  VelocityEngine velocityEngine;
+  private InactiveAccountAuthenticationHander inactiveAccountHandler;
 
   @Autowired
   private AUPSignatureCheckService aupSignatureCheckService;
@@ -216,10 +213,12 @@ public class SamlConfig extends WebSecurityConfigurerAdapter implements Scheduli
   private AccountUtils accountUtils;
 
   @Autowired
-  SSOProfileOptionsResolver optionsResolver;
+  private SSOProfileOptionsResolver optionsResolver;
 
   @Autowired
-  IamSSOProfileOptions defaultOptions;
+  private IamSSOProfileOptions defaultOptions;
+
+  private MultiThreadedHttpConnectionManager connectionManager;
 
   @ConfigurationProperties(prefix = "server")
   public static class ServerProperties {
@@ -329,7 +328,7 @@ public static SAMLBootstrap sAMLBootstrap() {
   public Timer samlMetadataFetchTimer() {
     return new SamlMetadataFetchTimer();
   }
-  
+
   @Bean
   public SAMLEntryPoint samlEntryPoint() {
     IamSamlEntryPoint ep = new IamSamlEntryPoint(optionsResolver);
@@ -367,9 +366,15 @@ public ParserPoolHolder parserPoolHolder() {
   }
 
   // Bindings, encoders and decoders used for creating and parsing messages
-  @Bean
   public MultiThreadedHttpConnectionManager multiThreadedHttpConnectionManager() {
 
+    LOG.info("Initializing SAML connection manager");
+    LOG.info("SAML connection manager connection timeout: {} secs",
+        samlProperties.getHttpClientConnectionTimeoutSecs());
+
+    LOG.info("SAML connection manager socket timeout: {} secs",
+        samlProperties.getHttpClientSocketTimeoutSecs());
+
     MultiThreadedHttpConnectionManager manager = new MultiThreadedHttpConnectionManager();
 
     manager.getParams()
@@ -385,7 +390,7 @@ public MultiThreadedHttpConnectionManager multiThreadedHttpConnectionManager() {
 
   @Bean
   public HttpClient httpClient() {
-    return new HttpClient(multiThreadedHttpConnectionManager());
+    return new HttpClient(connectionManager);
   }
 
   @Bean
@@ -588,6 +593,11 @@ private List metadataProviders(Timer metadataFetchTimer, Parse
     HttpClient httpClient = httpClient();
 
     for (IamSamlIdpMetadataProperties p : samlProperties.getIdpMetadata()) {
+
+      if (Strings.isNullOrEmpty(p.getMetadataUrl())) {
+        throw new IllegalStateException("Null or empty metadata url");
+      }
+
       String trimmedMedataUrl = p.getMetadataUrl().trim();
 
       if (trimmedMedataUrl.startsWith("classpath:")) {
@@ -797,7 +807,7 @@ public HTTPSOAP11Binding soapBinding() {
   }
 
   @Bean
-  public HTTPPostBinding httpPostBinding() {
+  public HTTPPostBinding httpPostBinding(VelocityEngine velocityEngine) {
 
     return new HTTPPostBinding(parserPool(), velocityEngine);
   }
@@ -821,17 +831,21 @@ public HTTPPAOS11Binding httpPAOS11Binding() {
   }
 
   @Bean
-  public SAMLProcessor processor() {
+  public SAMLProcessor processor(VelocityEngine velocityEngine) {
 
     Collection bindings = new ArrayList<>();
     bindings.add(httpRedirectDeflateBinding());
-    bindings.add(httpPostBinding());
+    bindings.add(httpPostBinding(velocityEngine));
     bindings.add(artifactBinding(parserPool(), velocityEngine));
     bindings.add(httpSOAP11Binding());
     bindings.add(httpPAOS11Binding());
     return new SAMLProcessorImpl(bindings);
   }
 
+  @Bean
+  public VelocityEngine velocityEngine() {
+    return VelocityFactory.getEngine();
+  }
 
   @Bean
   public FilterChainProxy samlFilter() throws Exception {
@@ -902,4 +916,16 @@ public void configureTasks(ScheduledTaskRegistrar taskRegistrar) {
     scheduleProvisionedAccountsCleanup(taskRegistrar);
   }
 
+  @Override
+  public void destroy() throws Exception {
+    LOG.info("Shutting down SAML connection manager");
+    connectionManager.shutdown();
+    LOG.info("Shutted down SAML connection manager");
+  }
+
+  @Override
+  public void afterPropertiesSet() throws Exception {
+    connectionManager = multiThreadedHttpConnectionManager();
+  }
+
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/scim/ScimProperties.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/scim/ScimProperties.java
index 65589af37..9e3851c4c 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/scim/ScimProperties.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/scim/ScimProperties.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/security/CorsConfig.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/security/CorsConfig.java
new file mode 100644
index 000000000..e24418419
--- /dev/null
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/security/CorsConfig.java
@@ -0,0 +1,56 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.infn.mw.iam.config.security;
+
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.web.cors.CorsConfiguration;
+import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
+import org.springframework.web.filter.CorsFilter;
+
+@Configuration
+public class CorsConfig {
+
+  private static final String[] CORS_ENDPOINT_MATCHERS =
+  // @formatter:off
+    {
+        "/api/**", 
+        "/resource/**", 
+        "/register/**",
+        "/iam/**", 
+        "/scim/**", 
+        "/token", 
+        "/introspect", 
+        "/userinfo", 
+        "/revoke/**", 
+        "/jwk",
+        "/devicode"
+    };
+    //@formatter:on
+
+  @Bean
+  CorsFilter corsFilter() {
+    UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
+    CorsConfiguration corsConfig = new CorsConfiguration();
+    corsConfig.applyPermitDefaultValues();
+
+    for (String m : CORS_ENDPOINT_MATCHERS) {
+      source.registerCorsConfiguration(m, corsConfig);
+    }
+
+    return new CorsFilter(source);
+  }
+}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamApiSecurityConfig.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamApiSecurityConfig.java
index 0f8c9ab24..4fa7c1c3b 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamApiSecurityConfig.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamApiSecurityConfig.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -18,10 +18,11 @@
 import static org.springframework.http.HttpMethod.GET;
 import static org.springframework.http.HttpMethod.POST;
 
-import org.mitre.oauth2.web.CorsFilter;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Qualifier;
-import org.springframework.beans.factory.annotation.Value;
+import org.springframework.boot.actuate.autoconfigure.security.servlet.EndpointRequest;
+import org.springframework.boot.actuate.health.HealthEndpoint;
+import org.springframework.boot.actuate.info.InfoEndpoint;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.core.annotation.Order;
 import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
@@ -29,17 +30,18 @@
 import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
 import org.springframework.security.config.http.SessionCreationPolicy;
 import org.springframework.security.core.userdetails.UserDetailsService;
+import org.springframework.security.crypto.password.NoOpPasswordEncoder;
+import org.springframework.security.crypto.password.PasswordEncoder;
 import org.springframework.security.oauth2.provider.authentication.OAuth2AuthenticationProcessingFilter;
 import org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler;
 import org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint;
-import org.springframework.security.web.access.AccessDeniedHandlerImpl;
 import org.springframework.security.web.context.SecurityContextPersistenceFilter;
-import org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter;
 
 import it.infn.mw.iam.api.proxy.ProxyCertificatesApiController;
-import it.infn.mw.iam.config.CustomAuthenticationEntryPoint;
+import it.infn.mw.iam.config.IamProperties;
 import it.infn.mw.iam.core.oauth.FormClientCredentialsAuthenticationFilter;
 
+@SuppressWarnings("deprecation")
 @Configuration
 public class IamApiSecurityConfig {
 
@@ -59,12 +61,10 @@ public static class IamProxyCertificateApiConfig extends WebSecurityConfigurerAd
     @Autowired
     private OAuth2AuthenticationEntryPoint authenticationEntryPoint;
 
-    @Autowired
-    private CorsFilter corsFilter;
-
     @Override
     protected void configure(final AuthenticationManagerBuilder auth) throws Exception {
-      auth.userDetailsService(userDetailsService);
+      auth.userDetailsService(userDetailsService)
+        .passwordEncoder(NoOpPasswordEncoder.getInstance());
     }
 
     @Override
@@ -73,9 +73,9 @@ protected void configure(final HttpSecurity http) throws Exception {
       FormClientCredentialsAuthenticationFilter ccFilter =
           new FormClientCredentialsAuthenticationFilter(PROXY_API_MATCHER,
               authenticationEntryPoint);
-      
+
       ccFilter.setAuthenticationManager(authenticationManager());
-      
+
       // @formatter:off
       http.antMatcher(PROXY_API_MATCHER)
           .exceptionHandling()
@@ -84,7 +84,8 @@ protected void configure(final HttpSecurity http) throws Exception {
         .and()
           .addFilterBefore(ccFilter, SecurityContextPersistenceFilter.class)
           .addFilterAfter(resourceFilter, SecurityContextPersistenceFilter.class)
-          .addFilterBefore(corsFilter, WebAsyncManagerIntegrationFilter.class)
+        .cors()
+        .and()
         .sessionManagement()
           .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
         .and()
@@ -107,9 +108,6 @@ public static class IamApiConfig extends WebSecurityConfigurerAdapter {
 
     @Autowired
     private OAuth2AuthenticationEntryPoint authenticationEntryPoint;
-    
-    @Autowired
-    private CorsFilter corsFilter;
 
     @Override
     protected void configure(final HttpSecurity http) throws Exception {
@@ -124,7 +122,8 @@ protected void configure(final HttpSecurity http) throws Exception {
             .accessDeniedHandler(new OAuth2AccessDeniedHandler())
         .and()
           .addFilterAfter(resourceFilter, SecurityContextPersistenceFilter.class)
-          .addFilterBefore(corsFilter, WebAsyncManagerIntegrationFilter.class)
+        .cors()
+        .and()
         .sessionManagement()
           .sessionCreationPolicy(SessionCreationPolicy.NEVER)
         .and()
@@ -151,51 +150,33 @@ protected void configure(final HttpSecurity http) throws Exception {
   @Order(25)
   public static class ActuatorEndpointsConfig extends WebSecurityConfigurerAdapter {
 
-    @Value("${iam.superuser.username}")
-    private String basicUsername;
-
-    @Value("${iam.superuser.password}")
-    private String basicPassword;
-
     @Autowired
-    private OAuth2AuthenticationProcessingFilter resourceFilter;
+    private IamProperties properties;
 
     @Autowired
-    private CustomAuthenticationEntryPoint customAuthenticationEntyPoint;
+    private PasswordEncoder passwordEncoder;
 
     @Override
     public void configure(AuthenticationManagerBuilder auth) throws Exception {
       // @formatter:off
       auth.inMemoryAuthentication()
-        .withUser(basicUsername).password(basicPassword)
-        .roles("SUPERUSER", "ADMIN");
+        .withUser(properties.getActuatorUser().getUsername()).password(
+            passwordEncoder.encode(
+            properties.getActuatorUser().getPassword()))
+        .roles("ACTUATOR");
       // @formatter:on
     }
 
     @Override
     protected void configure(final HttpSecurity http) throws Exception {
-      // @formatter:off
-      http
-        .requestMatchers()
-          .antMatchers("/metrics", "/info", "/health", "/health/mail", "/health/external",
-              "/configprops", "/env", "/mappings", "/flyway", "/autoconfig", "/beans", "/dump", "/trace")
-        .and()
-          .httpBasic()
-          .authenticationEntryPoint(customAuthenticationEntyPoint)
-        .and()
-          .exceptionHandling()
-            .accessDeniedHandler(new AccessDeniedHandlerImpl())
+      http.requestMatcher(EndpointRequest.to(HealthEndpoint.class, InfoEndpoint.class))
+        .httpBasic()
         .and()
-          .addFilterAfter(resourceFilter, SecurityContextPersistenceFilter.class)
+        .authorizeRequests(r -> r.anyRequest().permitAll())
         .sessionManagement()
-          .sessionCreationPolicy(SessionCreationPolicy.NEVER)
+        .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
         .and()
-          .authorizeRequests()
-            .antMatchers(GET, "/info", "/health", "/health/mail", "/health/external").permitAll()
-            .antMatchers(GET, "/metrics").hasRole("ADMIN")
-            .antMatchers(GET, "/configprops", "/env", "/mappings", 
-                "/flyway", "/autoconfig", "/beans", "/dump", "/trace").hasRole("SUPERUSER");
-      // @formatter:on
+        .httpBasic();
     }
   }
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamTokenEndointSecurityConfig.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamTokenEndointSecurityConfig.java
index 4466db75c..37c8cb621 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamTokenEndointSecurityConfig.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamTokenEndointSecurityConfig.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -15,54 +15,88 @@
  */
 package it.infn.mw.iam.config.security;
 
+import static java.util.Collections.singletonList;
 import static org.springframework.http.HttpMethod.OPTIONS;
 
-import org.mitre.oauth2.web.CorsFilter;
+import java.time.Clock;
+
+import org.mitre.jwt.signer.service.impl.ClientKeyCacheService;
+import org.mitre.openid.connect.assertion.JWTBearerClientAssertionTokenEndpointFilter;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Qualifier;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.core.annotation.Order;
+import org.springframework.security.authentication.ProviderManager;
 import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
 import org.springframework.security.config.http.SessionCreationPolicy;
-import org.springframework.security.core.userdetails.UserDetailsService;
+import org.springframework.security.crypto.password.NoOpPasswordEncoder;
 import org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter;
 import org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler;
 import org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint;
 import org.springframework.security.web.authentication.preauth.AbstractPreAuthenticatedProcessingFilter;
-import org.springframework.security.web.context.SecurityContextPersistenceFilter;
+import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;
+import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
+
+import it.infn.mw.iam.config.IamProperties;
+import it.infn.mw.iam.core.client.ClientUserDetailsService;
+import it.infn.mw.iam.core.oauth.assertion.IAMJWTBearerAuthenticationProvider;
 
+@SuppressWarnings("deprecation")
 @Configuration
 @Order(-1)
 public class IamTokenEndointSecurityConfig extends WebSecurityConfigurerAdapter {
 
   public static final String TOKEN_ENDPOINT = "/token";
-  
-  @Autowired
-  private CorsFilter corsFilter;
 
   @Autowired
   private OAuth2AuthenticationEntryPoint authenticationEntryPoint;
 
   @Autowired
   @Qualifier("clientUserDetailsService")
-  private UserDetailsService userDetailsService;
+  private ClientUserDetailsService userDetailsService;
+
+  @Autowired
+  private Clock clock;
+
+  @Autowired
+  private ClientKeyCacheService validators;
+
+  @Autowired
+  private IamProperties iamProperties;
 
   @Override
   protected void configure(AuthenticationManagerBuilder auth) throws Exception {
-    auth.userDetailsService(userDetailsService);
+
+    auth.userDetailsService(userDetailsService)
+      .passwordEncoder(NoOpPasswordEncoder.getInstance());
   }
 
   @Bean
   public ClientCredentialsTokenEndpointFilter ccFilter() throws Exception {
     ClientCredentialsTokenEndpointFilter filter =
         new ClientCredentialsTokenEndpointFilter(TOKEN_ENDPOINT);
+    filter.setAllowOnlyPost(true);
     filter.setAuthenticationManager(authenticationManager());
     return filter;
   }
 
+  @Bean
+  public JWTBearerClientAssertionTokenEndpointFilter jwtBearerFilter() {
+
+    JWTBearerClientAssertionTokenEndpointFilter filter =
+        new JWTBearerClientAssertionTokenEndpointFilter(new AntPathRequestMatcher(TOKEN_ENDPOINT));
+
+    IAMJWTBearerAuthenticationProvider authProvider = new IAMJWTBearerAuthenticationProvider(clock,
+        iamProperties, userDetailsService.getClientDetailsService(), validators);
+
+    filter.setAuthenticationManager(new ProviderManager(singletonList(authProvider)));
+
+    return filter;
+  }
+
   @Override
   protected void configure(HttpSecurity http) throws Exception {
 
@@ -78,14 +112,16 @@ protected void configure(HttpSecurity http) throws Exception {
             .antMatchers(OPTIONS, TOKEN_ENDPOINT).permitAll()
             .antMatchers(TOKEN_ENDPOINT).authenticated()
             .and()
-        .addFilterBefore(ccFilter(), AbstractPreAuthenticatedProcessingFilter.class)   
-        .addFilterBefore(corsFilter, SecurityContextPersistenceFilter.class)
+            .addFilterBefore(jwtBearerFilter(), AbstractPreAuthenticatedProcessingFilter.class)
+            .addFilterAfter(ccFilter(), BasicAuthenticationFilter.class)
         .exceptionHandling()
             .authenticationEntryPoint(authenticationEntryPoint)
             .accessDeniedHandler(new OAuth2AccessDeniedHandler())
             .and()
         .sessionManagement()
             .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
+        .and()
+          .cors()
         .and()
           .csrf()
             .disable();
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java
index 03f9ef203..d01c8512d 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -64,6 +64,7 @@
 import it.infn.mw.iam.core.IamLocalAuthenticationProvider;
 import it.infn.mw.iam.persistence.repository.IamAccountRepository;
 
+@SuppressWarnings("deprecation")
 @Configuration
 @EnableWebSecurity
 public class IamWebSecurityConfig {
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/security/MitreSecurityConfig.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/security/MitreSecurityConfig.java
index 4f843b2ba..1c214b56e 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/security/MitreSecurityConfig.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/security/MitreSecurityConfig.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -18,7 +18,6 @@
 import static org.springframework.security.config.http.SessionCreationPolicy.NEVER;
 import static org.springframework.security.config.http.SessionCreationPolicy.STATELESS;
 
-import org.mitre.oauth2.web.CorsFilter;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Qualifier;
 import org.springframework.context.annotation.Configuration;
@@ -28,16 +27,17 @@
 import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
 import org.springframework.security.config.http.SessionCreationPolicy;
 import org.springframework.security.core.userdetails.UserDetailsService;
+import org.springframework.security.crypto.password.NoOpPasswordEncoder;
 import org.springframework.security.oauth2.provider.authentication.OAuth2AuthenticationProcessingFilter;
 import org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter;
 import org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint;
 import org.springframework.security.web.authentication.Http403ForbiddenEntryPoint;
 import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;
 import org.springframework.security.web.context.SecurityContextPersistenceFilter;
-import org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter;
 
 import it.infn.mw.iam.config.client_registration.ClientRegistrationProperties;
 
+@SuppressWarnings("deprecation")
 @Configuration
 public class MitreSecurityConfig {
 
@@ -52,23 +52,20 @@ public static class MitreApisEndpointAuthorizationConfig extends WebSecurityConf
     @Autowired
     private OAuth2AuthenticationEntryPoint authenticationEntryPoint;
 
-    @Autowired
-    private CorsFilter corsFilter;
-
     @Override
     public void configure(final HttpSecurity http) throws Exception {
 
       // @formatter:off
       http.antMatcher("/api/**")
           .addFilterAfter(resourceFilter, SecurityContextPersistenceFilter.class)
-          .addFilterBefore(corsFilter, WebAsyncManagerIntegrationFilter.class)
           .exceptionHandling()
             .authenticationEntryPoint(authenticationEntryPoint)
           .and()
             .sessionManagement()
             .sessionCreationPolicy(SessionCreationPolicy.NEVER)
           .and()
-            .csrf().disable();
+            .csrf().disable()
+          .cors();
       // @formatter:on
 
     }
@@ -84,11 +81,7 @@ public static class ResourceEndpointAuthorizationConfig extends WebSecurityConfi
     @Autowired
     private OAuth2AuthenticationEntryPoint authenticationEntryPoint;
 
-    @Autowired
-    private CorsFilter corsFilter;
-
     @Override
-
     public void configure(final HttpSecurity http) throws Exception {
 
       // @formatter:off
@@ -96,14 +89,14 @@ public void configure(final HttpSecurity http) throws Exception {
         .exceptionHandling()
           .authenticationEntryPoint(authenticationEntryPoint).and()
         .addFilterAfter(resourceFilter, SecurityContextPersistenceFilter.class)
-        .addFilterBefore(corsFilter, WebAsyncManagerIntegrationFilter.class)
         .sessionManagement()
           .sessionCreationPolicy(STATELESS)
         .and()
           .authorizeRequests()
             .antMatchers("/resource/**").permitAll()
         .and()
-          .csrf().disable();
+          .csrf().disable()
+        .cors();
       // @formatter:on
     }
   }
@@ -120,9 +113,6 @@ public static class RegisterEndpointAuthorizationConfig extends WebSecurityConfi
     @Autowired
     private OAuth2AuthenticationEntryPoint authenticationEntryPoint;
 
-    @Autowired
-    private CorsFilter corsFilter;
-
     @Autowired
     private ClientRegistrationProperties clientRegProps;
 
@@ -135,7 +125,6 @@ public void configure(final HttpSecurity http) throws Exception {
         .authenticationEntryPoint(authenticationEntryPoint)
         .and()
         .addFilterAfter(resourceFilter, SecurityContextPersistenceFilter.class)
-        .addFilterBefore(corsFilter, WebAsyncManagerIntegrationFilter.class)
         .sessionManagement()
         .sessionCreationPolicy(STATELESS);
 
@@ -162,9 +151,6 @@ public static class UserInfoEndpointAuthorizationConfig extends WebSecurityConfi
     @Autowired
     private OAuth2AuthenticationEntryPoint authenticationEntryPoint;
 
-    @Autowired
-    private CorsFilter corsFilter;
-
     @Override
     public void configure(final HttpSecurity http) throws Exception {
 
@@ -174,9 +160,10 @@ public void configure(final HttpSecurity http) throws Exception {
           .authenticationEntryPoint(authenticationEntryPoint)
         .and()
           .addFilterAfter(resourceFilter, SecurityContextPersistenceFilter.class)
-          .addFilterBefore(corsFilter, WebAsyncManagerIntegrationFilter.class)
-        .sessionManagement()
-          .sessionCreationPolicy(STATELESS)
+        .cors()
+        .and()
+          .sessionManagement()
+            .sessionCreationPolicy(STATELESS)
         .and()
           .csrf().disable();
       // @formatter:on
@@ -194,13 +181,11 @@ public static class IntrospectEndpointAuthorizationConfig extends WebSecurityCon
     @Qualifier("clientUserDetailsService")
     private UserDetailsService userDetailsService;
 
-    @Autowired
-    private CorsFilter corsFilter;
-
     @Override
     protected void configure(final AuthenticationManagerBuilder auth) throws Exception {
 
-      auth.userDetailsService(userDetailsService);
+      auth.userDetailsService(userDetailsService)
+        .passwordEncoder(NoOpPasswordEncoder.getInstance());
     }
 
     @Override
@@ -211,9 +196,10 @@ protected void configure(final HttpSecurity http) throws Exception {
         .httpBasic()
           .authenticationEntryPoint(authenticationEntryPoint)
         .and()
-          .addFilterBefore(corsFilter, SecurityContextPersistenceFilter.class)
+          .cors()
+        .and()
             .exceptionHandling()
-          .authenticationEntryPoint(authenticationEntryPoint)
+              .authenticationEntryPoint(authenticationEntryPoint)
         .and()
           .sessionManagement()
             .sessionCreationPolicy(STATELESS).and()
@@ -237,13 +223,11 @@ public static class RevokeEndpointAuthorizationConfig extends WebSecurityConfigu
     @Qualifier("clientUserDetailsService")
     private UserDetailsService userDetailsService;
 
-    @Autowired
-    private CorsFilter corsFilter;
-
     @Override
     protected void configure(final AuthenticationManagerBuilder auth) throws Exception {
 
-      auth.userDetailsService(userDetailsService);
+      auth.userDetailsService(userDetailsService)
+        .passwordEncoder(NoOpPasswordEncoder.getInstance());
     }
 
     private ClientCredentialsTokenEndpointFilter clientCredentialsEndpointFilter()
@@ -263,8 +247,9 @@ protected void configure(final HttpSecurity http) throws Exception {
         .httpBasic()
           .authenticationEntryPoint(authenticationEntryPoint)
         .and()
-          .addFilterBefore(corsFilter, SecurityContextPersistenceFilter.class)
           .addFilterBefore(clientCredentialsEndpointFilter(), BasicAuthenticationFilter.class)
+        .cors()
+        .and()
         .exceptionHandling()
           .authenticationEntryPoint(authenticationEntryPoint)
         .and()
@@ -288,6 +273,8 @@ protected void configure(final HttpSecurity http) throws Exception {
       http.antMatcher("/jwk**")
         .exceptionHandling()
           .authenticationEntryPoint(http403ForbiddenEntryPoint)
+        .and()
+          .cors()
         .and()
           .sessionManagement()
           .sessionCreationPolicy(STATELESS)
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/security/SpringHttpFirewallConfig.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/security/SpringHttpFirewallConfig.java
new file mode 100644
index 000000000..6db99e51c
--- /dev/null
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/security/SpringHttpFirewallConfig.java
@@ -0,0 +1,39 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.infn.mw.iam.config.security;
+
+import java.util.function.Predicate;
+
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.web.firewall.HttpFirewall;
+import org.springframework.security.web.firewall.StrictHttpFirewall;
+
+@Configuration
+public class SpringHttpFirewallConfig {
+
+  public static final Predicate ANY_VALUE = s -> true;
+
+  @Bean
+  HttpFirewall iamHttpFirewall() {
+
+    StrictHttpFirewall httpFirewall = new StrictHttpFirewall();
+    httpFirewall.setAllowedHeaderValues(ANY_VALUE);
+
+    return httpFirewall;
+  }
+
+}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/IamAuthenticationHolderEntityService.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/IamAuthenticationHolderEntityService.java
index 760492a29..2ffbefe66 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/IamAuthenticationHolderEntityService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/IamAuthenticationHolderEntityService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -30,6 +30,7 @@
 import it.infn.mw.iam.authn.AbstractExternalAuthenticationToken;
 import it.infn.mw.iam.authn.ExternalAuthenticationInfoBuilder;
 
+@SuppressWarnings("deprecation")
 @Service("authenticationHolderEntityService")
 @Primary
 public class IamAuthenticationHolderEntityService implements AuthenticationHolderEntityService {
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/IamLocalAuthenticationProvider.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/IamLocalAuthenticationProvider.java
index 23f6bc9eb..7f03bad7a 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/IamLocalAuthenticationProvider.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/IamLocalAuthenticationProvider.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/IamThirdPartyIssuerService.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/IamThirdPartyIssuerService.java
index 8a0419e27..ea904414c 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/IamThirdPartyIssuerService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/IamThirdPartyIssuerService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/IamTokenService.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/IamTokenService.java
index 0d28affc6..bf5b56935 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/IamTokenService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/IamTokenService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/IamUserDetailsService.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/IamUserDetailsService.java
index f41e9e412..1debac902 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/IamUserDetailsService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/IamUserDetailsService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimAttribute.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/client/ClientUserDetailsService.java
similarity index 67%
rename from iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimAttribute.java
rename to iam-login-service/src/main/java/it/infn/mw/iam/core/client/ClientUserDetailsService.java
index 36e726324..ae3097a12 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/scim/model/ScimAttribute.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/client/ClientUserDetailsService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -13,8 +13,11 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package it.infn.mw.iam.api.scim.model;
+package it.infn.mw.iam.core.client;
 
-public class ScimAttribute {
+import org.mitre.oauth2.service.ClientDetailsEntityService;
+import org.springframework.security.core.userdetails.UserDetailsService;
 
+public interface ClientUserDetailsService extends UserDetailsService {
+  ClientDetailsEntityService getClientDetailsService();
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/client/IAMClientUserDetailsService.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/client/IAMClientUserDetailsService.java
new file mode 100644
index 000000000..548fc5efe
--- /dev/null
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/client/IAMClientUserDetailsService.java
@@ -0,0 +1,79 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.infn.mw.iam.core.client;
+
+import java.util.Collection;
+import java.util.Optional;
+import java.util.function.Supplier;
+
+import org.mitre.oauth2.model.ClientDetailsEntity;
+import org.mitre.oauth2.service.ClientDetailsEntityService;
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.authority.SimpleGrantedAuthority;
+import org.springframework.security.core.userdetails.User;
+import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.security.core.userdetails.UsernameNotFoundException;
+import org.springframework.security.oauth2.common.exceptions.InvalidClientException;
+
+import com.google.common.base.Strings;
+import com.google.common.collect.Sets;
+
+@SuppressWarnings("deprecation")
+public class IAMClientUserDetailsService implements ClientUserDetailsService {
+  private static final GrantedAuthority ROLE_CLIENT = new SimpleGrantedAuthority("ROLE_CLIENT");
+
+  private final ClientDetailsEntityService clientService;
+
+  public IAMClientUserDetailsService(ClientDetailsEntityService clientService) {
+    this.clientService = clientService;
+  }
+
+  private Supplier unknownClientError(String clientId) {
+    return () -> new UsernameNotFoundException("Unknown client: " + clientId);
+  }
+
+  @Override
+  public UserDetails loadUserByUsername(String clientId) throws UsernameNotFoundException {
+
+    try {
+      ClientDetailsEntity client = Optional.ofNullable(clientService.loadClientByClientId(clientId))
+        .orElseThrow(unknownClientError(clientId));
+
+      final String password = Strings.nullToEmpty(client.getClientSecret());
+
+      final boolean accountEnabled = true;
+      final boolean accountNonExpired = true;
+      final boolean credentialsNonExpired = true;
+      final boolean accountNonLocked = true;
+
+      Collection authorities = Sets.newHashSet(client.getAuthorities());
+      authorities.add(ROLE_CLIENT);
+
+      return new User(clientId, password, accountEnabled, accountNonExpired, credentialsNonExpired,
+          accountNonLocked, authorities);
+
+    } catch (InvalidClientException e) {
+      throw unknownClientError(clientId).get();
+    }
+  }
+
+  @Override
+  public ClientDetailsEntityService getClientDetailsService() {
+
+    return clientService;
+  }
+
+}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/error/StartupError.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/error/StartupError.java
index 719b6f8ed..1d73864e3 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/error/StartupError.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/error/StartupError.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/expression/IamMethodSecurityExpressionHandler.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/expression/IamMethodSecurityExpressionHandler.java
index d1f021ac4..d6b94556a 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/expression/IamMethodSecurityExpressionHandler.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/expression/IamMethodSecurityExpressionHandler.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -26,6 +26,7 @@
 import it.infn.mw.iam.api.requests.GroupRequestUtils;
 import it.infn.mw.iam.core.userinfo.OAuth2AuthenticationScopeResolver;
 
+@SuppressWarnings("deprecation")
 @Component
 public class IamMethodSecurityExpressionHandler extends OAuth2MethodSecurityExpressionHandler {
 
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/expression/IamSecurityExpressionMethods.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/expression/IamSecurityExpressionMethods.java
index b3bb02688..91fba8ef3 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/expression/IamSecurityExpressionMethods.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/expression/IamSecurityExpressionMethods.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -34,6 +34,7 @@
 import it.infn.mw.iam.persistence.model.IamAccount;
 import it.infn.mw.iam.persistence.model.IamGroupRequest;
 
+@SuppressWarnings("deprecation")
 public class IamSecurityExpressionMethods {
 
   private final Authentication authentication;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/expression/IamWebSecurityExpressionHandler.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/expression/IamWebSecurityExpressionHandler.java
index 879e58d51..99b4d5fa8 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/expression/IamWebSecurityExpressionHandler.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/expression/IamWebSecurityExpressionHandler.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -26,6 +26,7 @@
 import it.infn.mw.iam.api.requests.GroupRequestUtils;
 import it.infn.mw.iam.core.userinfo.OAuth2AuthenticationScopeResolver;
 
+@SuppressWarnings("deprecation")
 @Component
 public class IamWebSecurityExpressionHandler extends OAuth2WebSecurityExpressionHandler {
 
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/group/DefaultIamGroupService.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/group/DefaultIamGroupService.java
index d229843b1..ce9c73b7a 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/group/DefaultIamGroupService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/group/DefaultIamGroupService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -111,7 +111,7 @@ public IamGroup deleteGroup(IamGroup g) {
 
     Long membersCount = groupRepo.countGroupMembersByGroupUuid(g.getUuid());
 
-    if (membersCount > 0L || g.getChildrenGroups().size() > 0) {
+    if (membersCount > 0L || !g.getChildrenGroups().isEmpty()) {
       throw new InvalidGroupOperationError("Group is not empty");
     }
 
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/group/IamGroupService.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/group/IamGroupService.java
index a7be676b2..aa2ec1838 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/group/IamGroupService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/group/IamGroupService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/group/error/IamGroupError.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/group/error/IamGroupError.java
index 670de3bca..54924d503 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/group/error/IamGroupError.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/group/error/IamGroupError.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/group/error/InvalidGroupOperationError.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/group/error/InvalidGroupOperationError.java
index 65e47e78e..2eac9ac24 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/group/error/InvalidGroupOperationError.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/group/error/InvalidGroupOperationError.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/group/error/NoSuchGroupError.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/group/error/NoSuchGroupError.java
index 068a50cd3..d353e2d37 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/group/error/NoSuchGroupError.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/group/error/NoSuchGroupError.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/lifecycle/ExpiredAccountsHandler.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/lifecycle/ExpiredAccountsHandler.java
index f88005142..eb6042de3 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/lifecycle/ExpiredAccountsHandler.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/lifecycle/ExpiredAccountsHandler.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -43,7 +43,9 @@
 public class ExpiredAccountsHandler implements Runnable {
 
   public enum AccountLifecycleStatus {
-    OK, PENDING_SUSPENSION, PENDING_REMOVAL
+    OK,
+    PENDING_SUSPENSION,
+    PENDING_REMOVAL
   }
 
   public static final String LIFECYCLE_TIMESTAMP_LABEL = "lifecycle.timestamp";
@@ -155,7 +157,7 @@ public void handleExpiredAccounts() {
     checkTime = clock.instant();
     Date now = Date.from(checkTime);
 
-    Pageable pageRequest = new PageRequest(0, PAGE_SIZE, new Sort(Direction.ASC, "endTime"));
+    Pageable pageRequest = PageRequest.of(0, PAGE_SIZE, Sort.by(Direction.ASC, "endTime"));
 
     while (true) {
       Page expiredAccountsPage =
@@ -163,7 +165,7 @@ public void handleExpiredAccounts() {
       LOG.debug("expiredAccountsPage: {}", expiredAccountsPage);
 
       if (expiredAccountsPage.hasContent()) {
-        
+
         for (IamAccount expiredAccount : expiredAccountsPage.getContent()) {
           handleExpiredAccount(expiredAccount);
         }
@@ -176,7 +178,7 @@ public void handleExpiredAccounts() {
       pageRequest = expiredAccountsPage.nextPageable();
     }
 
-    // Removals must be handled separately, otherwise pagination breaks 
+    // Removals must be handled separately, otherwise pagination breaks
     for (IamAccount a : accountsScheduledForRemoval) {
       removeAccount(a);
     }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/lifecycle/cern/CernHrLifecycleHandler.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/lifecycle/cern/CernHrLifecycleHandler.java
index 560a88bff..0df639d94 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/lifecycle/cern/CernHrLifecycleHandler.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/lifecycle/cern/CernHrLifecycleHandler.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -247,7 +247,7 @@ public void handleAccount(IamAccount account) {
   @Override
   public void run() {
 
-    Pageable pageRequest = new PageRequest(0, cernProperties.getTask().getPageSize());
+    Pageable pageRequest = PageRequest.of(0, cernProperties.getTask().getPageSize());
 
     while (true) {
       Page accountsPage = accountRepo.findByLabelPrefixAndName(LABEL_CERN_PREFIX,
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/FormClientCredentialsAuthenticationFilter.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/FormClientCredentialsAuthenticationFilter.java
index 6f4394348..91f9e9c61 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/FormClientCredentialsAuthenticationFilter.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/FormClientCredentialsAuthenticationFilter.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/IamIntrospectionResultAssembler.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/IamIntrospectionResultAssembler.java
index e532b6464..53ea1234d 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/IamIntrospectionResultAssembler.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/IamIntrospectionResultAssembler.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/IamJWKSetCacheService.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/IamJWKSetCacheService.java
index 10f322e5a..02b89e1b7 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/IamJWKSetCacheService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/IamJWKSetCacheService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/IamOAuth2RequestFactory.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/IamOAuth2RequestFactory.java
index 910a1114e..40c3dd1da 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/IamOAuth2RequestFactory.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/IamOAuth2RequestFactory.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -41,6 +41,7 @@
 import it.infn.mw.iam.core.oauth.profile.JWTProfileResolver;
 import it.infn.mw.iam.core.oauth.scope.pdp.IamScopeFilter;
 
+@SuppressWarnings("deprecation")
 public class IamOAuth2RequestFactory extends ConnectOAuth2RequestFactory {
 
   public static final Logger LOG = LoggerFactory.getLogger(IamOAuth2RequestFactory.class);
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/assertion/IAMJWTBearerAuthenticationProvider.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/assertion/IAMJWTBearerAuthenticationProvider.java
new file mode 100644
index 000000000..fc5f9581d
--- /dev/null
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/assertion/IAMJWTBearerAuthenticationProvider.java
@@ -0,0 +1,233 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.infn.mw.iam.core.oauth.assertion;
+
+import static java.lang.String.format;
+import static java.util.Objects.isNull;
+
+import java.text.ParseException;
+import java.time.Clock;
+import java.time.Instant;
+import java.util.Date;
+import java.util.HashSet;
+import java.util.Optional;
+import java.util.Set;
+
+import org.mitre.jwt.signer.service.JWTSigningAndValidationService;
+import org.mitre.jwt.signer.service.impl.ClientKeyCacheService;
+import org.mitre.oauth2.model.ClientDetailsEntity;
+import org.mitre.oauth2.model.ClientDetailsEntity.AuthMethod;
+import org.mitre.oauth2.service.ClientDetailsEntityService;
+import org.mitre.openid.connect.assertion.JWTBearerAssertionAuthenticationToken;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.security.authentication.AuthenticationProvider;
+import org.springframework.security.authentication.AuthenticationServiceException;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.AuthenticationException;
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.authority.SimpleGrantedAuthority;
+import org.springframework.security.core.userdetails.UsernameNotFoundException;
+
+import com.nimbusds.jose.JWSAlgorithm;
+import com.nimbusds.jwt.JWT;
+import com.nimbusds.jwt.JWTClaimsSet;
+import com.nimbusds.jwt.SignedJWT;
+
+import it.infn.mw.iam.config.IamProperties;
+
+public class IAMJWTBearerAuthenticationProvider implements AuthenticationProvider {
+
+  public static final Logger LOG =
+      LoggerFactory.getLogger(IAMJWTBearerAuthenticationProvider.class);
+
+  private static final GrantedAuthority ROLE_CLIENT = new SimpleGrantedAuthority("ROLE_CLIENT");
+
+  private static final int CLOCK_SKEW_IN_SECONDS = 300;
+
+  private static final String INVALID_SIGNATURE_ALGO = "Invalid signature algorithm: %s";
+
+  private final Clock clock;
+  private final ClientDetailsEntityService clientService;
+  private final ClientKeyCacheService validators;
+
+  private final String tokenEndpoint;
+
+  public IAMJWTBearerAuthenticationProvider(Clock clock, IamProperties iamProperties,
+      ClientDetailsEntityService clientService, ClientKeyCacheService validators) {
+
+    this.clock = clock;
+    this.clientService = clientService;
+    this.validators = validators;
+
+    if (iamProperties.getIssuer().endsWith("/")) {
+      tokenEndpoint = iamProperties.getIssuer() + "token";
+    } else {
+      tokenEndpoint = iamProperties.getIssuer() + "/token";
+    }
+
+  }
+
+  private String invalidSignatureAlgorithm(JWSAlgorithm alg) {
+    return String.format(INVALID_SIGNATURE_ALGO, alg.getName());
+  }
+
+  private void clientAuthMethodChecks(ClientDetailsEntity client, SignedJWT jws) {
+
+    if (client.getTokenEndpointAuthMethod() == null
+        || client.getTokenEndpointAuthMethod().equals(AuthMethod.NONE)
+        || client.getTokenEndpointAuthMethod().equals(AuthMethod.SECRET_BASIC)
+        || client.getTokenEndpointAuthMethod().equals(AuthMethod.SECRET_POST)) {
+
+      throw new AuthenticationServiceException(
+          "Client does not support JWT-based client autentication");
+    }
+
+    JWSAlgorithm alg = jws.getHeader().getAlgorithm();
+
+    if (client.getTokenEndpointAuthSigningAlg() != null
+        && !client.getTokenEndpointAuthSigningAlg().equals(alg)) {
+      invalidBearerAssertion(invalidSignatureAlgorithm(alg));
+    }
+
+    if (client.getTokenEndpointAuthMethod().equals(AuthMethod.PRIVATE_KEY)) {
+      if (!JWSAlgorithm.Family.SIGNATURE.contains(alg)) {
+        invalidBearerAssertion(invalidSignatureAlgorithm(alg));
+      }
+    } else if (client.getTokenEndpointAuthMethod().equals(AuthMethod.SECRET_JWT)
+        && !JWSAlgorithm.Family.HMAC_SHA.contains(alg)) {
+      invalidBearerAssertion(invalidSignatureAlgorithm(alg));
+    }
+  }
+
+  private void signatureChecks(ClientDetailsEntity client, SignedJWT jws) {
+    JWSAlgorithm alg = jws.getHeader().getAlgorithm();
+
+    JWTSigningAndValidationService validator =
+        Optional.ofNullable(validators.getValidator(client, alg))
+          .orElseThrow(() -> new AuthenticationServiceException(
+              format("Unable to resolve validator for client '%s' and algorithm '%s'",
+                  client.getClientId(), alg.getName())));
+
+    if (!validator.validateSignature(jws)) {
+      invalidBearerAssertion("invalid signature");
+    }
+  }
+
+  private void invalidBearerAssertion(String msg) {
+    throw new AuthenticationServiceException(
+        String.format("invalid jwt bearer assertion: %s", msg));
+  }
+
+  private void assertionChecks(ClientDetailsEntity client, SignedJWT jws) throws ParseException {
+
+    JWTClaimsSet jwtClaims = jws.getJWTClaimsSet();
+
+    if (isNull(jwtClaims.getIssuer())) {
+      invalidBearerAssertion("issuer is null");
+    } else if (!jwtClaims.getIssuer().equals(client.getClientId())) {
+      invalidBearerAssertion("issuer does not match client id");
+    }
+
+    if (isNull(jwtClaims.getExpirationTime())) {
+      invalidBearerAssertion("expiration time not set");
+    }
+
+    Instant nowSkewed = clock.instant().minusSeconds(CLOCK_SKEW_IN_SECONDS);
+
+    if (Date.from(nowSkewed).after(jwtClaims.getExpirationTime())) {
+      invalidBearerAssertion("expired assertion token");
+    }
+
+    if (!isNull(jwtClaims.getNotBeforeTime())) {
+
+      nowSkewed = clock.instant().plusSeconds(CLOCK_SKEW_IN_SECONDS);
+      if (Date.from(nowSkewed).before(jwtClaims.getNotBeforeTime())) {
+        invalidBearerAssertion("assertion is not yet valid");
+      }
+    }
+
+    if (!isNull(jwtClaims.getIssueTime())) {
+      nowSkewed = clock.instant().plusSeconds(CLOCK_SKEW_IN_SECONDS);
+      if (Date.from(nowSkewed).before(jwtClaims.getIssueTime())) {
+        invalidBearerAssertion("assertion was issued in the future");
+      }
+    }
+
+    if (isNull(jwtClaims.getAudience())) {
+      invalidBearerAssertion("assertion audience is null");
+    } else {
+      if (!jwtClaims.getAudience().contains(tokenEndpoint)) {
+        invalidBearerAssertion("invalid audience");
+      }
+    }
+
+    if (isNull(jwtClaims.getJWTID())) {
+      invalidBearerAssertion("jti is null");
+      // no further jti validation is implemented currently
+    }
+  }
+
+  @Override
+  public Authentication authenticate(Authentication authentication) throws AuthenticationException {
+
+    JWTBearerAssertionAuthenticationToken jwtAuth =
+        (JWTBearerAssertionAuthenticationToken) authentication;
+
+    ClientDetailsEntity client = clientService.loadClientByClientId(jwtAuth.getName());
+
+    if (isNull(client)) {
+      throw new UsernameNotFoundException("Unknown client: " + jwtAuth.getName());
+    }
+
+    try {
+
+
+      final JWT jwt = jwtAuth.getJwt();
+
+      if (isNull(jwt)) {
+        invalidBearerAssertion("Null JWT in authentication token");
+      }
+
+      if (!(jwt instanceof SignedJWT)) {
+        invalidBearerAssertion("Unsupported JWT type: " + jwt.getClass().getName());
+      }
+
+      SignedJWT jws = (SignedJWT) jwt;
+
+      clientAuthMethodChecks(client, jws);
+
+      signatureChecks(client, jws);
+
+      assertionChecks(client, jws);
+
+      Set authorities = new HashSet<>(client.getAuthorities());
+      authorities.add(ROLE_CLIENT);
+
+      return new JWTBearerAssertionAuthenticationToken(jwt, authorities);
+
+    } catch (ParseException e) {
+      throw new AuthenticationServiceException("JWT parse error:" + e.getMessage(), e);
+    }
+  }
+
+
+  @Override
+  public boolean supports(Class authentication) {
+    return JWTBearerAssertionAuthenticationToken.class.isAssignableFrom(authentication);
+  }
+
+}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/attributes/AttributeMapHelper.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/attributes/AttributeMapHelper.java
index d13b63ad0..f06ede2f1 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/attributes/AttributeMapHelper.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/attributes/AttributeMapHelper.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/exchange/AnyClientMatcher.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/exchange/AnyClientMatcher.java
index 347f2874d..f5618965e 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/exchange/AnyClientMatcher.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/exchange/AnyClientMatcher.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -17,6 +17,7 @@
 
 import org.springframework.security.oauth2.provider.ClientDetails;
 
+@SuppressWarnings("deprecation")
 public class AnyClientMatcher implements ClientMatcher {
 
   @Override
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/exchange/ByIdClientMatcher.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/exchange/ByIdClientMatcher.java
index b0cc6eb08..8f15dda58 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/exchange/ByIdClientMatcher.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/exchange/ByIdClientMatcher.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -20,6 +20,7 @@
 
 import org.springframework.security.oauth2.provider.ClientDetails;
 
+@SuppressWarnings("deprecation")
 public class ByIdClientMatcher implements ClientMatcher {
 
   final String clientId;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/exchange/ByScopeClientMatcher.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/exchange/ByScopeClientMatcher.java
index 27a290a85..634883568 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/exchange/ByScopeClientMatcher.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/exchange/ByScopeClientMatcher.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -20,6 +20,7 @@
 
 import org.springframework.security.oauth2.provider.ClientDetails;
 
+@SuppressWarnings("deprecation")
 public class ByScopeClientMatcher implements ClientMatcher {
 
   final String scope;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/exchange/ClientMatcher.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/exchange/ClientMatcher.java
index dd56e9278..644cb7db8 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/exchange/ClientMatcher.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/exchange/ClientMatcher.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -17,6 +17,7 @@
 
 import org.springframework.security.oauth2.provider.ClientDetails;
 
+@SuppressWarnings("deprecation")
 public interface ClientMatcher {
   
   boolean matchesClient(ClientDetails client);
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/exchange/ClientMatcherFactory.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/exchange/ClientMatcherFactory.java
index d0a63ed0a..887fa532f 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/exchange/ClientMatcherFactory.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/exchange/ClientMatcherFactory.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/exchange/DefaultTokenExchangePdp.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/exchange/DefaultTokenExchangePdp.java
index 186d8a18a..4fddda863 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/exchange/DefaultTokenExchangePdp.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/exchange/DefaultTokenExchangePdp.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -40,6 +40,7 @@
 import it.infn.mw.iam.persistence.model.IamTokenExchangePolicyEntity;
 import it.infn.mw.iam.persistence.repository.IamTokenExchangePolicyRepository;
 
+@SuppressWarnings("deprecation")
 @Service
 public class DefaultTokenExchangePdp implements TokenExchangePdp, InitializingBean {
 
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/exchange/ScopeExchangePolicy.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/exchange/ScopeExchangePolicy.java
index ce80771da..3212fbc53 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/exchange/ScopeExchangePolicy.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/exchange/ScopeExchangePolicy.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/exchange/TokenExchangePdp.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/exchange/TokenExchangePdp.java
index 045a36be0..10f36efd2 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/exchange/TokenExchangePdp.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/exchange/TokenExchangePdp.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -18,6 +18,7 @@
 import org.springframework.security.oauth2.provider.ClientDetails;
 import org.springframework.security.oauth2.provider.TokenRequest;
 
+@SuppressWarnings("deprecation")
 public interface TokenExchangePdp {
 
   public void reloadPolicies();
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/exchange/TokenExchangePdpResult.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/exchange/TokenExchangePdpResult.java
index 0c6845763..3e192d5dc 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/exchange/TokenExchangePdpResult.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/exchange/TokenExchangePdpResult.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/exchange/TokenExchangePolicy.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/exchange/TokenExchangePolicy.java
index a7630e52a..5fdfbf124 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/exchange/TokenExchangePolicy.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/exchange/TokenExchangePolicy.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -28,6 +28,7 @@
 import it.infn.mw.iam.persistence.model.IamTokenExchangeScopePolicy;
 import it.infn.mw.iam.persistence.model.PolicyRule;
 
+@SuppressWarnings("deprecation")
 public class TokenExchangePolicy {
   private final Long id;
 
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/granters/IamDeviceCodeTokenGranter.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/granters/IamDeviceCodeTokenGranter.java
index 003be71c4..d226f496c 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/granters/IamDeviceCodeTokenGranter.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/granters/IamDeviceCodeTokenGranter.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -30,6 +30,7 @@
 import org.springframework.security.oauth2.provider.token.AbstractTokenGranter;
 import org.springframework.security.oauth2.provider.token.AuthorizationServerTokenServices;
 
+@SuppressWarnings("deprecation")
 public class IamDeviceCodeTokenGranter extends AbstractTokenGranter {
 
   public static final String GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/granters/IamResourceOwnerPasswordTokenGranter.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/granters/IamResourceOwnerPasswordTokenGranter.java
index 51c31b856..5e7d00273 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/granters/IamResourceOwnerPasswordTokenGranter.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/granters/IamResourceOwnerPasswordTokenGranter.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -33,6 +33,7 @@
 import it.infn.mw.iam.api.aup.AUPSignatureCheckService;
 import it.infn.mw.iam.persistence.model.IamAccount;
 
+@SuppressWarnings("deprecation")
 public class IamResourceOwnerPasswordTokenGranter extends ResourceOwnerPasswordTokenGranter {
 
   private AUPSignatureCheckService signatureCheckService;
@@ -59,7 +60,7 @@ protected OAuth2Authentication getOAuth2Authentication(ClientDetails client,
 
     if (user.isPresent() && signatureCheckService.needsAupSignature(user.get())) {
       throw new InvalidGrantException(
-          format("User '%s' needs to sign AUP for this organization in order to proceed.",
+          format("User %s needs to sign AUP for this organization in order to proceed.",
               user.get().getUsername()));
     }
 
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/granters/TokenExchangeTokenGranter.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/granters/TokenExchangeTokenGranter.java
index bca2a4eed..c4d043f2a 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/granters/TokenExchangeTokenGranter.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/granters/TokenExchangeTokenGranter.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -49,6 +49,7 @@
 import it.infn.mw.iam.core.oauth.exchange.TokenExchangePdpResult;
 import it.infn.mw.iam.persistence.model.IamAccount;
 
+@SuppressWarnings("deprecation")
 public class TokenExchangeTokenGranter extends AbstractTokenGranter {
 
   public static final Logger LOG = LoggerFactory.getLogger(TokenExchangeTokenGranter.class);
@@ -160,7 +161,7 @@ protected OAuth2Authentication getOAuth2Authentication(final ClientDetails actor
 
       if (account.isPresent() && signatureCheckService.needsAupSignature(account.get())) {
         throw new InvalidGrantException(
-            format("User '%s' needs to sign AUP for this organization " + "in order to proceed.",
+            format("User %s needs to sign AUP for this organization " + "in order to proceed.",
                 account.get().getUsername()));
       }
 
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/IDTokenCustomizer.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/IDTokenCustomizer.java
index daf9b6bb3..a69ff5841 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/IDTokenCustomizer.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/IDTokenCustomizer.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -24,6 +24,7 @@
 import it.infn.mw.iam.persistence.model.IamAccount;
 
 @FunctionalInterface
+@SuppressWarnings("deprecation")
 public interface IDTokenCustomizer {
   void customizeIdTokenClaims(Builder idClaims, ClientDetailsEntity client,
       OAuth2Request request, String sub, OAuth2AccessTokenEntity accessToken, IamAccount account);
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/IamAccountIDTokenCustomizer.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/IamAccountIDTokenCustomizer.java
index 25dff4330..3610f71f1 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/IamAccountIDTokenCustomizer.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/IamAccountIDTokenCustomizer.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -23,8 +23,10 @@
 
 import it.infn.mw.iam.persistence.model.IamAccount;
 
+@SuppressWarnings("deprecation")
 public interface IamAccountIDTokenCustomizer {
 
+
   void customizeIdTokenClaims(Builder idClaims, ClientDetailsEntity client, OAuth2Request request,
       IamAccount account, OAuth2AccessTokenEntity accessToken);
 
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/IamOIDCTokenService.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/IamOIDCTokenService.java
index 804d42fd8..926b933e6 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/IamOIDCTokenService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/IamOIDCTokenService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -33,6 +33,7 @@
 
 @Service
 @Primary
+@SuppressWarnings("deprecation")
 public class IamOIDCTokenService extends DefaultOIDCTokenService {
 
 
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/IamTokenEnhancer.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/IamTokenEnhancer.java
index 9f833129b..42a2674da 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/IamTokenEnhancer.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/IamTokenEnhancer.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -39,6 +39,7 @@
 
 import it.infn.mw.iam.core.oauth.scope.pdp.IamScopeFilter;
 
+@SuppressWarnings("deprecation")
 public class IamTokenEnhancer extends ConnectTokenEnhancer {
 
   @Autowired
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/IntrospectionResultHelper.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/IntrospectionResultHelper.java
index ef4444a77..7af6e2aa8 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/IntrospectionResultHelper.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/IntrospectionResultHelper.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/JWTAccessTokenBuilder.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/JWTAccessTokenBuilder.java
index c61ca18b3..e3f838481 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/JWTAccessTokenBuilder.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/JWTAccessTokenBuilder.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -24,6 +24,7 @@
 import com.nimbusds.jwt.JWTClaimsSet;
 
 @FunctionalInterface
+@SuppressWarnings("deprecation")
 public interface JWTAccessTokenBuilder {
 
   JWTClaimsSet buildAccessToken(OAuth2AccessTokenEntity token, OAuth2Authentication authentication,
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/JWTProfile.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/JWTProfile.java
index e624678b3..f8bf7df96 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/JWTProfile.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/JWTProfile.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/JWTProfileResolver.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/JWTProfileResolver.java
index e24daf824..8f4102bda 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/JWTProfileResolver.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/JWTProfileResolver.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/RequestValidator.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/RequestValidator.java
index 1387be88e..27c92848f 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/RequestValidator.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/RequestValidator.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -17,6 +17,7 @@
 
 import org.springframework.security.oauth2.provider.OAuth2Request;
 
+@SuppressWarnings("deprecation")
 public interface RequestValidator {
 
   public void validateRequest(OAuth2Request request);
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/ScopeAwareProfileResolver.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/ScopeAwareProfileResolver.java
index 68de9b82f..ac03dc430 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/ScopeAwareProfileResolver.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/ScopeAwareProfileResolver.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -28,6 +28,7 @@
 import org.springframework.security.oauth2.provider.ClientDetails;
 import org.springframework.security.oauth2.provider.ClientDetailsService;
 
+@SuppressWarnings("deprecation")
 public class ScopeAwareProfileResolver implements JWTProfileResolver {
 
   public static final String AARC_PROFILE_ID = "aarc";
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/UserInfoHelper.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/UserInfoHelper.java
index e38f52b61..96a204bcf 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/UserInfoHelper.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/UserInfoHelper.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -18,6 +18,7 @@
 import org.mitre.openid.connect.model.UserInfo;
 import org.springframework.security.oauth2.provider.OAuth2Authentication;
 
+@SuppressWarnings("deprecation")
 public interface UserInfoHelper {
   
   UserInfo resolveUserInfo(OAuth2Authentication authentication);
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/aarc/AarcClaimValueHelper.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/aarc/AarcClaimValueHelper.java
index b7fe4a6d9..d081c429b 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/aarc/AarcClaimValueHelper.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/aarc/AarcClaimValueHelper.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,14 +16,11 @@
 package it.infn.mw.iam.core.oauth.profile.aarc;
 
 import java.util.HashSet;
-import java.util.Optional;
 import java.util.Set;
 
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.stereotype.Component;
 
-import com.google.common.collect.ImmutableSet;
-
 import it.infn.mw.iam.persistence.model.IamGroup;
 import it.infn.mw.iam.persistence.model.IamUserInfo;
 
@@ -31,7 +28,7 @@
 public class AarcClaimValueHelper {
 
   public static final Set ADDITIONAL_CLAIMS =
-      ImmutableSet.of("eduperson_scoped_affiliation", "eduperson_entitlement");
+      Set.of("eduperson_scoped_affiliation", "eduperson_entitlement");
 
   @Value("${iam.host}")
   String iamHost;
@@ -60,29 +57,13 @@ public Object getClaimValueFromUserInfo(String claim, IamUserInfo info) {
   public Set resolveGroups(IamUserInfo userInfo) {
 
     Set encodedGroups = new HashSet<>();
-    userInfo
-      .getGroups()
-      .forEach(g -> encodedGroups.add(encodeGroup(g)));
+    userInfo.getGroups().forEach(g -> encodedGroups.add(encodeGroup(g)));
     return encodedGroups;
   }
 
   private String encodeGroup(IamGroup group) {
-
-    StringBuilder urn = new StringBuilder();
-
-    urn.append(String.format("urn:%s:group:", urnNamespace));
-
-    StringBuilder groupHierarchy = new StringBuilder(group.getName());
-    Optional parent = Optional.ofNullable(group.getParentGroup());
-    while (parent.isPresent()) {
-      groupHierarchy.insert(0, parent.get().getName() + ":");
-      parent = Optional.ofNullable(parent.get().getParentGroup());
-    }
-    urn.append(groupHierarchy.toString());
-
-    urn.append(String.format("#%s", iamHost));
-
-    return urn.toString();
+    String encodedGroupName = group.getName().replaceAll("/", ":");
+    return String.format("urn:%s:group:%s#%s", urnNamespace, encodedGroupName, iamHost);
   }
 
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/aarc/AarcJWTProfile.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/aarc/AarcJWTProfile.java
index a922ac6da..429d571dc 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/aarc/AarcJWTProfile.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/aarc/AarcJWTProfile.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -24,6 +24,7 @@
 import it.infn.mw.iam.core.oauth.profile.RequestValidator;
 import it.infn.mw.iam.core.oauth.profile.UserInfoHelper;
 
+@SuppressWarnings("deprecation")
 public class AarcJWTProfile implements JWTProfile, RequestValidator {
 
   public static final String PROFILE_NAME = "AARC JWT profile";
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/aarc/AarcJWTProfileAccessTokenBuilder.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/aarc/AarcJWTProfileAccessTokenBuilder.java
index 32b562e2b..b7750c669 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/aarc/AarcJWTProfileAccessTokenBuilder.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/aarc/AarcJWTProfileAccessTokenBuilder.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -33,6 +33,7 @@
 import it.infn.mw.iam.core.oauth.profile.common.BaseAccessTokenBuilder;
 import it.infn.mw.iam.persistence.repository.UserInfoAdapter;
 
+@SuppressWarnings("deprecation")
 public class AarcJWTProfileAccessTokenBuilder extends BaseAccessTokenBuilder {
 
   protected final ScopeClaimTranslationService scopeClaimConverter;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/aarc/AarcJWTProfileIdTokenCustomizer.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/aarc/AarcJWTProfileIdTokenCustomizer.java
index 7c4701d01..96dbd28d2 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/aarc/AarcJWTProfileIdTokenCustomizer.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/aarc/AarcJWTProfileIdTokenCustomizer.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -32,6 +32,7 @@
 import it.infn.mw.iam.persistence.model.IamUserInfo;
 import it.infn.mw.iam.persistence.repository.IamAccountRepository;
 
+@SuppressWarnings("deprecation")
 public class AarcJWTProfileIdTokenCustomizer extends BaseIdTokenCustomizer {
 
   protected final ScopeClaimTranslationService scopeClaimConverter;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/aarc/AarcJWTProfileTokenIntrospectionHelper.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/aarc/AarcJWTProfileTokenIntrospectionHelper.java
index 7eee1000b..d5335d913 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/aarc/AarcJWTProfileTokenIntrospectionHelper.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/aarc/AarcJWTProfileTokenIntrospectionHelper.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/aarc/AarcJWTProfileUserinfoHelper.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/aarc/AarcJWTProfileUserinfoHelper.java
index 3e3af36e6..18f8ef80b 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/aarc/AarcJWTProfileUserinfoHelper.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/aarc/AarcJWTProfileUserinfoHelper.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -27,6 +27,7 @@
 import it.infn.mw.iam.persistence.model.IamUserInfo;
 import it.infn.mw.iam.persistence.repository.UserInfoAdapter;
 
+@SuppressWarnings("deprecation")
 public class AarcJWTProfileUserinfoHelper extends BaseUserinfoHelper {
 
   protected final AarcClaimValueHelper claimValueHelper;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/common/BaseAccessTokenBuilder.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/common/BaseAccessTokenBuilder.java
index 787112491..031e4c974 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/common/BaseAccessTokenBuilder.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/common/BaseAccessTokenBuilder.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -43,6 +43,7 @@
 import it.infn.mw.iam.config.IamProperties;
 import it.infn.mw.iam.core.oauth.profile.JWTAccessTokenBuilder;
 
+@SuppressWarnings("deprecation")
 public abstract class BaseAccessTokenBuilder implements JWTAccessTokenBuilder {
 
   public static final Logger LOG = LoggerFactory.getLogger(BaseAccessTokenBuilder.class);
@@ -144,9 +145,8 @@ protected JWTClaimsSet.Builder baseJWTSetup(OAuth2AccessTokenEntity token,
       .subject(subject)
       .jwtID(UUID.randomUUID().toString());
 
-    if (!authentication.isClientOnly()) {
-      builder.claim(CLIENT_ID_CLAIM_NAME, token.getClient().getClientId());
-    }
+
+    builder.claim(CLIENT_ID_CLAIM_NAME, token.getClient().getClientId());
 
     String audience = null;
 
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/common/BaseIdTokenCustomizer.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/common/BaseIdTokenCustomizer.java
index 9fe811a73..a8caf865f 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/common/BaseIdTokenCustomizer.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/common/BaseIdTokenCustomizer.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -33,6 +33,7 @@
 import it.infn.mw.iam.persistence.model.IamLabel;
 import it.infn.mw.iam.persistence.repository.IamAccountRepository;
 
+@SuppressWarnings("deprecation")
 public abstract class BaseIdTokenCustomizer implements IDTokenCustomizer {
 
   private final IamAccountRepository accountRepo;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/common/BaseIntrospectionHelper.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/common/BaseIntrospectionHelper.java
index 094e93c4e..892e36b5f 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/common/BaseIntrospectionHelper.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/common/BaseIntrospectionHelper.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/common/BaseUserinfoHelper.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/common/BaseUserinfoHelper.java
index 172d2b9f2..874e437af 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/common/BaseUserinfoHelper.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/common/BaseUserinfoHelper.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -22,6 +22,7 @@
 import it.infn.mw.iam.config.IamProperties;
 import it.infn.mw.iam.core.oauth.profile.UserInfoHelper;
 
+@SuppressWarnings("deprecation")
 public abstract class BaseUserinfoHelper implements UserInfoHelper {
 
   private final IamProperties properties;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/iam/ClaimValueHelper.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/iam/ClaimValueHelper.java
index 1fe431a2b..4e07a50c7 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/iam/ClaimValueHelper.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/iam/ClaimValueHelper.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -21,8 +21,6 @@
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.stereotype.Component;
 
-import com.google.common.collect.ImmutableSet;
-
 import it.infn.mw.iam.core.oauth.attributes.AttributeMapHelper;
 import it.infn.mw.iam.persistence.model.IamGroup;
 import it.infn.mw.iam.persistence.model.IamUserInfo;
@@ -31,7 +29,7 @@
 public class ClaimValueHelper {
 
   public static final Set ADDITIONAL_CLAIMS =
-      ImmutableSet.of("name", "email", "preferred_username", "organisation_name", "groups", "attr");
+      Set.of("name", "email", "preferred_username", "organisation_name", "groups", "attr");
 
   @Value("${iam.organisation.name}")
   String organisationName;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/iam/IamJWTProfile.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/iam/IamJWTProfile.java
index 366333151..7d13d3db1 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/iam/IamJWTProfile.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/iam/IamJWTProfile.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -24,6 +24,7 @@
 import it.infn.mw.iam.core.oauth.profile.RequestValidator;
 import it.infn.mw.iam.core.oauth.profile.UserInfoHelper;
 
+@SuppressWarnings("deprecation")
 public class IamJWTProfile implements JWTProfile, RequestValidator {
 
   public static final String PROFILE_NAME = "IAM JWT profile";
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/iam/IamJWTProfileAccessTokenBuilder.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/iam/IamJWTProfileAccessTokenBuilder.java
index 03ae777ca..3962f1dd3 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/iam/IamJWTProfileAccessTokenBuilder.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/iam/IamJWTProfileAccessTokenBuilder.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -34,6 +34,7 @@
 import it.infn.mw.iam.core.oauth.profile.common.BaseAccessTokenBuilder;
 import it.infn.mw.iam.persistence.repository.UserInfoAdapter;
 
+@SuppressWarnings("deprecation")
 public class IamJWTProfileAccessTokenBuilder extends BaseAccessTokenBuilder {
 
   protected final ScopeClaimTranslationService scopeClaimConverter;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/iam/IamJWTProfileIdTokenCustomizer.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/iam/IamJWTProfileIdTokenCustomizer.java
index eaaaa01d8..1a753c901 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/iam/IamJWTProfileIdTokenCustomizer.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/iam/IamJWTProfileIdTokenCustomizer.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -32,6 +32,7 @@
 import it.infn.mw.iam.persistence.model.IamUserInfo;
 import it.infn.mw.iam.persistence.repository.IamAccountRepository;
 
+@SuppressWarnings("deprecation")
 public class IamJWTProfileIdTokenCustomizer extends BaseIdTokenCustomizer {
 
   protected final ScopeClaimTranslationService scopeClaimConverter;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/iam/IamJWTProfileTokenIntrospectionHelper.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/iam/IamJWTProfileTokenIntrospectionHelper.java
index 2445bee32..752e5e0ba 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/iam/IamJWTProfileTokenIntrospectionHelper.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/iam/IamJWTProfileTokenIntrospectionHelper.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/iam/IamJWTProfileUserinfoHelper.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/iam/IamJWTProfileUserinfoHelper.java
index f4cf929b1..0a0ec6244 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/iam/IamJWTProfileUserinfoHelper.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/iam/IamJWTProfileUserinfoHelper.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -29,6 +29,7 @@
 import it.infn.mw.iam.core.oauth.profile.common.BaseUserinfoHelper;
 import it.infn.mw.iam.core.userinfo.IamDecoratedUserInfo;
 
+@SuppressWarnings("deprecation")
 public class IamJWTProfileUserinfoHelper extends BaseUserinfoHelper {
 
   private final ExternalAuthenticationInfoProcessor extAuthnProcessor;
@@ -41,10 +42,8 @@ public IamJWTProfileUserinfoHelper(IamProperties props, UserInfoService userInfo
 
   @Override
   public UserInfo resolveUserInfo(OAuth2Authentication authentication) {
-    final String username = authentication.getName();
 
-    UserInfo ui = getUserInfoService().getByUsernameAndClientId(username,
-        authentication.getOAuth2Request().getClientId());
+    UserInfo ui = lookupUserinfo(authentication);
 
     if (isNull(ui)) {
       return null;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/wlcg/WLCGGroupHelper.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/wlcg/WLCGGroupHelper.java
index d99356e87..268aacebf 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/wlcg/WLCGGroupHelper.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/wlcg/WLCGGroupHelper.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -32,6 +32,7 @@
 import it.infn.mw.iam.persistence.model.IamLabel;
 import it.infn.mw.iam.persistence.model.IamUserInfo;
 
+@SuppressWarnings("deprecation")
 public class WLCGGroupHelper {
 
   public static final String WLCG_GROUP_REGEXP_STR = "wlcg\\.groups(?::((?:\\/[a-zA-Z0-9][a-zA-Z0-9_.-]*)+))?$";
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/wlcg/WLCGIdTokenCustomizer.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/wlcg/WLCGIdTokenCustomizer.java
index 75970aac9..eb3a2190f 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/wlcg/WLCGIdTokenCustomizer.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/wlcg/WLCGIdTokenCustomizer.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -34,6 +34,7 @@
 import it.infn.mw.iam.persistence.model.IamUserInfo;
 import it.infn.mw.iam.persistence.repository.IamAccountRepository;
 
+@SuppressWarnings("deprecation")
 public class WLCGIdTokenCustomizer extends IamJWTProfileIdTokenCustomizer {
 
   public static final String GROUPS_CLAIM = "groups";
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/wlcg/WLCGIntrospectionHelper.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/wlcg/WLCGIntrospectionHelper.java
index 8bc9bbdee..d2f27794d 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/wlcg/WLCGIntrospectionHelper.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/wlcg/WLCGIntrospectionHelper.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -27,6 +27,7 @@
 import it.infn.mw.iam.core.oauth.scope.matchers.ScopeMatcherRegistry;
 import it.infn.mw.iam.persistence.repository.UserInfoAdapter;
 
+
 public class WLCGIntrospectionHelper extends BaseIntrospectionHelper {
 
   private final WLCGGroupHelper groupHelper;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/wlcg/WLCGJWTProfile.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/wlcg/WLCGJWTProfile.java
index a2f2b363c..908d144bc 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/wlcg/WLCGJWTProfile.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/wlcg/WLCGJWTProfile.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -32,6 +32,7 @@
 import it.infn.mw.iam.core.oauth.scope.matchers.ScopeMatcherRegistry;
 import it.infn.mw.iam.persistence.repository.IamAccountRepository;
 
+@SuppressWarnings("deprecation")
 public class WLCGJWTProfile implements JWTProfile, RequestValidator {
 
   public static final String PROFILE_VERSION = "1.0";
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/wlcg/WLCGProfileAccessTokenBuilder.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/wlcg/WLCGProfileAccessTokenBuilder.java
index b22706a12..d096d0843 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/wlcg/WLCGProfileAccessTokenBuilder.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/wlcg/WLCGProfileAccessTokenBuilder.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -35,6 +35,7 @@
 import it.infn.mw.iam.core.oauth.profile.common.BaseAccessTokenBuilder;
 import it.infn.mw.iam.persistence.repository.UserInfoAdapter;
 
+@SuppressWarnings("deprecation")
 public class WLCGProfileAccessTokenBuilder extends BaseAccessTokenBuilder {
 
   public static final String WLCG_VER_CLAIM = "wlcg.ver";
@@ -73,17 +74,17 @@ public JWTClaimsSet buildAccessToken(OAuth2AccessTokenEntity token,
       if (!groupNames.isEmpty()) {
         builder.claim(WLCGGroupHelper.WLCG_GROUPS_SCOPE, groupNames);
       }
+
+      if (token.getScope().contains(ATTR_SCOPE)) {
+        builder.claim(ATTR_SCOPE, attributeHelper
+          .getAttributeMapFromUserInfo(((UserInfoAdapter) userInfo).getUserinfo()));
+      }
     }
 
     if (!hasAudienceRequest(authentication) && !hasRefreshTokenAudienceRequest(authentication)) {
       builder.audience(ALL_AUDIENCES_VALUE);
     }
 
-    if (token.getScope().contains(ATTR_SCOPE)) {
-      builder.claim(ATTR_SCOPE,
-          attributeHelper.getAttributeMapFromUserInfo(((UserInfoAdapter) userInfo).getUserinfo()));
-    }
-
     return builder.build();
   }
 
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/wlcg/WLCGUserInfoAdapter.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/wlcg/WLCGUserInfoAdapter.java
index c82802dfa..480100861 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/wlcg/WLCGUserInfoAdapter.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/wlcg/WLCGUserInfoAdapter.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -15,9 +15,15 @@
  */
 package it.infn.mw.iam.core.oauth.profile.wlcg;
 
+
+
+import static java.util.Objects.isNull;
+
 import org.mitre.openid.connect.model.UserInfo;
 
+import com.google.gson.JsonArray;
 import com.google.gson.JsonObject;
+import com.google.gson.JsonPrimitive;
 
 import it.infn.mw.iam.core.userinfo.DelegateUserInfoAdapter;
 
@@ -25,8 +31,11 @@ public class WLCGUserInfoAdapter extends DelegateUserInfoAdapter {
 
   private static final long serialVersionUID = 1L;
 
-  private WLCGUserInfoAdapter(UserInfo delegate) {
+  private final String[] resolvedGroups;
+
+  private WLCGUserInfoAdapter(UserInfo delegate, String[] resolvedGroups) {
     super(delegate);
+    this.resolvedGroups = resolvedGroups;
   }
 
   @Override
@@ -34,11 +43,24 @@ public JsonObject toJson() {
     JsonObject json = super.toJson();
 
     json.remove("groups");
+    json.remove("organisation_name");
+
+    if (!isNull(resolvedGroups)) {
+      JsonArray groups = new JsonArray();
+      for (String g : resolvedGroups) {
+        groups.add(new JsonPrimitive(g));
+      }
+      json.add("wlcg.groups", groups);
+    }
 
     return json;
   }
 
+  public static WLCGUserInfoAdapter forUserInfo(UserInfo delegate, String[] resolvedGroups) {
+    return new WLCGUserInfoAdapter(delegate, resolvedGroups);
+  }
+
   public static WLCGUserInfoAdapter forUserInfo(UserInfo delegate) {
-    return new WLCGUserInfoAdapter(delegate);
+    return new WLCGUserInfoAdapter(delegate, null);
   }
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/wlcg/WLCGUserinfoHelper.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/wlcg/WLCGUserinfoHelper.java
index ba3958517..339de2b7d 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/wlcg/WLCGUserinfoHelper.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/wlcg/WLCGUserinfoHelper.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -18,29 +18,68 @@
 import static it.infn.mw.iam.core.oauth.profile.wlcg.WLCGUserInfoAdapter.forUserInfo;
 import static java.util.Objects.isNull;
 
+import java.text.ParseException;
+import java.util.Optional;
+
 import org.mitre.openid.connect.model.UserInfo;
 import org.mitre.openid.connect.service.UserInfoService;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 import org.springframework.security.oauth2.provider.OAuth2Authentication;
+import org.springframework.security.oauth2.provider.authentication.OAuth2AuthenticationDetails;
+
+import com.nimbusds.jwt.JWT;
+import com.nimbusds.jwt.JWTParser;
 
 import it.infn.mw.iam.config.IamProperties;
 import it.infn.mw.iam.core.oauth.profile.common.BaseUserinfoHelper;
 
+@SuppressWarnings("deprecation")
 public class WLCGUserinfoHelper extends BaseUserinfoHelper {
 
+  public static final Logger LOG = LoggerFactory.getLogger(WLCGUserinfoHelper.class);
+
   public WLCGUserinfoHelper(IamProperties props, UserInfoService userInfoService) {
     super(props, userInfoService);
   }
 
+
+  private Optional resolveGroupsFromToken(OAuth2Authentication authentication) {
+    OAuth2AuthenticationDetails details = (OAuth2AuthenticationDetails) authentication.getDetails();
+
+    if (isNull(details) || isNull(details.getTokenValue())) {
+      return Optional.empty();
+    }
+
+    try {
+      JWT accessToken = JWTParser.parse(details.getTokenValue());
+      String[] resolvedGroups = accessToken.getJWTClaimsSet().getStringArrayClaim("wlcg.groups");
+
+      return Optional.ofNullable(resolvedGroups);
+
+    } catch (ParseException e) {
+      LOG.error("Error parsing access token: {}", e.getMessage(), e);
+      return Optional.empty();
+    }
+  }
+
   @Override
   public UserInfo resolveUserInfo(OAuth2Authentication authentication) {
-    
+
     UserInfo ui = lookupUserinfo(authentication);
 
     if (isNull(ui)) {
       return null;
     }
-    
-    return forUserInfo(ui);
+
+    Optional resolvedGroups = resolveGroupsFromToken(authentication);
+
+    if (resolvedGroups.isPresent()) {
+      return forUserInfo(ui, resolvedGroups.get());
+    } else {
+      return forUserInfo(ui);
+    }
+
   }
 
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/IamSystemScopeService.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/IamSystemScopeService.java
index dd1675dee..7f83355cf 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/IamSystemScopeService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/IamSystemScopeService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/matchers/DefaultScopeMatcherRegistry.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/matchers/DefaultScopeMatcherRegistry.java
index bba858938..e3ea10a5d 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/matchers/DefaultScopeMatcherRegistry.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/matchers/DefaultScopeMatcherRegistry.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -27,6 +27,7 @@
 import com.google.common.cache.LoadingCache;
 import com.google.common.collect.Sets;
 
+@SuppressWarnings("deprecation")
 public class DefaultScopeMatcherRegistry implements ScopeMatcherRegistry {
 
   public static final int DEFAULT_CACHE_SIZE = 10;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/matchers/RegexpScopeMatcher.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/matchers/RegexpScopeMatcher.java
index efa8899d4..b99502d95 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/matchers/RegexpScopeMatcher.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/matchers/RegexpScopeMatcher.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/matchers/ScopeMatcher.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/matchers/ScopeMatcher.java
index 43f303451..0eb59615c 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/matchers/ScopeMatcher.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/matchers/ScopeMatcher.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -17,4 +17,4 @@
 
 public interface ScopeMatcher {
   boolean matches(String scope);
-}
\ No newline at end of file
+}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/matchers/ScopeMatcherOAuthRequestValidator.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/matchers/ScopeMatcherOAuthRequestValidator.java
index 83ed10d35..975723737 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/matchers/ScopeMatcherOAuthRequestValidator.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/matchers/ScopeMatcherOAuthRequestValidator.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -27,6 +27,7 @@
 import com.google.common.cache.CacheLoader;
 import com.google.common.cache.LoadingCache;
 
+@SuppressWarnings("deprecation")
 public class ScopeMatcherOAuthRequestValidator implements OAuth2RequestValidator {
 
   public static final int DEFAULT_CACHE_SIZE = 10;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/matchers/ScopeMatcherRegistry.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/matchers/ScopeMatcherRegistry.java
index a349410a1..d24dadf73 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/matchers/ScopeMatcherRegistry.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/matchers/ScopeMatcherRegistry.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -19,6 +19,7 @@
 
 import org.springframework.security.oauth2.provider.ClientDetails;
 
+@SuppressWarnings("deprecation")
 public interface ScopeMatcherRegistry {
   Set findMatchersForClient(ClientDetails client);
   ScopeMatcher findMatcherForScope(String scope);
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/matchers/ScopeMatchersProperties.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/matchers/ScopeMatchersProperties.java
index 2bbb601f4..9a442d2c7 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/matchers/ScopeMatchersProperties.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/matchers/ScopeMatchersProperties.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -19,7 +19,7 @@
 
 import javax.validation.Valid;
 
-import org.hibernate.validator.constraints.NotBlank;
+import javax.validation.constraints.NotBlank;
 import org.springframework.boot.context.properties.ConfigurationProperties;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.validation.annotation.Validated;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/matchers/ScopeMatchersPropertiesParser.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/matchers/ScopeMatchersPropertiesParser.java
index 0b4d762ad..e59a4b34d 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/matchers/ScopeMatchersPropertiesParser.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/matchers/ScopeMatchersPropertiesParser.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/matchers/StringEqualsScopeMatcher.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/matchers/StringEqualsScopeMatcher.java
index d71deb95b..03e84d0ff 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/matchers/StringEqualsScopeMatcher.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/matchers/StringEqualsScopeMatcher.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/matchers/StructuredPathScopeMatcher.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/matchers/StructuredPathScopeMatcher.java
index 318a95370..eabf7fcc7 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/matchers/StructuredPathScopeMatcher.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/matchers/StructuredPathScopeMatcher.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/pdp/DefaultScopePolicyPDP.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/pdp/DefaultScopePolicyPDP.java
index 4f16a2386..92bee264c 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/pdp/DefaultScopePolicyPDP.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/pdp/DefaultScopePolicyPDP.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/pdp/IamNullScopeFilter.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/pdp/IamNullScopeFilter.java
index 022cef1ab..48f1770c1 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/pdp/IamNullScopeFilter.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/pdp/IamNullScopeFilter.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/pdp/IamPDPScopeFilter.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/pdp/IamPDPScopeFilter.java
index 0235e48a8..68563bc6b 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/pdp/IamPDPScopeFilter.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/pdp/IamPDPScopeFilter.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -27,6 +27,7 @@
 import it.infn.mw.iam.persistence.model.IamAccount;
 import it.infn.mw.iam.persistence.repository.IamAccountRepository;
 
+@SuppressWarnings("deprecation")
 @Component
 @ConditionalOnProperty(name = "iam.enableScopeAuthz", havingValue = "true")
 public class IamPDPScopeFilter implements IamScopeFilter {
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/pdp/IamScopeFilter.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/pdp/IamScopeFilter.java
index 9e0954e98..2ff2ad5c9 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/pdp/IamScopeFilter.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/pdp/IamScopeFilter.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -24,4 +24,4 @@ public interface IamScopeFilter {
   
   public void filterScopes(Set scopes, Authentication authn);
 
-}
\ No newline at end of file
+}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/pdp/ScopePolicyPDP.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/pdp/ScopePolicyPDP.java
index 1a7fbf62c..d6dc4aa9b 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/pdp/ScopePolicyPDP.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/scope/pdp/ScopePolicyPDP.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oidc/IamClientValidationService.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oidc/IamClientValidationService.java
index 92fde8eda..37d1dcd70 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oidc/IamClientValidationService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oidc/IamClientValidationService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/time/SystemTimeProvider.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/time/SystemTimeProvider.java
index eca38aad3..11604d3f5 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/time/SystemTimeProvider.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/time/SystemTimeProvider.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/time/TimeProvider.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/time/TimeProvider.java
index 4ec7bb675..02171541c 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/time/TimeProvider.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/time/TimeProvider.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/DefaultIamAccountService.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/DefaultIamAccountService.java
index d352fb6a0..ec1d90acc 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/DefaultIamAccountService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/DefaultIamAccountService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/IamAccountService.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/IamAccountService.java
index 372481368..d608893ea 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/IamAccountService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/IamAccountService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/CredentialAlreadyBoundException.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/CredentialAlreadyBoundException.java
index 8d6089ade..03e4388f6 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/CredentialAlreadyBoundException.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/CredentialAlreadyBoundException.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/IamAccountException.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/IamAccountException.java
index b1a4f6ea3..f19156681 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/IamAccountException.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/IamAccountException.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/InvalidCredentialException.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/InvalidCredentialException.java
index 58aced943..d0aeb27bd 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/InvalidCredentialException.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/InvalidCredentialException.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/UserAlreadyExistsException.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/UserAlreadyExistsException.java
index 2a59c5841..c95117afd 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/UserAlreadyExistsException.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/UserAlreadyExistsException.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/userinfo/AarcDecoratedUserInfo.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/userinfo/AarcDecoratedUserInfo.java
index e143cefd2..ffd8c3af1 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/userinfo/AarcDecoratedUserInfo.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/userinfo/AarcDecoratedUserInfo.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/userinfo/AarcUserInfo.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/userinfo/AarcUserInfo.java
index b79e2064d..7af3159d8 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/userinfo/AarcUserInfo.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/userinfo/AarcUserInfo.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/userinfo/DecoratedUserInfo.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/userinfo/DecoratedUserInfo.java
index 219fdd57b..ae79a7404 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/userinfo/DecoratedUserInfo.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/userinfo/DecoratedUserInfo.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/userinfo/DefaultOAuth2AuthenticationScopeResolver.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/userinfo/DefaultOAuth2AuthenticationScopeResolver.java
index 8ff00f679..abca42161 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/userinfo/DefaultOAuth2AuthenticationScopeResolver.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/userinfo/DefaultOAuth2AuthenticationScopeResolver.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -29,6 +29,7 @@
 import it.infn.mw.iam.api.scim.exception.IllegalArgumentException;
 
 @Component
+@SuppressWarnings("deprecation")
 public class DefaultOAuth2AuthenticationScopeResolver implements OAuth2AuthenticationScopeResolver {
 
   private final OAuth2TokenRepository tokenRepo;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/userinfo/DelegateUserInfoAdapter.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/userinfo/DelegateUserInfoAdapter.java
index 093dd646f..76b53aa8a 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/userinfo/DelegateUserInfoAdapter.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/userinfo/DelegateUserInfoAdapter.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/userinfo/IamDecoratedUserInfo.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/userinfo/IamDecoratedUserInfo.java
index 7c5c5d43d..3e8777695 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/userinfo/IamDecoratedUserInfo.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/userinfo/IamDecoratedUserInfo.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/userinfo/IamScopeClaimTranslationService.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/userinfo/IamScopeClaimTranslationService.java
index 808396fc0..f6c0db1f7 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/userinfo/IamScopeClaimTranslationService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/userinfo/IamScopeClaimTranslationService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -41,6 +41,7 @@
 import static it.infn.mw.iam.core.userinfo.UserInfoClaim.SUB;
 import static it.infn.mw.iam.core.userinfo.UserInfoClaim.UPDATED_AT;
 import static it.infn.mw.iam.core.userinfo.UserInfoClaim.WEBSITE;
+import static it.infn.mw.iam.core.userinfo.UserInfoClaim.WLCG_GROUPS;
 import static it.infn.mw.iam.core.userinfo.UserInfoClaim.ZONEINFO;
 
 import java.util.EnumSet;
@@ -70,6 +71,7 @@ public class IamScopeClaimTranslationService implements ScopeClaimTranslationSer
   public static final String EDUPERSON_ENTITLEMENT_SCOPE = "eduperson_entitlement";
   public static final String ATTR_SCOPE = "attr";
   public static final String SSH_KEYS_SCOPE = "ssh-keys";
+  public static final String WLCG_GROUPS_SCOPE = "wlcg.groups";
 
   protected static final Set PROFILE_CLAIMS = EnumSet.of(NAME, PREFERRED_USERNAME,
       GIVEN_NAME, FAMILY_NAME, MIDDLE_NAME, NICKNAME, PROFILE, PICTURE, WEBSITE, GENDER, ZONEINFO,
@@ -90,10 +92,11 @@ public IamScopeClaimTranslationService() {
     mapScopeToClaim(EDUPERSON_ENTITLEMENT_SCOPE, EDUPERSON_ENTITLEMENT);
     mapScopeToClaim(ATTR_SCOPE, ATTR);
     mapScopeToClaim(SSH_KEYS_SCOPE, SSH_KEYS);
+    mapScopeToClaim(WLCG_GROUPS_SCOPE, WLCG_GROUPS);
   }
 
   private void mapScopeToClaim(String scope, UserInfoClaim claim) {
-    scopesToClaims.put(scope, claim.name().toLowerCase());
+    scopesToClaims.put(scope, claim.getClaimName());
   }
 
   private void mapScopeToClaim(String scope, Set claimSet) {
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/userinfo/IamUserInfoEndpoint.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/userinfo/IamUserInfoEndpoint.java
index 4b78a9909..271624d60 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/userinfo/IamUserInfoEndpoint.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/userinfo/IamUserInfoEndpoint.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -39,6 +39,7 @@
 import it.infn.mw.iam.core.oauth.profile.JWTProfile;
 import it.infn.mw.iam.core.oauth.profile.JWTProfileResolver;
 
+@SuppressWarnings("deprecation")
 @Controller
 @RequestMapping("/userinfo")
 public class IamUserInfoEndpoint {
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/userinfo/IamUserInfoInterceptor.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/userinfo/IamUserInfoInterceptor.java
new file mode 100644
index 000000000..785bb3190
--- /dev/null
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/userinfo/IamUserInfoInterceptor.java
@@ -0,0 +1,92 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.infn.mw.iam.core.userinfo;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.mitre.openid.connect.model.UserInfo;
+import org.mitre.openid.connect.service.UserInfoService;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.security.authentication.AuthenticationTrustResolver;
+import org.springframework.security.authentication.AuthenticationTrustResolverImpl;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.security.oauth2.provider.OAuth2Authentication;
+import org.springframework.web.servlet.AsyncHandlerInterceptor;
+import org.springframework.web.servlet.HandlerInterceptor;
+
+import com.google.gson.Gson;
+import com.google.gson.GsonBuilder;
+import com.google.gson.JsonPrimitive;
+import com.google.gson.JsonSerializer;
+
+@SuppressWarnings("deprecation")
+public class IamUserInfoInterceptor implements HandlerInterceptor, AsyncHandlerInterceptor {
+
+  public static final String USERINFO_ATTR_NAME = "userInfo";
+  public static final String USERINFO_JSON_ATTR_NAME = "userInfoJson";
+
+  private final Gson gsonBuilder;
+  private final UserInfoService userInfoService;
+  private final AuthenticationTrustResolver trustResolver = new AuthenticationTrustResolverImpl();
+
+  private static final JsonSerializer AUTHORITY_SERIALIZER =
+      (src, type, context) -> new JsonPrimitive(src.getAuthority());
+
+  @Autowired
+  public IamUserInfoInterceptor(UserInfoService userInfoService) {
+    this.userInfoService = userInfoService;
+    gsonBuilder = new GsonBuilder()
+      .registerTypeHierarchyAdapter(GrantedAuthority.class, AUTHORITY_SERIALIZER)
+      .create();
+  }
+
+  private void resolveUserInfo(Authentication auth, HttpServletRequest request) {
+    UserInfo user = userInfoService.getByUsername(auth.getName());
+
+    if (user != null) {
+      request.setAttribute(USERINFO_ATTR_NAME, user);
+      request.setAttribute(USERINFO_JSON_ATTR_NAME, user.toJson());
+    }
+  }
+
+  @Override
+  public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler)
+      throws Exception {
+
+    Authentication auth = SecurityContextHolder.getContext().getAuthentication();
+
+    if (auth instanceof Authentication) {
+      request.setAttribute("userAuthorities", gsonBuilder.toJson(auth.getAuthorities()));
+    }
+
+    if (!trustResolver.isAnonymous(auth)) {
+      if (auth instanceof OAuth2Authentication) {
+
+        OAuth2Authentication oauth = (OAuth2Authentication) auth;
+        if (oauth.getUserAuthentication() != null) {
+          resolveUserInfo(oauth.getUserAuthentication(), request);
+        }
+      } else if (auth != null && auth.getName() != null) {
+
+        resolveUserInfo(auth, request);
+      }
+    }
+    return true;
+  }
+}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/userinfo/OAuth2AuthenticationScopeResolver.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/userinfo/OAuth2AuthenticationScopeResolver.java
index dcaffd7de..e41c7eb68 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/userinfo/OAuth2AuthenticationScopeResolver.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/userinfo/OAuth2AuthenticationScopeResolver.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -19,6 +19,7 @@
 
 import org.springframework.security.oauth2.provider.OAuth2Authentication;
 
+@SuppressWarnings("deprecation")
 @FunctionalInterface
 public interface OAuth2AuthenticationScopeResolver {
   Set resolveScope(OAuth2Authentication auth);
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/userinfo/UserInfoClaim.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/userinfo/UserInfoClaim.java
index 616ce8d1f..6c167e1f9 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/userinfo/UserInfoClaim.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/userinfo/UserInfoClaim.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,31 +16,41 @@
 package it.infn.mw.iam.core.userinfo;
 
 public enum UserInfoClaim {
-  ATTR,
-  SUB,
-  NAME,
-  PREFERRED_USERNAME,
-  GIVEN_NAME,
-  FAMILY_NAME,
-  MIDDLE_NAME,
-  NICKNAME,
-  PROFILE,
-  PICTURE,
-  WEBSITE,
-  GENDER,
-  ZONEINFO,
-  LOCALE,
-  UPDATED_AT,
-  BIRTHDATE,
-  EMAIL,
-  EMAIL_VERIFIED,
-  PHONE_NUMBER,
-  PHONE_NUMBER_VERIFIED,
-  ADDRESS,
-  ORGANISATION_NAME,
-  GROUPS,
-  EXTERNAL_AUTHN,
-  EDUPERSON_SCOPED_AFFILIATION,
-  EDUPERSON_ENTITLEMENT,
-  SSH_KEYS;
+  ATTR("attr"),
+  SUB("sub"),
+  NAME("name"),
+  PREFERRED_USERNAME("preferred_username"),
+  GIVEN_NAME("given_name"),
+  FAMILY_NAME("family_name"),
+  MIDDLE_NAME("middle_name"),
+  NICKNAME("nickname"),
+  PROFILE("profile"),
+  PICTURE("picture"),
+  WEBSITE("website"),
+  GENDER("gender"),
+  ZONEINFO("zoneinfo"),
+  LOCALE("locale"),
+  UPDATED_AT("updated_at"),
+  BIRTHDATE("birthdate"),
+  EMAIL("email"),
+  EMAIL_VERIFIED("email_verified"),
+  PHONE_NUMBER("phone_number"),
+  PHONE_NUMBER_VERIFIED("phone_number_verified"),
+  ADDRESS("address"),
+  ORGANISATION_NAME("organisation_name"),
+  GROUPS("groups"),
+  WLCG_GROUPS("wlcg.groups"),
+  EXTERNAL_AUTHN("external_authn"),
+  EDUPERSON_SCOPED_AFFILIATION("eduperson_scoped_affiliation"),
+  EDUPERSON_ENTITLEMENT("eduperson_entitlement"),
+  SSH_KEYS("ssh_keys");
+
+  private UserInfoClaim(String claimName) {
+    this.claimName = claimName;
+  }
+  private String claimName;
+
+  public String getClaimName() {
+    return claimName;
+  }
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/util/AuthenticationLogger.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/util/AuthenticationLogger.java
index 35f9b4fa0..b4f7bf232 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/util/AuthenticationLogger.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/util/AuthenticationLogger.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/util/IamAuthenticationEventPublisher.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/util/IamAuthenticationEventPublisher.java
index 1af19d64c..cd5195aba 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/util/IamAuthenticationEventPublisher.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/util/IamAuthenticationEventPublisher.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/util/IamAuthenticationLogger.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/util/IamAuthenticationLogger.java
index c0470bf2d..d9c669de6 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/util/IamAuthenticationLogger.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/util/IamAuthenticationLogger.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -20,6 +20,7 @@
 import org.springframework.security.core.Authentication;
 import org.springframework.security.oauth2.provider.OAuth2Authentication;
 
+@SuppressWarnings("deprecation")
 public enum IamAuthenticationLogger implements AuthenticationLogger {
 
   INSTANCE;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/util/IamBanner.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/util/IamBanner.java
index 1114622ea..d1411d7a6 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/util/IamBanner.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/util/IamBanner.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/util/PoliteJsonMessageSource.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/util/PoliteJsonMessageSource.java
index cba189da5..862961990 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/util/PoliteJsonMessageSource.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/util/PoliteJsonMessageSource.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -40,6 +40,7 @@
 import com.google.gson.JsonParser;
 import com.google.gson.JsonSyntaxException;
 
+@SuppressWarnings("deprecation")
 /**
  * This is a more polite {@link org.mitre.openid.connect.config.JsonMessageSource} that does not log
  * errors for unsupported locales.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/web/DefaultLoginPageConfiguration.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/web/DefaultLoginPageConfiguration.java
index 0d6dd4692..1663fa953 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/web/DefaultLoginPageConfiguration.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/web/DefaultLoginPageConfiguration.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -15,9 +15,6 @@
  */
 package it.infn.mw.iam.core.web;
 
-import static it.infn.mw.iam.api.account_linking.AccountLinkingConstants.ACCOUNT_LINKING_DISABLE_PROPERTY;
-
-import java.util.Arrays;
 import java.util.List;
 import java.util.Optional;
 
@@ -27,6 +24,7 @@
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.context.EnvironmentAware;
 import org.springframework.core.env.Environment;
+import org.springframework.core.env.Profiles;
 import org.springframework.stereotype.Component;
 
 import com.google.common.base.Strings;
@@ -51,8 +49,8 @@ public class DefaultLoginPageConfiguration implements LoginPageConfiguration, En
   private boolean localAuthenticationVisible;
   private boolean showLinkToLocalAuthn;
 
-  @Value(ACCOUNT_LINKING_DISABLE_PROPERTY)
-  private Boolean accountLinkingDisable;
+  @Value("${iam.account-linking.enable}")
+  private Boolean accountLinkingEnabled;
 
   private OidcValidatedProviders providers;
 
@@ -69,20 +67,15 @@ public DefaultLoginPageConfiguration(OidcValidatedProviders providers, IamProper
   public void init() {
 
     oidcEnabled = !providers.getValidatedProviders().isEmpty();
-    githubEnabled = activeProfilesContains("github");
-    samlEnabled = activeProfilesContains("saml");
-    registrationEnabled = activeProfilesContains("registration");
+    githubEnabled = env.acceptsProfiles(Profiles.of("github"));
+    samlEnabled = env.acceptsProfiles(Profiles.of("saml"));
+    registrationEnabled = env.acceptsProfiles(Profiles.of("registration"));
     localAuthenticationVisible = IamProperties.LocalAuthenticationLoginPageMode.VISIBLE
       .equals(iamProperties.getLocalAuthn().getLoginPageVisibility());
     showLinkToLocalAuthn = IamProperties.LocalAuthenticationLoginPageMode.HIDDEN_WITH_LINK
       .equals(iamProperties.getLocalAuthn().getLoginPageVisibility());
   }
 
-  private boolean activeProfilesContains(String val) {
-
-    return Arrays.asList(env.getActiveProfiles()).contains(val);
-  }
-
   @Override
   public boolean isOidcEnabled() {
 
@@ -116,7 +109,7 @@ public boolean isRegistrationEnabled() {
 
   @Override
   public boolean isAccountLinkingEnabled() {
-    return !accountLinkingDisable.booleanValue();
+    return accountLinkingEnabled.booleanValue();
   }
 
   @Override
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/web/DefaultStartRegistrationController.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/web/DefaultStartRegistrationController.java
index 6c717014a..4397eb309 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/web/DefaultStartRegistrationController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/web/DefaultStartRegistrationController.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -20,6 +20,7 @@
 
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.core.env.Environment;
+import org.springframework.core.env.Profiles;
 import org.springframework.security.core.Authentication;
 import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.RequestMapping;
@@ -34,13 +35,7 @@ public class DefaultStartRegistrationController {
 
   @Autowired
   public DefaultStartRegistrationController(Environment env) {
-    registrationProfileEnabled = false;
-
-    for (String ap : env.getActiveProfiles()) {
-      if (REGISTRATION_PROFILE.equals(ap)) {
-        registrationProfileEnabled = true;
-      }
-    }
+    registrationProfileEnabled = env.acceptsProfiles(Profiles.of(REGISTRATION_PROFILE));
   }
 
   @RequestMapping(method = RequestMethod.GET, path = "/start-registration")
@@ -50,7 +45,7 @@ public String startRegistration(Authentication authentication) {
         && !authentication.getAuthorities().contains(EXT_AUTHN_UNREGISTERED_USER_AUTH)) {
       return "iam/dashboard";
     }
-    
+
     if (registrationProfileEnabled) {
       return "iam/register";
     } else {
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/web/EnforceAupFilter.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/web/EnforceAupFilter.java
index 1d3a106b6..771235a5b 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/web/EnforceAupFilter.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/web/EnforceAupFilter.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/web/IamDiscoveryEndpoint.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/web/IamDiscoveryEndpoint.java
index f09d7014a..5e766f856 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/web/IamDiscoveryEndpoint.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/web/IamDiscoveryEndpoint.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/web/IamErrorController.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/web/IamErrorController.java
index 4d583009c..ffebf19c4 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/web/IamErrorController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/web/IamErrorController.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@
 import javax.servlet.http.HttpServletRequest;
 
 import org.apache.commons.lang3.exception.ExceptionUtils;
-import org.springframework.boot.autoconfigure.web.ErrorController;
+import org.springframework.boot.web.servlet.error.ErrorController;
 import org.springframework.http.HttpStatus;
 import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.RequestMapping;
@@ -58,9 +58,4 @@ private Exception getRequestException(HttpServletRequest httpRequest) {
     return (Exception) httpRequest.getAttribute("javax.servlet.error.exception");
   }
 
-  @Override
-  public String getErrorPath() {
-    return PATH;
-  }
-
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/web/IamRootController.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/web/IamRootController.java
index ebe1b7c68..e4013bc40 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/web/IamRootController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/web/IamRootController.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/web/IamViewInfoInterceptor.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/web/IamViewInfoInterceptor.java
index d0ef27ba6..25291ef5d 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/web/IamViewInfoInterceptor.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/web/IamViewInfoInterceptor.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -21,14 +21,14 @@
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.stereotype.Component;
-import org.springframework.web.servlet.handler.HandlerInterceptorAdapter;
+import org.springframework.web.servlet.HandlerInterceptor;
 
 import it.infn.mw.iam.config.IamProperties;
 import it.infn.mw.iam.config.saml.IamSamlProperties;
 import it.infn.mw.iam.rcauth.RCAuthProperties;
 
 @Component
-public class IamViewInfoInterceptor extends HandlerInterceptorAdapter {
+public class IamViewInfoInterceptor implements HandlerInterceptor {
 
   public static final String LOGIN_PAGE_CONFIGURATION_KEY = "loginPageConfiguration";
   public static final String ORGANISATION_NAME_KEY = "iamOrganisationName";
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/web/LoginPageConfiguration.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/web/LoginPageConfiguration.java
index c190812dc..dd3808c51 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/web/LoginPageConfiguration.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/web/LoginPageConfiguration.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/web/jwk/IamJWKSetPublishingEndpoint.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/web/jwk/IamJWKSetPublishingEndpoint.java
index 4dfa5bdf8..0beb22988 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/web/jwk/IamJWKSetPublishingEndpoint.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/web/jwk/IamJWKSetPublishingEndpoint.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -22,7 +22,7 @@
 import org.springframework.beans.factory.InitializingBean;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.http.MediaType;
-import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.RestController;
 
 import com.nimbusds.jose.jwk.JWK;
@@ -38,7 +38,7 @@ public class IamJWKSetPublishingEndpoint implements InitializingBean {
   @Autowired
   private JWTSigningAndValidationService jwtService;
 
-  @RequestMapping(value = "/" + URL, produces = MediaType.APPLICATION_JSON_VALUE)
+  @GetMapping(value = "/" + URL, produces = MediaType.APPLICATION_JSON_VALUE)
   public String getJwk() {
 
     return jsonKeys;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/dashboard/DashboardController.java b/iam-login-service/src/main/java/it/infn/mw/iam/dashboard/DashboardController.java
index abb73c74d..36076854d 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/dashboard/DashboardController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/dashboard/DashboardController.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/github/GithubAuthFilter.java b/iam-login-service/src/main/java/it/infn/mw/iam/github/GithubAuthFilter.java
deleted file mode 100644
index 1d7cf9848..000000000
--- a/iam-login-service/src/main/java/it/infn/mw/iam/github/GithubAuthFilter.java
+++ /dev/null
@@ -1,66 +0,0 @@
-/**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package it.infn.mw.iam.github;
-
-import java.io.IOException;
-
-import javax.servlet.ServletException;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.servlet.http.HttpSession;
-
-import org.springframework.security.core.Authentication;
-import org.springframework.security.oauth2.client.filter.OAuth2ClientAuthenticationProcessingFilter;
-import org.springframework.security.web.savedrequest.DefaultSavedRequest;
-
-public class GithubAuthFilter extends OAuth2ClientAuthenticationProcessingFilter {
-
-  protected static final String REDIRECT_URI_SESSION_VARIABLE = "redirect_uri";
-  protected static final String STATE_SESSION_VARIABLE = "state";
-  protected static final String NONCE_SESSION_VARIABLE = "nonce";
-  protected static final String ISSUER_SESSION_VARIABLE = "issuer";
-  protected static final String TARGET_SESSION_VARIABLE = "target";
-  protected static final int HTTP_SOCKET_TIMEOUT = 30000;
-
-  protected static final String ORIGIN_AUTH_REQUEST_SESSION_VARIABLE = "origin_auth_request";
-
-  public static final String FILTER_PROCESSES_URL = "/login/github";
-
-  public GithubAuthFilter() {
-    super(FILTER_PROCESSES_URL);
-  }
-
-  public GithubAuthFilter(String processingUrl) {
-    super(processingUrl);
-  }
-
-  @Override
-  public Authentication attemptAuthentication(final HttpServletRequest request,
-      final HttpServletResponse response)
-          throws IOException, ServletException {
-
-    HttpSession session = request.getSession();
-
-    // backup origin redirect uri and state
-    DefaultSavedRequest savedRequest =
-        (DefaultSavedRequest) session.getAttribute("SPRING_SECURITY_SAVED_REQUEST");
-    session.setAttribute(ORIGIN_AUTH_REQUEST_SESSION_VARIABLE, savedRequest);
-
-    return super.attemptAuthentication(request, response);
-
-  }
-
-}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/notification/NotificationDelivery.java b/iam-login-service/src/main/java/it/infn/mw/iam/notification/NotificationDelivery.java
index d1b59d375..c987c62ea 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/notification/NotificationDelivery.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/notification/NotificationDelivery.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/notification/NotificationDeliveryTask.java b/iam-login-service/src/main/java/it/infn/mw/iam/notification/NotificationDeliveryTask.java
index 5db40c8e5..962ac7bdd 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/notification/NotificationDeliveryTask.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/notification/NotificationDeliveryTask.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/notification/NotificationFactory.java b/iam-login-service/src/main/java/it/infn/mw/iam/notification/NotificationFactory.java
index e8c5b08e7..035218299 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/notification/NotificationFactory.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/notification/NotificationFactory.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/notification/NotificationProperties.java b/iam-login-service/src/main/java/it/infn/mw/iam/notification/NotificationProperties.java
index afb6394c0..726a710aa 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/notification/NotificationProperties.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/notification/NotificationProperties.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -20,11 +20,13 @@
 
 import java.util.Map;
 
-import org.hibernate.validator.constraints.NotBlank;
+import javax.validation.constraints.NotBlank;
 import org.springframework.boot.context.properties.ConfigurationProperties;
 import org.springframework.stereotype.Component;
+import org.springframework.validation.annotation.Validated;
 
 @Component
+@Validated
 @ConfigurationProperties(prefix = "notification")
 public class NotificationProperties {
 
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/notification/PersistentNotificationFactory.java b/iam-login-service/src/main/java/it/infn/mw/iam/notification/PersistentNotificationFactory.java
index 3a1e45355..24ec41f4d 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/notification/PersistentNotificationFactory.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/notification/PersistentNotificationFactory.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/notification/TransientNotificationFactory.java b/iam-login-service/src/main/java/it/infn/mw/iam/notification/TransientNotificationFactory.java
index a445b032b..c4357db32 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/notification/TransientNotificationFactory.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/notification/TransientNotificationFactory.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/DefaultNotificationStoreService.java b/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/DefaultNotificationStoreService.java
index 3d059bffb..d267db0a0 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/DefaultNotificationStoreService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/DefaultNotificationStoreService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -57,7 +57,7 @@ public void clearExpiredNotifications() {
         repo.findByStatusWithUpdateTime(IamDeliveryStatus.DELIVERED, threshold);
 
     if (!messageList.isEmpty()) {
-      repo.delete(messageList);
+      repo.deleteAll(messageList);
       LOG.info("Deleted {} messages in status {} older than {}", messageList.size(),
           IamDeliveryStatus.DELIVERED, threshold);
     }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/JavaMailNotificationDelivery.java b/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/JavaMailNotificationDelivery.java
index 42e7b4f85..19d48fb68 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/JavaMailNotificationDelivery.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/JavaMailNotificationDelivery.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/LoggingNotificationDelivery.java b/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/LoggingNotificationDelivery.java
index f3d229172..d0b464f6a 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/LoggingNotificationDelivery.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/LoggingNotificationDelivery.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/NotificationStoreService.java b/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/NotificationStoreService.java
index 1e2b99634..85fbc592a 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/NotificationStoreService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/NotificationStoreService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/resolver/AddressResolutionService.java b/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/resolver/AddressResolutionService.java
index c17562b6c..95889308d 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/resolver/AddressResolutionService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/resolver/AddressResolutionService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/resolver/AdminNotificationDeliveryStrategy.java b/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/resolver/AdminNotificationDeliveryStrategy.java
index 18ab2de17..adb3525ea 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/resolver/AdminNotificationDeliveryStrategy.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/resolver/AdminNotificationDeliveryStrategy.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/resolver/CompositeAdminsNotificationDelivery.java b/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/resolver/CompositeAdminsNotificationDelivery.java
index 1b436181d..34e074b27 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/resolver/CompositeAdminsNotificationDelivery.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/resolver/CompositeAdminsNotificationDelivery.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/resolver/ContextAwareAddressResolver.java b/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/resolver/ContextAwareAddressResolver.java
index 45ade9ccf..6fc799407 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/resolver/ContextAwareAddressResolver.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/resolver/ContextAwareAddressResolver.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/resolver/DefaultAddressResolutionService.java b/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/resolver/DefaultAddressResolutionService.java
index 23a4980f4..5de0b0af6 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/resolver/DefaultAddressResolutionService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/resolver/DefaultAddressResolutionService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/resolver/GroupManagerNotificationDeliveryStrategy.java b/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/resolver/GroupManagerNotificationDeliveryStrategy.java
index 02c404182..21a2c929f 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/resolver/GroupManagerNotificationDeliveryStrategy.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/resolver/GroupManagerNotificationDeliveryStrategy.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/resolver/IamAccountByAuthorityAddressResolver.java b/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/resolver/IamAccountByAuthorityAddressResolver.java
index 2d4d89ea7..d037841f2 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/resolver/IamAccountByAuthorityAddressResolver.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/resolver/IamAccountByAuthorityAddressResolver.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/resolver/InvalidAudience.java b/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/resolver/InvalidAudience.java
index 12fd450ab..42434caad 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/resolver/InvalidAudience.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/resolver/InvalidAudience.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/resolver/NotifyAdminAddressStrategy.java b/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/resolver/NotifyAdminAddressStrategy.java
index 4dd92a486..17fca3bcb 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/resolver/NotifyAdminAddressStrategy.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/resolver/NotifyAdminAddressStrategy.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/resolver/NotifyAdminsStrategy.java b/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/resolver/NotifyAdminsStrategy.java
index 6458ffba0..d9d215302 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/resolver/NotifyAdminsStrategy.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/resolver/NotifyAdminsStrategy.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/resolver/NotifyGmStrategy.java b/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/resolver/NotifyGmStrategy.java
index a1d4ca080..9a282a051 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/resolver/NotifyGmStrategy.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/resolver/NotifyGmStrategy.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/resolver/NotifyGmsAndAdminsStrategy.java b/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/resolver/NotifyGmsAndAdminsStrategy.java
index b3ae7d15b..7b3e81f96 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/resolver/NotifyGmsAndAdminsStrategy.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/notification/service/resolver/NotifyGmsAndAdminsStrategy.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/persistence/repository/AddressAdapter.java b/iam-login-service/src/main/java/it/infn/mw/iam/persistence/repository/AddressAdapter.java
index 32ae0b926..99f0c2d1a 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/persistence/repository/AddressAdapter.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/persistence/repository/AddressAdapter.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/persistence/repository/IamOAuthAccessTokenRepository.java b/iam-login-service/src/main/java/it/infn/mw/iam/persistence/repository/IamOAuthAccessTokenRepository.java
index 798ab089e..aedfd9ad9 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/persistence/repository/IamOAuthAccessTokenRepository.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/persistence/repository/IamOAuthAccessTokenRepository.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/persistence/repository/IamOAuthRefreshTokenRepository.java b/iam-login-service/src/main/java/it/infn/mw/iam/persistence/repository/IamOAuthRefreshTokenRepository.java
index 45362560f..7e6221866 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/persistence/repository/IamOAuthRefreshTokenRepository.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/persistence/repository/IamOAuthRefreshTokenRepository.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/persistence/repository/IamUserinfoRepository.java b/iam-login-service/src/main/java/it/infn/mw/iam/persistence/repository/IamUserinfoRepository.java
index fa894dfe7..5de0bdd97 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/persistence/repository/IamUserinfoRepository.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/persistence/repository/IamUserinfoRepository.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/persistence/repository/UserInfoAdapter.java b/iam-login-service/src/main/java/it/infn/mw/iam/persistence/repository/UserInfoAdapter.java
index 052844013..40a80554a 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/persistence/repository/UserInfoAdapter.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/persistence/repository/UserInfoAdapter.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/DefaultRCAuthCertificateRequestor.java b/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/DefaultRCAuthCertificateRequestor.java
index a35bd5d5e..1cbeec21f 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/DefaultRCAuthCertificateRequestor.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/DefaultRCAuthCertificateRequestor.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/DefaultRCAuthTokenRequestor.java b/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/DefaultRCAuthTokenRequestor.java
index e8b6a6427..376ae084c 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/DefaultRCAuthTokenRequestor.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/DefaultRCAuthTokenRequestor.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@
 import static it.infn.mw.iam.rcauth.RCAuthController.CALLBACK_PATH;
 import static java.util.Objects.isNull;
 import static org.springframework.http.HttpStatus.BAD_REQUEST;
-import static org.springframework.http.MediaType.APPLICATION_JSON_UTF8_VALUE;
+import static org.springframework.http.MediaType.APPLICATION_JSON_VALUE;
 
 import java.nio.charset.StandardCharsets;
 import java.util.Optional;
@@ -141,7 +141,7 @@ public RCAuthTokenResponse getAccessToken(String code) {
     
     // ugly hack needed to workaround buggy oauth myproxy implementation
     // that does not set the content type for the token response
-    rt.getInterceptors().add(new AddContentTypeInterceptor(APPLICATION_JSON_UTF8_VALUE));
+    rt.getInterceptors().add(new AddContentTypeInterceptor(APPLICATION_JSON_VALUE));
 
     try {
 
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/DefaultRcAuthRequestService.java b/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/DefaultRcAuthRequestService.java
index ae9fa8e31..ab8f4a6f1 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/DefaultRcAuthRequestService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/DefaultRcAuthRequestService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/RCAuthAuthorizationResponse.java b/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/RCAuthAuthorizationResponse.java
index ef87b687d..3b8576f42 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/RCAuthAuthorizationResponse.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/RCAuthAuthorizationResponse.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -15,7 +15,7 @@
  */
 package it.infn.mw.iam.rcauth;
 
-import org.hibernate.validator.constraints.NotBlank;
+import javax.validation.constraints.NotBlank;
 
 public class RCAuthAuthorizationResponse {
 
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/RCAuthCertificateRequestor.java b/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/RCAuthCertificateRequestor.java
index 8fb06151b..08b8b1f46 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/RCAuthCertificateRequestor.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/RCAuthCertificateRequestor.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/RCAuthController.java b/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/RCAuthController.java
index fa424b851..8cc2c0b4f 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/RCAuthController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/RCAuthController.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/RCAuthError.java b/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/RCAuthError.java
index d9dd13fb5..3de1c5ad1 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/RCAuthError.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/RCAuthError.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/RCAuthExchangeContext.java b/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/RCAuthExchangeContext.java
index ce93d7318..992762bf6 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/RCAuthExchangeContext.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/RCAuthExchangeContext.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/RCAuthProperties.java b/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/RCAuthProperties.java
index a02089e4e..77c460942 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/RCAuthProperties.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/RCAuthProperties.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/RCAuthRequestService.java b/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/RCAuthRequestService.java
index c019fb1c3..39f3192df 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/RCAuthRequestService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/RCAuthRequestService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/RCAuthSecurityConfig.java b/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/RCAuthSecurityConfig.java
index a43a29017..6f6862b10 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/RCAuthSecurityConfig.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/RCAuthSecurityConfig.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/RCAuthTokenRequestor.java b/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/RCAuthTokenRequestor.java
index 5bcf65bb3..28f097495 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/RCAuthTokenRequestor.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/RCAuthTokenRequestor.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/RCAuthTokenResponse.java b/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/RCAuthTokenResponse.java
index 82400d24e..81a340026 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/RCAuthTokenResponse.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/RCAuthTokenResponse.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/RCAuthX509Config.java b/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/RCAuthX509Config.java
index 59f70a99e..ed817f05b 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/RCAuthX509Config.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/RCAuthX509Config.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/oidc/DefaultRCAuthTokenResponseVerifier.java b/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/oidc/DefaultRCAuthTokenResponseVerifier.java
index 1e0abf0f3..9821a5043 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/oidc/DefaultRCAuthTokenResponseVerifier.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/oidc/DefaultRCAuthTokenResponseVerifier.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/oidc/RCAuthTokenResponseVerifier.java b/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/oidc/RCAuthTokenResponseVerifier.java
index 4faab5ac2..04f515513 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/oidc/RCAuthTokenResponseVerifier.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/oidc/RCAuthTokenResponseVerifier.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/util/AddContentTypeInterceptor.java b/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/util/AddContentTypeInterceptor.java
index b245756a0..cbe602693 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/util/AddContentTypeInterceptor.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/util/AddContentTypeInterceptor.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/x509/CertificateRequestHolder.java b/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/x509/CertificateRequestHolder.java
index 729cb16cb..6ac5feb6b 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/x509/CertificateRequestHolder.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/x509/CertificateRequestHolder.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/x509/CertificateRequestUtil.java b/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/x509/CertificateRequestUtil.java
index 6056baf52..36f149a0b 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/x509/CertificateRequestUtil.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/x509/CertificateRequestUtil.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/x509/DefaultProxyHelperService.java b/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/x509/DefaultProxyHelperService.java
index 95dbf224a..2c7dbb210 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/x509/DefaultProxyHelperService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/x509/DefaultProxyHelperService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/x509/ProxyGenerationError.java b/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/x509/ProxyGenerationError.java
index e09aa6363..1e1f40938 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/x509/ProxyGenerationError.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/x509/ProxyGenerationError.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/x509/ProxyHelperService.java b/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/x509/ProxyHelperService.java
index 12632813a..18ee789b1 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/x509/ProxyHelperService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/rcauth/x509/ProxyHelperService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/registration/DefaultRegistrationRequestService.java b/iam-login-service/src/main/java/it/infn/mw/iam/registration/DefaultRegistrationRequestService.java
index 3a4e17102..314ff4d66 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/registration/DefaultRegistrationRequestService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/registration/DefaultRegistrationRequestService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -235,7 +235,7 @@ public List listRequests(IamRegistrationRequestStatus st
             () -> new IllegalStateException("No request found with status: " + status.name()));
 
     } else {
-      Sort srt = new Sort(Sort.Direction.ASC, "creationTime");
+      Sort srt = Sort.by(Sort.Direction.ASC, "creationTime");
       Iterable iter = requestRepository.findAll(srt);
       for (IamRegistrationRequest elem : iter) {
         result.add(elem);
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/registration/PersistentUUIDTokenGenerator.java b/iam-login-service/src/main/java/it/infn/mw/iam/registration/PersistentUUIDTokenGenerator.java
index 44bb2453f..e71f3e33b 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/registration/PersistentUUIDTokenGenerator.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/registration/PersistentUUIDTokenGenerator.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/registration/RegistrationApiController.java b/iam-login-service/src/main/java/it/infn/mw/iam/registration/RegistrationApiController.java
index ad2156098..04561f271 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/registration/RegistrationApiController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/registration/RegistrationApiController.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/registration/RegistrationConverter.java b/iam-login-service/src/main/java/it/infn/mw/iam/registration/RegistrationConverter.java
index d68a0cc82..85e67ceb0 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/registration/RegistrationConverter.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/registration/RegistrationConverter.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/registration/RegistrationRequestDto.java b/iam-login-service/src/main/java/it/infn/mw/iam/registration/RegistrationRequestDto.java
index 8973d52b2..76d2b0ae5 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/registration/RegistrationRequestDto.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/registration/RegistrationRequestDto.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/registration/RegistrationRequestService.java b/iam-login-service/src/main/java/it/infn/mw/iam/registration/RegistrationRequestService.java
index f14202441..51256cd60 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/registration/RegistrationRequestService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/registration/RegistrationRequestService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/registration/RegistrationUtilsController.java b/iam-login-service/src/main/java/it/infn/mw/iam/registration/RegistrationUtilsController.java
index d38023adb..36e7df251 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/registration/RegistrationUtilsController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/registration/RegistrationUtilsController.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/registration/TokenGenerator.java b/iam-login-service/src/main/java/it/infn/mw/iam/registration/TokenGenerator.java
index bf874b79b..397baf824 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/registration/TokenGenerator.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/registration/TokenGenerator.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/registration/UUIDTokenGenerator.java b/iam-login-service/src/main/java/it/infn/mw/iam/registration/UUIDTokenGenerator.java
index 67f024b92..142dee9e7 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/registration/UUIDTokenGenerator.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/registration/UUIDTokenGenerator.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/registration/validation/CernHrDbRequestValidatorService.java b/iam-login-service/src/main/java/it/infn/mw/iam/registration/validation/CernHrDbRequestValidatorService.java
index da1c77169..eb700fc55 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/registration/validation/CernHrDbRequestValidatorService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/registration/validation/CernHrDbRequestValidatorService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/registration/validation/RegistrationRequestValidationResult.java b/iam-login-service/src/main/java/it/infn/mw/iam/registration/validation/RegistrationRequestValidationResult.java
index 7e144b4d9..4a344881b 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/registration/validation/RegistrationRequestValidationResult.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/registration/validation/RegistrationRequestValidationResult.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/registration/validation/RegistrationRequestValidationService.java b/iam-login-service/src/main/java/it/infn/mw/iam/registration/validation/RegistrationRequestValidationService.java
index 4c0e6da27..96598b833 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/registration/validation/RegistrationRequestValidationService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/registration/validation/RegistrationRequestValidationService.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/registration/validation/RegistrationRequestValidatorError.java b/iam-login-service/src/main/java/it/infn/mw/iam/registration/validation/RegistrationRequestValidatorError.java
index 7a34192df..6ab156073 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/registration/validation/RegistrationRequestValidatorError.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/registration/validation/RegistrationRequestValidatorError.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/util/BasicAuthenticationUtils.java b/iam-login-service/src/main/java/it/infn/mw/iam/util/BasicAuthenticationUtils.java
index cf9bb39b5..e6284f41d 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/util/BasicAuthenticationUtils.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/util/BasicAuthenticationUtils.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/util/DumpHeadersFilter.java b/iam-login-service/src/main/java/it/infn/mw/iam/util/DumpHeadersFilter.java
index ce483ee1c..5d2051c36 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/util/DumpHeadersFilter.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/util/DumpHeadersFilter.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/util/IamBcryptUtil.java b/iam-login-service/src/main/java/it/infn/mw/iam/util/IamBcryptUtil.java
index 75cff08b4..6396c1c01 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/util/IamBcryptUtil.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/util/IamBcryptUtil.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/util/JWKKeystoreLoader.java b/iam-login-service/src/main/java/it/infn/mw/iam/util/JWKKeystoreLoader.java
index e458a1503..16abdac52 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/util/JWKKeystoreLoader.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/util/JWKKeystoreLoader.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/util/SamlDecryptUtil.java b/iam-login-service/src/main/java/it/infn/mw/iam/util/SamlDecryptUtil.java
index 312b2db8c..abfffa573 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/util/SamlDecryptUtil.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/util/SamlDecryptUtil.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/util/ssh/InvalidSshKeyException.java b/iam-login-service/src/main/java/it/infn/mw/iam/util/ssh/InvalidSshKeyException.java
index be59e9f8d..5e38fba5c 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/util/ssh/InvalidSshKeyException.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/util/ssh/InvalidSshKeyException.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/util/ssh/RSAPublicKeyUtils.java b/iam-login-service/src/main/java/it/infn/mw/iam/util/ssh/RSAPublicKeyUtils.java
index 63a671242..94e7876ef 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/util/ssh/RSAPublicKeyUtils.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/util/ssh/RSAPublicKeyUtils.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -18,47 +18,18 @@
 import java.security.MessageDigest;
 import java.util.Base64;
 
-import org.apache.commons.codec.binary.Hex;
 import org.apache.commons.codec.digest.MessageDigestAlgorithms;
 
 public class RSAPublicKeyUtils {
 
   private RSAPublicKeyUtils() {}
   
-  public static String getMD5Fingerprint(String key) {
-
-    return buildMD5Fingerprint(key);
-  }
-
-  public static String getFormattedMD5Fingerprint(String key) {
-
-    return String.join(":", buildMD5Fingerprint(key).split("(?<=\\G..)"));
-  }
 
   public static String getSHA256Fingerprint(String key) {
 
     return buildSHA256Fingerprint(key);
   }
 
-  private static String buildMD5Fingerprint(String key) throws InvalidSshKeyException {
-
-    String fingerprint = null;
-
-    try {
-
-      byte[] decodedKey = Base64.getDecoder().decode(key);
-      byte[] digest = MessageDigest.getInstance(MessageDigestAlgorithms.MD5).digest(decodedKey);
-      fingerprint = Hex.encodeHexString(digest);
-
-    } catch (Exception e) {
-
-      throw new InvalidSshKeyException(
-          "Error during fingerprint generation: RSA key is not base64 encoded", e);
-    }
-
-    return fingerprint;
-  }
-
   private static String buildSHA256Fingerprint(String keyVal) throws InvalidSshKeyException {
     
     final String[] keyParts = keyVal.split("\\s");
@@ -66,8 +37,7 @@ private static String buildSHA256Fingerprint(String keyVal) throws InvalidSshKey
 
     if (keyParts.length == 0) {
       encodedKey = keyVal;
-    }
-    if (keyParts.length == 1) {
+    } else if (keyParts.length == 1) {
       encodedKey = keyParts[0];
     } else {
       encodedKey = keyParts[1];
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/util/test/OidcSecurityContextBuilder.java b/iam-login-service/src/main/java/it/infn/mw/iam/util/test/OidcSecurityContextBuilder.java
index 2022b24d3..faae365d8 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/util/test/OidcSecurityContextBuilder.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/util/test/OidcSecurityContextBuilder.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/util/test/SecurityContextBuilderSupport.java b/iam-login-service/src/main/java/it/infn/mw/iam/util/test/SecurityContextBuilderSupport.java
index a4f0fed8c..93de22571 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/util/test/SecurityContextBuilderSupport.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/util/test/SecurityContextBuilderSupport.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/util/test/saml/SamlSecurityContextBuilder.java b/iam-login-service/src/main/java/it/infn/mw/iam/util/test/saml/SamlSecurityContextBuilder.java
index 4e56bb691..d4539dfad 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/util/test/saml/SamlSecurityContextBuilder.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/util/test/saml/SamlSecurityContextBuilder.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/util/x509/X509Utils.java b/iam-login-service/src/main/java/it/infn/mw/iam/util/x509/X509Utils.java
index 046c5ae37..9282a2284 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/util/x509/X509Utils.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/util/x509/X509Utils.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/resources-filtered/application.properties b/iam-login-service/src/main/resources-filtered/application.properties
deleted file mode 100644
index 0f489abb2..000000000
--- a/iam-login-service/src/main/resources-filtered/application.properties
+++ /dev/null
@@ -1,53 +0,0 @@
-#
-# Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-info.app.name=${project.name}
-info.app.description=${project.description}
-info.app.version=${project.version}
-info.app.encoding=${project.build.sourceEncoding}
-info.app.java.source=${java.version}
-info.app.java.target=${java.version}
-
-# The Audit log default
-logging.level.AUDIT=INFO
-
-logging.level.=WARN
-logging.level.root=WARN
-
-logging.level.it.infn.mw=INFO
-logging.level.org.opensaml.saml2.metadata.provider=INFO
-
-#logging.level.=DEBUG
-#logging.level.root=DEBUG
-
-# Persistence engine logging
-#logging.level.org.eclipse.persistence=DEBUG
-
-# Test logging
-# logging.level.org.springframework.test.web.servlet.result=DEBUG
-
-#logging.level.org.apache.jasper.servlet.TldScanner=DEBUG
-
-# Notification service logging
-#logging.level.it.infn.mw.iam.notification=DEBUG
-
-#logging.level.org.springframework.security=DEBUG
-#logging.level.org.springframework.web=DEBUG
-
-# logging.level.com.fasterxml.jackson=INFO
-# logging.level.org.apache.http.wire=DEBUG
-
-# logging.level.org.mitre=INFO
diff --git a/iam-login-service/src/main/resources-filtered/iam.version.properties b/iam-login-service/src/main/resources-filtered/iam.version.properties
index 2206fd74f..d2c452961 100644
--- a/iam-login-service/src/main/resources-filtered/iam.version.properties
+++ b/iam-login-service/src/main/resources-filtered/iam.version.properties
@@ -1,5 +1,5 @@
 #
-# Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+# Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -14,4 +14,4 @@
 # limitations under the License.
 #
 
-iam.version=${project.version}
\ No newline at end of file
+iam.version=@project.version@
\ No newline at end of file
diff --git a/iam-login-service/src/main/resources/ValidationMessages.properties b/iam-login-service/src/main/resources/ValidationMessages.properties
index d46ef84e4..29fb7f38e 100644
--- a/iam-login-service/src/main/resources/ValidationMessages.properties
+++ b/iam-login-service/src/main/resources/ValidationMessages.properties
@@ -1,5 +1,5 @@
 #
-# Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+# Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -15,4 +15,6 @@
 #
 
 it.infn.mw.iam.api.scope_policy.validation.ScopePolicyValidator.emptyScope.message=Invalid scope policy: custom matching policy requires one or more scopes
+it.infn.mw.iam.api.scope_policy.validation.ScopePolicyValidator.nullScope.message=Invalid scope policy: null scope found
+it.infn.mw.iam.api.scope_policy.validation.ScopePolicyValidator.invalidScopeLength.message=Invalid scope policy: scope length must be >= 1 and < 255 characters
 it.infn.mw.iam.api.scope_policy.validation.ScopePolicyValidator.nullMatchingPolicy.message=Invalid scope policy: matching policy cannot be empty or null
diff --git a/iam-login-service/src/main/resources/application-dev.yml b/iam-login-service/src/main/resources/application-dev.yml
index a97dacfcf..d5a8872be 100644
--- a/iam-login-service/src/main/resources/application-dev.yml
+++ b/iam-login-service/src/main/resources/application-dev.yml
@@ -1,5 +1,5 @@
 #
-# Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+# Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/resources/application-h2-test.yml b/iam-login-service/src/main/resources/application-h2.yml
similarity index 64%
rename from iam-login-service/src/main/resources/application-h2-test.yml
rename to iam-login-service/src/main/resources/application-h2.yml
index 4271069ce..ae3b61dcb 100644
--- a/iam-login-service/src/main/resources/application-h2-test.yml
+++ b/iam-login-service/src/main/resources/application-h2.yml
@@ -1,5 +1,5 @@
 #
-# Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+# Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -15,29 +15,33 @@
 #
 
 spring:
-  profiles:
-    include: saml,registration
+    
+  main:
+    allow-bean-definition-overriding: true
+    banner-mode: off
+  
   mail:
     port: ${IAM_MAIL_PORT:8125}
+  
+  flyway:
+    locations:
+      - classpath:db/migration/h2
+      - classpath:db/migration/test
+  
   datasource:
-    driverClassName: org.h2.Driver
-    url: jdbc:h2:mem:iam;DB_CLOSE_DELAY=-1;DB_CLOSE_ON_EXIT=FALSE
+    type: org.h2.jdbcx.JdbcDataSource
+    url: jdbc:h2:mem:iam;DB_CLOSE_ON_EXIT=FALSE;DB_CLOSE_DELAY=-1
     username: sa
     password:
-    test-while-idle: true
-    test-on-borrow: true
-    validation-query: SELECT 1
-    time-between-eviction-runs-millis: 5000
-    min-evictable-idle-time-millis: 10000
-  
+      
 notification:
   disable: ${IAM_NOTIFICATION_DISABLE:true}
 
-flyway:
-  locations:
-    - classpath:db/migration/h2
-    - classpath:db/migration/test
-
 iam:
   versioned-static-resources:
-    enable-versioning: false 
\ No newline at end of file
+    enable-versioning: false
+
+management:
+  health:
+      mail:
+        enabled: false
\ No newline at end of file
diff --git a/iam-login-service/src/main/resources/application-mysql-test.yml b/iam-login-service/src/main/resources/application-mysql-test.yml
index 352778cd1..690cb4cc3 100644
--- a/iam-login-service/src/main/resources/application-mysql-test.yml
+++ b/iam-login-service/src/main/resources/application-mysql-test.yml
@@ -1,5 +1,5 @@
 #
-# Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+# Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -15,33 +15,25 @@
 #
 
 spring:
-  profiles:
-    include: mysql,registration,saml
+  main:
+    allow-bean-definition-overriding: true
+    banner-mode: off
+    
   datasource:
-    dataSourceClassName: com.mysql.jdbc.jdbc2.optional.MysqlDataSource
+    
     url: jdbc:mysql://${IAM_DB_HOST:dev.local.io}:${IAM_DB_PORT:3306}/${IAM_DB_NAME:iam}?useSSL=${IAM_DB_USE_SSL:false}
     username: ${IAM_DB_USERNAME:iam}
     password: ${IAM_DB_PASSWORD:pwd}
-    max-active: 5
-    min-idle: 1
-    max-idle:  1
-    initial-size: 2
-    test-while-idle: true
-    test-on-borrow: true
-    validation-query: SELECT 1
-    time-between-eviction-runs-millis: 5000
-    min-evictable-idle-time-millis: 5000
+    
+    hikari:
+      maximum-pool-size: 5
+      minimum-idle: 1
+      connection-test-query: SELECT 1
      
-notification:
-  disable: true
-
- 
-flyway:
-  locations:
-    - classpath:db/migration/mysql
-    - classpath:db/migration/test
+  flyway:
+    locations:
+      - classpath:db/migration/mysql
+      - classpath:db/migration/test
 
-management:
-  health:
-    mail:
-      enabled: false
\ No newline at end of file
+notification:
+  disable: true
\ No newline at end of file
diff --git a/iam-login-service/src/main/resources/application-mysql.yml b/iam-login-service/src/main/resources/application-mysql.yml
index ade7903be..d5a8872be 100644
--- a/iam-login-service/src/main/resources/application-mysql.yml
+++ b/iam-login-service/src/main/resources/application-mysql.yml
@@ -1,5 +1,5 @@
 #
-# Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+# Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -14,6 +14,4 @@
 # limitations under the License.
 #
 
-spring:  
-  jpa:
-    openInView: false
\ No newline at end of file
+#
diff --git a/iam-login-service/src/main/resources/application-oidc.yml b/iam-login-service/src/main/resources/application-oidc.yml
index 2d7a12f09..eca81a5a3 100644
--- a/iam-login-service/src/main/resources/application-oidc.yml
+++ b/iam-login-service/src/main/resources/application-oidc.yml
@@ -1,5 +1,5 @@
 #
-# Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+# Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/resources/application-prod.yml b/iam-login-service/src/main/resources/application-prod.yml
index 4a139bb89..c94c463f1 100644
--- a/iam-login-service/src/main/resources/application-prod.yml
+++ b/iam-login-service/src/main/resources/application-prod.yml
@@ -1,5 +1,5 @@
 #
-# Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+# Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -15,25 +15,27 @@
 #
 
 spring:
-  profiles:
-    include: mysql,flyway-repair
+
+  devtools:
+    add-properties: false
+    livereload:
+      enabled: false
+    restart:
+      enabled: false
+  
+  flyway:
+    locations:
+      - classpath:db/migration/mysql
+      - classpath:db/migration/prod
   
   datasource:
-    dataSourceClassName: com.mysql.jdbc.jdbc2.optional.MysqlDataSource
+    type: org.apache.tomcat.jdbc.pool.DataSource
     url: jdbc:mysql://${IAM_DB_HOST:dev.local.io}:${IAM_DB_PORT:3306}/${IAM_DB_NAME:iam}?useSSL=${IAM_DB_USE_SSL:false}
     username: ${IAM_DB_USERNAME:iam}
     password: ${IAM_DB_PASSWORD:pwd}
-    max-active: ${IAM_DB_MAX_ACTIVE:10}
-    min-idle: ${IAM_DB_MIN_IDLE:5}
-    max-idle:  ${IAM_DB_MAX_IDLE:5}
-    initial-size: ${IAM_DB_INITIAL_SIZE:2}
-    test-while-idle: ${IAM_DB_TEST_WHILE_IDLE:true}
-    test-on-borrow: ${IAM_DB_TEST_ON_BORROW:true}
-    validation-query: ${IAM_DB_VALIDATION_QUERY:SELECT 1}
-    time-between-eviction-runs-millis: ${IAM_DB_TIME_BETWEEN_EVICTION_RUNS_MILLIS:5000}
-    min-evictable-idle-time-millis: ${IAM_DB_MIN_EVICTABLE_IDLE_TIME_MILLIS:60000}
     
-flyway:
-  locations:
-    - classpath:db/migration/mysql
-    - classpath:db/migration/prod
+    hikari:
+      maximum-pool-size: ${IAM_DB_MAX_ACTIVE:50}
+      minimum-idle: ${IAM_DB_MIN_IDLE:8}
+      connection-test-query: ${IAM_DB_VALIDATION_QUERY:SELECT 1}    
+
diff --git a/iam-login-service/src/main/resources/application-saml-debug.properties b/iam-login-service/src/main/resources/application-saml-debug.properties
index e187cdf70..39eec8b67 100644
--- a/iam-login-service/src/main/resources/application-saml-debug.properties
+++ b/iam-login-service/src/main/resources/application-saml-debug.properties
@@ -1,5 +1,5 @@
 #
-# Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+# Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/resources/application-saml.yml b/iam-login-service/src/main/resources/application-saml.yml
index a799e9000..25489eb0e 100644
--- a/iam-login-service/src/main/resources/application-saml.yml
+++ b/iam-login-service/src/main/resources/application-saml.yml
@@ -1,5 +1,5 @@
 #
-# Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+# Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/resources/application-spid-test.yml b/iam-login-service/src/main/resources/application-spid-test.yml
index 223f7520c..76eab65ea 100644
--- a/iam-login-service/src/main/resources/application-spid-test.yml
+++ b/iam-login-service/src/main/resources/application-spid-test.yml
@@ -1,5 +1,5 @@
 #
-# Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+# Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/resources/application-wlcg-scopes.yml b/iam-login-service/src/main/resources/application-wlcg-scopes.yml
index 8a88c7dc9..75e1c7c26 100644
--- a/iam-login-service/src/main/resources/application-wlcg-scopes.yml
+++ b/iam-login-service/src/main/resources/application-wlcg-scopes.yml
@@ -1,5 +1,5 @@
 #
-# Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+# Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
diff --git a/iam-login-service/src/main/resources/application.properties b/iam-login-service/src/main/resources/application.properties
index 802c5928c..67a1d6df3 100644
--- a/iam-login-service/src/main/resources/application.properties
+++ b/iam-login-service/src/main/resources/application.properties
@@ -1,5 +1,5 @@
 #
-# Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+# Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -14,11 +14,41 @@
 # limitations under the License.
 #
 
-logging.level.=WARN
+# The Audit log default
+logging.level.AUDIT=INFO
+
 logging.level.root=WARN
+
 logging.level.it.infn.mw=INFO
+logging.level.org.opensaml.saml2.metadata.provider=INFO
+logging.level.org.flywaydb.core.internal.command=WARN
+logging.level.org.apache.tomcat.util.scan.StandardJarScanner=ERROR
+
+# Turn everything to DEBUG?
+#logging.level.root=DEBUG
+
+# Flyway Log
+# logging.level.org.flywaydb=DEBUG
+
+# Velocity logging (only used for SAML templates)
+# logging.level.org.apache.velocity=TRACE
+
+# Persistence engine logging
+#logging.level.org.eclipse.persistence=DEBUG
+
+# Test logging
+# logging.level.org.springframework.test=WARN
+# logging.level.org.springframework.test.web.servlet.result=DEBUG
+
+# Notification service logging
+#logging.level.it.infn.mw.iam.notification=DEBUG
+
+
+# Spring security/mvc
+# logging.level.org.springframework.security=DEBUG
+# logging.level.org.springframework.web=DEBUG
 
-#logging.level.org.springframework.security=DEBUG
-#logging.level.org.springframework.mvc=DEBUG
 # logging.level.com.fasterxml.jackson=INFO
-# logging.level.org.mitre=INFO
+# logging.level.org.apache.http.wire=DEBUG
+
+# logging.level.org.mitre=INFO
\ No newline at end of file
diff --git a/iam-login-service/src/main/resources/application.yml b/iam-login-service/src/main/resources/application.yml
index 6c85a2008..aff52fcf7 100644
--- a/iam-login-service/src/main/resources/application.yml
+++ b/iam-login-service/src/main/resources/application.yml
@@ -1,5 +1,5 @@
 #
-# Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+# Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -14,12 +14,14 @@
 # limitations under the License.
 #
 
-security:
-  filter-order: 1
-
 server:
+  error:
+    path: /error
+    
   port: ${IAM_PORT:8080}
+  
   tomcat:
+    
     accesslog:
       enabled: ${IAM_TOMCAT_ACCESS_LOG_ENABLED:false}
       directory: ${IAM_TOMCAT_ACCESS_LOG_DIRECTORY:/tmp}
@@ -27,17 +29,27 @@ server:
 
   use-forward-headers: ${IAM_USE_FORWARDED_HEADERS:false}
   
+spring:
+  application:
+    name: INDIGO IAM
+  
   session:
     timeout: ${IAM_SESSION_TIMEOUT_SECS:1800}
-
-spring: 
+     
+  security:
+    filter:
+      order: 1
+       
   profiles:
-    active: h2-test
-  application:
-    name: INDIGO IAM
+    default: h2-test
+    group:
+     "h2-test": "h2,saml,registration"
+     "mysql-test": "mysql,saml,registration"
+     "prod": "mysql,flyway-repair"
     
   jpa:
     generate-ddl: true
+    open-in-view: false
 
   mail:
     host: ${IAM_MAIL_HOST:localhost}
@@ -45,11 +57,8 @@ spring:
     username: ${IAM_MAIL_USERNAME:}
     password: ${IAM_MAIL_PASSWORD:}
 
-  velocity:
-    enabled: false
-
   freemarker:
-    template-loader-path: ${IAM_CUSTOM_TEMPLATE_LOCATION:classpath:templates/}
+    template-loader-path: ${IAM_CUSTOM_TEMPLATE_LOCATION:classpath:/email-templates}
 
 iam:
   host: ${IAM_HOST:localhost}
@@ -59,6 +68,11 @@ iam:
   
   jwk:
     keystore-location: ${IAM_KEY_STORE_LOCATION:classpath:keystore.jwks}
+    default-key-id: ${IAM_JWK_DEFAULT_KEY_ID:rsa1}
+    default-jwe-decrypt-key-id: ${IAM_JWK_DEFAULT_JWE_DECRYPT_KEY_ID:${iam.jwk.default-key-id}}
+    default-jwe-encrypt-key-id: ${IAM_JWK_DEFAULT_JWE_ENCRYPT_KEY_ID:${iam.jwk.default-key-id}}
+    default-jws-algorithm: ${IAM_JWK_DEFAULT_JWS_ALGORITHM:RS256}
+    default-jwe-algorithm: ${IAM_JWT_DEFAULT_JWE_ALGORITHM:RSA_OAEP_256} 
     
   jwt-profile:
     default-profile: ${IAM_JWT_DEFAULT_PROFILE:iam}
@@ -90,9 +104,9 @@ iam:
     include_scope: ${IAM_ACCESS_TOKEN_INCLUDE_SCOPE:false}
     include_nbf: ${IAM_ACCESS_TOKEN_INCLUDE_NBF:false}
 
-  superuser:
-    username: ${IAM_SUPERUSER_USERNAME:superuser}
-    password: ${IAM_SUPERUSER_PASSWORD:superpassword}
+  actuator-user:
+    username: ${IAM_ACTUATOR_USER_USERNAME:actuator-user}
+    password: ${IAM_ACTUATOR_USER_PASSWORD:actuator-password}
   
   local-resources:
     enable: ${IAM_LOCAL_RESOURCES_ENABLE:false}
@@ -125,6 +139,14 @@ iam:
    
   aarc-profile:
     urn-namespace: ${IAM_AARC_PROFILE_URN_NAMESPACE:example:iam}
+    
+  external-connectivity-probe:
+    enabled: ${IAM_HEALTH_EXTERNAL_CONNECTIVITY_PROBE_ENABLED:false}
+    endpoint: ${IAM_HEALTH_EXTERNAL_CONNECTIVITY_PROBE_ENDPOINT:https://www.google.it}
+    timeout-in-secs: ${IAM_HEALTH_EXTERNAL_CONNECTIVITY_PROBE_TIMEOUT_IN_SECS:10}
+    
+  account-linking:
+    enable: ${IAM_ACCOUNT_LINKING_ENABLE:true}
 
 x509:
   trustAnchorsDir: ${IAM_X509_TRUST_ANCHORS_DIR:/etc/grid-security/certificates}
@@ -151,31 +173,35 @@ task:
   approvalCleanupPeriodMsec: ${IAM_APPROVAL_CLEANUP_PERIOD_MSEC:300000}
   deviceCodeCleanupPeriodMsec: ${IAM_DEVICE_CODE_CLEANUP_PERIOD_MSEC:300000}
 
-health:
-  externalServiceProbe:
-    enabled: ${IAM_HEALTH_EXTERNAL_SERVICE_PROBE_ENABLED:true}
-    endpoint: ${IAM_HEALTH_EXTERNAL_SERVICE_PROBE_ENDPOINT:http://www.google.it}
-    timeout: ${IAM_HEALTH_EXTERNAL_SERVICE_PROBE_TIMEOUT:5000}
-    path: /health/external
-  mailProbe:
-    enabled: ${IAM_HEALTH_MAIL_PROBE_ENABLED:true}
-    path: /health/mail
-    
-accountLinking:
-  disable: ${IAM_ACCOUNT_LINKING_DISABLE:false}
 
 clientRegistration:
   allow-for: ${IAM_CLIENT_REGISTRATION_ALLOW_FOR:ANYONE}
-  
-endpoints:
-  enabled: false
-  info:
-    enabled: true
-  health:
-    enabled: true
-  metrics:
-    enabled: true
 
+management:
+  health:
+      mail:
+        enabled: ${IAM_HEALTH_MAIL_PROBE_ENABLED:false} 
+  endpoints:
+    enabled-by-default: false
+    web:
+      exposure:
+        include:
+        - info
+        - health
+  endpoint:
+    info:
+      enabled: true
+    health:
+      show-components: always 
+      enabled: true
+      show-details: when-authorized
+      roles:
+      - ADMIN
+      - ACTUATOR
+      
+    metrics:
+      enabled: true
+    
 rcauth:
   enabled: ${IAM_RCAUTH_ENABLED:false}
   label: ${IAM_RCAUTH_LABEL:RCAuth.eu online CA}
diff --git a/iam-login-service/src/main/resources/templates/accountActivated.ftl b/iam-login-service/src/main/resources/email-templates/accountActivated.ftl
similarity index 100%
rename from iam-login-service/src/main/resources/templates/accountActivated.ftl
rename to iam-login-service/src/main/resources/email-templates/accountActivated.ftl
diff --git a/iam-login-service/src/main/resources/templates/adminHandleGroupRequest.ftl b/iam-login-service/src/main/resources/email-templates/adminHandleGroupRequest.ftl
similarity index 100%
rename from iam-login-service/src/main/resources/templates/adminHandleGroupRequest.ftl
rename to iam-login-service/src/main/resources/email-templates/adminHandleGroupRequest.ftl
diff --git a/iam-login-service/src/main/resources/templates/adminHandleRequest.ftl b/iam-login-service/src/main/resources/email-templates/adminHandleRequest.ftl
similarity index 100%
rename from iam-login-service/src/main/resources/templates/adminHandleRequest.ftl
rename to iam-login-service/src/main/resources/email-templates/adminHandleRequest.ftl
diff --git a/iam-login-service/src/main/resources/templates/confirmRegistration.ftl b/iam-login-service/src/main/resources/email-templates/confirmRegistration.ftl
similarity index 100%
rename from iam-login-service/src/main/resources/templates/confirmRegistration.ftl
rename to iam-login-service/src/main/resources/email-templates/confirmRegistration.ftl
diff --git a/iam-login-service/src/main/resources/templates/groupMembershipApproved.ftl b/iam-login-service/src/main/resources/email-templates/groupMembershipApproved.ftl
similarity index 100%
rename from iam-login-service/src/main/resources/templates/groupMembershipApproved.ftl
rename to iam-login-service/src/main/resources/email-templates/groupMembershipApproved.ftl
diff --git a/iam-login-service/src/main/resources/templates/groupMembershipRejected.ftl b/iam-login-service/src/main/resources/email-templates/groupMembershipRejected.ftl
similarity index 100%
rename from iam-login-service/src/main/resources/templates/groupMembershipRejected.ftl
rename to iam-login-service/src/main/resources/email-templates/groupMembershipRejected.ftl
diff --git a/iam-login-service/src/main/resources/templates/requestRejected.ftl b/iam-login-service/src/main/resources/email-templates/requestRejected.ftl
similarity index 100%
rename from iam-login-service/src/main/resources/templates/requestRejected.ftl
rename to iam-login-service/src/main/resources/email-templates/requestRejected.ftl
diff --git a/iam-login-service/src/main/resources/templates/resetPassword.ftl b/iam-login-service/src/main/resources/email-templates/resetPassword.ftl
similarity index 100%
rename from iam-login-service/src/main/resources/templates/resetPassword.ftl
rename to iam-login-service/src/main/resources/email-templates/resetPassword.ftl
diff --git a/iam-login-service/src/main/resources/keystore.jwks b/iam-login-service/src/main/resources/keystore.jwks
index 1728bc0dc..b0d97f4e8 100644
--- a/iam-login-service/src/main/resources/keystore.jwks
+++ b/iam-login-service/src/main/resources/keystore.jwks
@@ -1,16 +1,16 @@
 {
   "keys": [
     {
-      "p": "59LvF80yUJjKmOXSyv8pLxWEFXrpDGMxp6V80OQvUMsllkFmiDSBpuYDIg-wGYABxLR7Bt3gelvXGvkC6emwZw",
+      "p": "-qdvzeHU7w_ToV2RlS2QlVggXNL2YfpRWQxvrO8pHZC_dVgYFwKz5nadOMzR1BK0tPuCTWuuI66sFgaA9VENGypdIYoCF2O1FBLFK6GjOO-uc0LZEbIDa6Xn0G7UYOWcLaiYriHTtC_Pzp11L7VGjrUlX4HRgU_B3X1oeGn0mbM",
       "kty": "RSA",
-      "q": "r36WDa-C-c2oxmWV60bKQC7IuRLmt5fN5z7LZNKXXU5DszDl-Do7i3y92Svo43AyLYvETeadYHpRYGYx9nmDJQ",
-      "d": "EJf5HQM3BRK76KikZ-Dzx7i71K80DJ-WUOoURPgdIxz4JTNRSjn_CBX2XMeraiCx4ffnRv41S6_4GAHg8RPes6I8z1ZoSJHrCO8V6fU2Yx_bJmSgFdvXNMA__zwtpSZohhA6icMOYShNDe6SgPH4GKD6hhE2IWFmhQSkNw9NMEk",
+      "q": "5S2b9tYHi9zBcNGZ8X6GM4TAL4UU9mABH0rKIyzbudkG7Wxxbj6I18skuHzfOOPI4c8sTQSv6IVAr2n1bn3_E5RSyPpbtDSCTYGzhijXl9wZ0ba2NidFrVjnL-KPx_gcHKnUHebKvsIEdjxeuqaaZ1kqEJX326b450Frghd78p8",
+      "d": "oDb1qfQTaP73jEZHgkOG5C9dY5EJZW57fX_BYUJ-yYTuTHPWZBVDKw9I_Ir1tSYyuTF-Bfb4iPim46gnEBM3AdvMian2iajvrN_rJFUJHo65vtY9xCXCD0d_Jct5JMyOafP5LF3cP38yDcyZRS_JeyKGB6U1KhbL-gG4hrQGS8qO3rdY_JQiLDLVdRRptHsPphS44JHXdP2qeVNJ41-CTfPWKiMIUOC0fj-As-dbTzRXuLXs04NayAdM-yhvRiwKujEfL8YbKW9CDJIgJfm2vzWHXFus5Y11S2Zr65cWxxVvRfnAFbFO1AkIkJc2jHZ4xLxfDU2kTi20sOMq1UFrvQ",
       "e": "AQAB",
       "kid": "rsa1",
-      "qi": "oeMVzIMRn1EZBJ70avR_PxqaZqR-1KIkCUUpA9ZHICCqvlMMRNkBz67BTd4dnxiuQnW_1ofMK93fFwdHrnkCJQ",
-      "dp": "0VV01y5Qr9y4nUZyiSHN45lvMyJQzQHJddQGmG5kl3VJlJur5XRcWwQ6cghugShI8IH00eeK65KA8_dFfUmrIw",
-      "dq": "iKk_-rpReWww4Qacn5IJz79e6diROCkL2-cnhoUEAFIBIFqUyx-13OKwCJ1MB0kImjU8EhnjNg0qr7IFeFWZzQ",
-      "n": "nuvTJO-6RxIbIyYpPvAWeLSZ4o8o9T_lFU0ltiqAlp5eR-ID36aPqMvBGnNOcTVPcoFpfmQL5INgoWNJGTUm7pWTpV1wZjZe7PX6dFBhRe8SQQ0yb5SVc29-sX1QK-Cg7gKTe0l7Wrhve2vazHH1uYEqLUoTVnGsAx1nzL66M-M"
+      "qi": "bN1wnq_0VkJlECMGPmeRFdZCX2LgAMrgwbJpysRw5J04vO9YsVmAcB_4xqoDjDUg7koioAp3IOhMGjOJWpYzCqWzsaA_84kX4WKGsr2xz6oaFSgt1FvtBY4GqEeZj8RG0LMtEtKSyjHGieA0hd4TUcqSdNZ4osT98Bfd7z3peYc",
+      "dp": "YfyaxI2IRHyXavm9M-hAIWH2JNOD5gGJU5p8_cnw9NHlRuZNZJF16p5sEAxh6tn1MtsvsTxrMx_RvjqEp2IsEXaaOcZN0v7zhwlfcxMZT-TC-eQkH7rLg4Wz_dOVytt4FpFWPpySuloGjusXKLNhBeDi31dMo5SeYQvpj0k8iek",
+      "dq": "9_lhyLPNdohmxqwE5kkA7L23NbPJ-svmavWBwo3HMlCiLkQoeCEx8EzebsCux9-wfKSuSqfHrtCALU15QxUR6x2SdeRvVY17cGHm3kNTA_4j8cbBYdccjXSksitzZ-wOfvVDjxcqST2llkm8NjoO18Siv0-F4SXKLG-c5CaE9w",
+      "n": "4GRvJuFantVV3JdjwQOAkfREnwUFp2znRBTOIJhPamyH4gf4YlI5PQT79415NV4_HrWYzgooH5AK6-7WE-TLLGEAVK5vdk4vv79bG7ukvjvBPxAjEhQn6-Amln88iXtvicEGbh--3CKbQj1jryVU5aWM6jzweaabFSeCILVEd6ZT7ofXaAqan9eLzU5IEtTPy5MfrrOvWw5Q7D2yzMqc5LksmaQSw8XtmhA8gnENnIqjAMmPtRltf93wjtmiamgVENOVPdN-93Nd5w-pnMwEyoO6Q9JqXxV6lD6qBRxI7_5t4_vmVxcbbxcZbSAMoHqA2pbSMJ4Jcw-27Hct9jesLQ"
     }
   ]
-}
\ No newline at end of file
+}
diff --git a/iam-login-service/src/main/resources/saml/iam.local.io.metadata.xml b/iam-login-service/src/main/resources/saml/iam.local.io.metadata.xml
index b5531449d..516af82f8 100644
--- a/iam-login-service/src/main/resources/saml/iam.local.io.metadata.xml
+++ b/iam-login-service/src/main/resources/saml/iam.local.io.metadata.xml
@@ -1,7 +1,7 @@
 
 
-      2.8.5
     
 
     
diff --git a/iam-persistence/src/main/java/db/migration/h2/V10_1__Password_Update.java b/iam-persistence/src/main/java/db/migration/h2/V10_1__Password_Update.java
index 42d6ac8b9..9d36c9546 100644
--- a/iam-persistence/src/main/java/db/migration/h2/V10_1__Password_Update.java
+++ b/iam-persistence/src/main/java/db/migration/h2/V10_1__Password_Update.java
@@ -15,17 +15,18 @@
  */
 package db.migration.h2;
 
+import org.springframework.dao.DataAccessException;
 import org.springframework.jdbc.core.JdbcTemplate;
 import org.springframework.jdbc.support.rowset.SqlRowSet;
 import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
 import org.springframework.security.crypto.password.PasswordEncoder;
 
-import it.infn.mw.iam.persistence.migrations.BaseJdbcTemplateFlywayMigration;
+import it.infn.mw.iam.persistence.migrations.BaseFlywayJavaMigrationAdapter;
 
-public class V10_1__Password_Update extends BaseJdbcTemplateFlywayMigration {
+public class V10_1__Password_Update extends BaseFlywayJavaMigrationAdapter {
 
   @Override
-  public void migrate(JdbcTemplate jdbcTemplate) throws Exception {
+  public void migrate(JdbcTemplate jdbcTemplate) throws DataAccessException {
 
     PasswordEncoder passwordEncoder = new BCryptPasswordEncoder();
 
diff --git a/iam-persistence/src/main/java/db/migration/h2/V10_2___CheckDuplicateEmails.java b/iam-persistence/src/main/java/db/migration/h2/V10_2___CheckDuplicateEmails.java
index 5b2d9d07a..6ef7ba036 100644
--- a/iam-persistence/src/main/java/db/migration/h2/V10_2___CheckDuplicateEmails.java
+++ b/iam-persistence/src/main/java/db/migration/h2/V10_2___CheckDuplicateEmails.java
@@ -20,17 +20,18 @@
 
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
+import org.springframework.dao.DataAccessException;
 import org.springframework.jdbc.core.JdbcTemplate;
 import org.springframework.jdbc.support.rowset.SqlRowSet;
 
-import it.infn.mw.iam.persistence.migrations.BaseJdbcTemplateFlywayMigration;
+import it.infn.mw.iam.persistence.migrations.BaseFlywayJavaMigrationAdapter;
 
-public class V10_2___CheckDuplicateEmails extends BaseJdbcTemplateFlywayMigration {
+public class V10_2___CheckDuplicateEmails extends BaseFlywayJavaMigrationAdapter {
 
   public static final Logger LOG = LoggerFactory.getLogger(V10_2___CheckDuplicateEmails.class);
 
   @Override
-  public void migrate(JdbcTemplate jdbcTemplate) throws Exception {
+  public void migrate(JdbcTemplate jdbcTemplate) throws DataAccessException {
 
     SqlRowSet rowSet = jdbcTemplate
       .queryForRowSet("SELECT email from iam_user_info group by email having count(email) > 1");
diff --git a/iam-persistence/src/main/java/db/migration/h2/V23___CreateGroupManagerAuthorities.java b/iam-persistence/src/main/java/db/migration/h2/V23___CreateGroupManagerAuthorities.java
index 4f70d5c21..d5c979315 100644
--- a/iam-persistence/src/main/java/db/migration/h2/V23___CreateGroupManagerAuthorities.java
+++ b/iam-persistence/src/main/java/db/migration/h2/V23___CreateGroupManagerAuthorities.java
@@ -15,10 +15,11 @@
  */
 package db.migration.h2;
 
+import org.springframework.dao.DataAccessException;
 import org.springframework.jdbc.core.JdbcTemplate;
 
-import it.infn.mw.iam.persistence.migrations.BaseJdbcTemplateFlywayMigration;
-import it.infn.mw.iam.persistence.migrations.CreateGroupManagerAuthorities;
+import db.migration.tasks.CreateGroupManagerAuthorities;
+import it.infn.mw.iam.persistence.migrations.BaseFlywayJavaMigrationAdapter;
 
 /**
  * 
@@ -26,10 +27,10 @@
  * will never be groups to migrate. See the test folder for the actual migration
  *
  */
-public class V23___CreateGroupManagerAuthorities extends BaseJdbcTemplateFlywayMigration {
+public class V23___CreateGroupManagerAuthorities extends BaseFlywayJavaMigrationAdapter {
 
   @Override
-  public void migrate(JdbcTemplate jdbcTemplate) throws Exception {
+  public void migrate(JdbcTemplate jdbcTemplate) throws DataAccessException {
     CreateGroupManagerAuthorities task = new CreateGroupManagerAuthorities();
     task.migrate(jdbcTemplate);
   }
diff --git a/iam-persistence/src/main/java/db/migration/h2/V34_2___RemoveOrphanTokens.java b/iam-persistence/src/main/java/db/migration/h2/V34_2___RemoveOrphanTokens.java
index 404441238..1009fc2ed 100644
--- a/iam-persistence/src/main/java/db/migration/h2/V34_2___RemoveOrphanTokens.java
+++ b/iam-persistence/src/main/java/db/migration/h2/V34_2___RemoveOrphanTokens.java
@@ -15,15 +15,16 @@
  */
 package db.migration.h2;
 
+import org.springframework.dao.DataAccessException;
 import org.springframework.jdbc.core.JdbcTemplate;
 
 import db.migration.tasks.RemoveOrphanTokens;
-import it.infn.mw.iam.persistence.migrations.BaseJdbcTemplateFlywayMigration;
+import it.infn.mw.iam.persistence.migrations.BaseFlywayJavaMigrationAdapter;
 
-public class V34_2___RemoveOrphanTokens extends BaseJdbcTemplateFlywayMigration {
+public class V34_2___RemoveOrphanTokens extends BaseFlywayJavaMigrationAdapter {
 
   @Override
-  public void migrate(JdbcTemplate jdbcTemplate) throws Exception {
+  public void migrate(JdbcTemplate jdbcTemplate) throws DataAccessException {
 
     RemoveOrphanTokens task = new RemoveOrphanTokens();
     task.migrate(jdbcTemplate);
diff --git a/iam-persistence/src/main/java/db/migration/mysql/V10_1__Password_Update.java b/iam-persistence/src/main/java/db/migration/mysql/V10_1__Password_Update.java
index 9a81c7d29..ab9424a73 100644
--- a/iam-persistence/src/main/java/db/migration/mysql/V10_1__Password_Update.java
+++ b/iam-persistence/src/main/java/db/migration/mysql/V10_1__Password_Update.java
@@ -15,17 +15,18 @@
  */
 package db.migration.mysql;
 
+import org.springframework.dao.DataAccessException;
 import org.springframework.jdbc.core.JdbcTemplate;
 import org.springframework.jdbc.support.rowset.SqlRowSet;
 import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
 import org.springframework.security.crypto.password.PasswordEncoder;
 
-import it.infn.mw.iam.persistence.migrations.BaseJdbcTemplateFlywayMigration;
+import it.infn.mw.iam.persistence.migrations.BaseFlywayJavaMigrationAdapter;
 
-public class V10_1__Password_Update extends BaseJdbcTemplateFlywayMigration {
+public class V10_1__Password_Update extends BaseFlywayJavaMigrationAdapter {
 
   @Override
-  public void migrate(JdbcTemplate jdbcTemplate) throws Exception {
+  public void migrate(JdbcTemplate jdbcTemplate) throws DataAccessException {
 
     PasswordEncoder passwordEncoder = new BCryptPasswordEncoder();
 
diff --git a/iam-persistence/src/main/java/db/migration/mysql/V10_2___CheckDuplicateEmails.java b/iam-persistence/src/main/java/db/migration/mysql/V10_2___CheckDuplicateEmails.java
index 9d7dcf5af..da31706f2 100644
--- a/iam-persistence/src/main/java/db/migration/mysql/V10_2___CheckDuplicateEmails.java
+++ b/iam-persistence/src/main/java/db/migration/mysql/V10_2___CheckDuplicateEmails.java
@@ -20,17 +20,18 @@
 
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
+import org.springframework.dao.DataAccessException;
 import org.springframework.jdbc.core.JdbcTemplate;
 import org.springframework.jdbc.support.rowset.SqlRowSet;
 
-import it.infn.mw.iam.persistence.migrations.BaseJdbcTemplateFlywayMigration;
+import it.infn.mw.iam.persistence.migrations.BaseFlywayJavaMigrationAdapter;
 
-public class V10_2___CheckDuplicateEmails extends BaseJdbcTemplateFlywayMigration {
+public class V10_2___CheckDuplicateEmails extends BaseFlywayJavaMigrationAdapter {
 
   public static final Logger LOG = LoggerFactory.getLogger(V10_2___CheckDuplicateEmails.class);
 
   @Override
-  public void migrate(JdbcTemplate jdbcTemplate) throws Exception {
+  public void migrate(JdbcTemplate jdbcTemplate) throws DataAccessException {
 
     SqlRowSet rowSet = jdbcTemplate
       .queryForRowSet("SELECT email from iam_user_info group by email having count(email) > 1");
diff --git a/iam-persistence/src/main/java/db/migration/mysql/V23___CreateGroupManagerAuthorities.java b/iam-persistence/src/main/java/db/migration/mysql/V23___CreateGroupManagerAuthorities.java
index 743ce7d5d..e46e1b3ac 100644
--- a/iam-persistence/src/main/java/db/migration/mysql/V23___CreateGroupManagerAuthorities.java
+++ b/iam-persistence/src/main/java/db/migration/mysql/V23___CreateGroupManagerAuthorities.java
@@ -17,18 +17,19 @@
 
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
+import org.springframework.dao.DataAccessException;
 import org.springframework.jdbc.core.JdbcTemplate;
 
-import it.infn.mw.iam.persistence.migrations.BaseJdbcTemplateFlywayMigration;
-import it.infn.mw.iam.persistence.migrations.CreateGroupManagerAuthorities;
+import db.migration.tasks.CreateGroupManagerAuthorities;
+import it.infn.mw.iam.persistence.migrations.BaseFlywayJavaMigrationAdapter;
 
-public class V23___CreateGroupManagerAuthorities extends BaseJdbcTemplateFlywayMigration {
+public class V23___CreateGroupManagerAuthorities extends BaseFlywayJavaMigrationAdapter {
 
   public static final Logger LOG =
       LoggerFactory.getLogger(V23___CreateGroupManagerAuthorities.class);
 
   @Override
-  public void migrate(JdbcTemplate jdbcTemplate) throws Exception {
+  public void migrate(JdbcTemplate jdbcTemplate) throws DataAccessException {
     CreateGroupManagerAuthorities task = new CreateGroupManagerAuthorities();
     task.migrate(jdbcTemplate);
   }
diff --git a/iam-persistence/src/main/java/db/migration/mysql/V34_2___RemoveOrphanTokens.java b/iam-persistence/src/main/java/db/migration/mysql/V34_2___RemoveOrphanTokens.java
index d4d0ead39..fc4c74ebc 100644
--- a/iam-persistence/src/main/java/db/migration/mysql/V34_2___RemoveOrphanTokens.java
+++ b/iam-persistence/src/main/java/db/migration/mysql/V34_2___RemoveOrphanTokens.java
@@ -15,15 +15,16 @@
  */
 package db.migration.mysql;
 
+import org.springframework.dao.DataAccessException;
 import org.springframework.jdbc.core.JdbcTemplate;
 
 import db.migration.tasks.RemoveOrphanTokens;
-import it.infn.mw.iam.persistence.migrations.BaseJdbcTemplateFlywayMigration;
+import it.infn.mw.iam.persistence.migrations.BaseFlywayJavaMigrationAdapter;
 
-public class V34_2___RemoveOrphanTokens extends BaseJdbcTemplateFlywayMigration {
+public class V34_2___RemoveOrphanTokens extends BaseFlywayJavaMigrationAdapter {
 
   @Override
-  public void migrate(JdbcTemplate jdbcTemplate) throws Exception {
+  public void migrate(JdbcTemplate jdbcTemplate) throws DataAccessException {
 
     RemoveOrphanTokens task = new RemoveOrphanTokens();
     task.migrate(jdbcTemplate);
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/migrations/CreateGroupManagerAuthorities.java b/iam-persistence/src/main/java/db/migration/tasks/CreateGroupManagerAuthorities.java
similarity index 81%
rename from iam-persistence/src/main/java/it/infn/mw/iam/persistence/migrations/CreateGroupManagerAuthorities.java
rename to iam-persistence/src/main/java/db/migration/tasks/CreateGroupManagerAuthorities.java
index 0ed330e75..e87a990b6 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/migrations/CreateGroupManagerAuthorities.java
+++ b/iam-persistence/src/main/java/db/migration/tasks/CreateGroupManagerAuthorities.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -13,19 +13,22 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package it.infn.mw.iam.persistence.migrations;
+package db.migration.tasks;
 
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
+import org.springframework.dao.DataAccessException;
 import org.springframework.jdbc.core.JdbcTemplate;
 import org.springframework.jdbc.support.rowset.SqlRowSet;
 
-public class CreateGroupManagerAuthorities extends BaseJdbcTemplateFlywayMigration {
+import it.infn.mw.iam.persistence.migrations.SpringJdbcFlywayMigration;
+
+public class CreateGroupManagerAuthorities implements SpringJdbcFlywayMigration {
 
   public static final Logger LOG = LoggerFactory.getLogger(CreateGroupManagerAuthorities.class);
 
   @Override
-  public void migrate(JdbcTemplate jdbcTemplate) throws Exception {
+  public void migrate(JdbcTemplate jdbcTemplate) throws DataAccessException {
     SqlRowSet rowSet = jdbcTemplate.queryForRowSet("SELECT id,uuid,name from iam_group");
 
     while (rowSet.next()) {
diff --git a/iam-persistence/src/main/java/db/migration/tasks/RemoveOrphanTokens.java b/iam-persistence/src/main/java/db/migration/tasks/RemoveOrphanTokens.java
index 538635e0d..3100c999c 100644
--- a/iam-persistence/src/main/java/db/migration/tasks/RemoveOrphanTokens.java
+++ b/iam-persistence/src/main/java/db/migration/tasks/RemoveOrphanTokens.java
@@ -17,11 +17,12 @@
 
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
+import org.springframework.dao.DataAccessException;
 import org.springframework.jdbc.core.JdbcTemplate;
 
-import it.infn.mw.iam.persistence.migrations.BaseJdbcTemplateFlywayMigration;
+import it.infn.mw.iam.persistence.migrations.SpringJdbcFlywayMigration;
 
-public class RemoveOrphanTokens extends BaseJdbcTemplateFlywayMigration {
+public class RemoveOrphanTokens implements SpringJdbcFlywayMigration {
 
   public static final Logger LOG = LoggerFactory.getLogger(RemoveOrphanTokens.class);
 
@@ -41,7 +42,7 @@ public class RemoveOrphanTokens extends BaseJdbcTemplateFlywayMigration {
       "DELETE FROM refresh_token WHERE auth_holder_id NOT IN (SELECT id FROM authentication_holder)";
 
   @Override
-  public void migrate(JdbcTemplate jdbcTemplate) throws Exception {
+  public void migrate(JdbcTemplate jdbcTemplate) throws DataAccessException {
 
     int updateResult = jdbcTemplate.update(DELETE_ACCESS_TOKENS_OF_DELETED_USERS);
     LOG.info("Removed {} access tokens owned by deleted users", updateResult);
diff --git a/iam-persistence/src/main/java/db/migration/test/V100000_1___CreateGroupManagerAuthorities.java b/iam-persistence/src/main/java/db/migration/test/V100000_1___CreateGroupManagerAuthorities.java
index cfc2a6de4..1a1bdd859 100644
--- a/iam-persistence/src/main/java/db/migration/test/V100000_1___CreateGroupManagerAuthorities.java
+++ b/iam-persistence/src/main/java/db/migration/test/V100000_1___CreateGroupManagerAuthorities.java
@@ -15,15 +15,16 @@
  */
 package db.migration.test;
 
-import org.flywaydb.core.api.migration.spring.SpringJdbcMigration;
+import org.springframework.dao.DataAccessException;
 import org.springframework.jdbc.core.JdbcTemplate;
 
-import it.infn.mw.iam.persistence.migrations.CreateGroupManagerAuthorities;
+import db.migration.tasks.CreateGroupManagerAuthorities;
+import it.infn.mw.iam.persistence.migrations.BaseFlywayJavaMigrationAdapter;
 
-public class V100000_1___CreateGroupManagerAuthorities implements SpringJdbcMigration {
+public class V100000_1___CreateGroupManagerAuthorities extends BaseFlywayJavaMigrationAdapter {
 
   @Override
-  public void migrate(JdbcTemplate jdbcTemplate) throws Exception {
+  public void migrate(JdbcTemplate jdbcTemplate) throws DataAccessException {
     CreateGroupManagerAuthorities task = new CreateGroupManagerAuthorities();
     task.migrate(jdbcTemplate);
   }
diff --git a/iam-persistence/src/main/java/db/migration/test/V100000_3___RemoveOrphanTokens.java b/iam-persistence/src/main/java/db/migration/test/V100000_3___RemoveOrphanTokens.java
index b50f81973..2d8d3c9fb 100644
--- a/iam-persistence/src/main/java/db/migration/test/V100000_3___RemoveOrphanTokens.java
+++ b/iam-persistence/src/main/java/db/migration/test/V100000_3___RemoveOrphanTokens.java
@@ -15,15 +15,16 @@
  */
 package db.migration.test;
 
-import org.flywaydb.core.api.migration.spring.SpringJdbcMigration;
+import org.springframework.dao.DataAccessException;
 import org.springframework.jdbc.core.JdbcTemplate;
 
 import db.migration.tasks.RemoveOrphanTokens;
+import it.infn.mw.iam.persistence.migrations.BaseFlywayJavaMigrationAdapter;
 
-public class V100000_3___RemoveOrphanTokens implements SpringJdbcMigration {
+public class V100000_3___RemoveOrphanTokens extends BaseFlywayJavaMigrationAdapter {
 
   @Override
-  public void migrate(JdbcTemplate jdbcTemplate) throws Exception {
+  public void migrate(JdbcTemplate jdbcTemplate) throws DataAccessException {
 
     RemoveOrphanTokens task = new RemoveOrphanTokens();
     task.migrate(jdbcTemplate);
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/core/IamDeliveryStatus.java b/iam-persistence/src/main/java/it/infn/mw/iam/core/IamDeliveryStatus.java
index a1d322a3b..7c8b7d91e 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/core/IamDeliveryStatus.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/core/IamDeliveryStatus.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/core/IamGroupRequestStatus.java b/iam-persistence/src/main/java/it/infn/mw/iam/core/IamGroupRequestStatus.java
index 54f514e28..4e21b422e 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/core/IamGroupRequestStatus.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/core/IamGroupRequestStatus.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/core/IamNotificationType.java b/iam-persistence/src/main/java/it/infn/mw/iam/core/IamNotificationType.java
index 14ae53817..971ae61be 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/core/IamNotificationType.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/core/IamNotificationType.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/core/IamRegistrationRequestStatus.java b/iam-persistence/src/main/java/it/infn/mw/iam/core/IamRegistrationRequestStatus.java
index 99322e334..6cfadbb25 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/core/IamRegistrationRequestStatus.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/core/IamRegistrationRequestStatus.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/core/NameUtils.java b/iam-persistence/src/main/java/it/infn/mw/iam/core/NameUtils.java
index edee476b8..a66a61961 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/core/NameUtils.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/core/NameUtils.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/migrations/BaseFlywayJavaMigrationAdapter.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/migrations/BaseFlywayJavaMigrationAdapter.java
new file mode 100644
index 000000000..3d6cd4753
--- /dev/null
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/migrations/BaseFlywayJavaMigrationAdapter.java
@@ -0,0 +1,35 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.infn.mw.iam.persistence.migrations;
+
+import org.flywaydb.core.api.migration.BaseJavaMigration;
+import org.flywaydb.core.api.migration.Context;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.jdbc.datasource.SingleConnectionDataSource;
+
+public abstract class BaseFlywayJavaMigrationAdapter extends BaseJavaMigration
+    implements SpringJdbcFlywayMigration {
+
+  protected JdbcTemplate templateFromContext(Context context) {
+    return new JdbcTemplate(new SingleConnectionDataSource(context.getConnection(), true));
+  }
+
+  @Override
+  public void migrate(Context context) throws Exception {
+    migrate(templateFromContext(context));
+  }
+
+}
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/migrations/BaseJdbcTemplateFlywayMigration.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/migrations/SpringJdbcFlywayMigration.java
similarity index 73%
rename from iam-persistence/src/main/java/it/infn/mw/iam/persistence/migrations/BaseJdbcTemplateFlywayMigration.java
rename to iam-persistence/src/main/java/it/infn/mw/iam/persistence/migrations/SpringJdbcFlywayMigration.java
index 9c7bd3589..57f820372 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/migrations/BaseJdbcTemplateFlywayMigration.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/migrations/SpringJdbcFlywayMigration.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -15,12 +15,11 @@
  */
 package it.infn.mw.iam.persistence.migrations;
 
-import org.flywaydb.core.api.migration.spring.SpringJdbcMigration;
-
-public abstract class BaseJdbcTemplateFlywayMigration implements SpringJdbcMigration {
-
-
-
+import org.springframework.dao.DataAccessException;
+import org.springframework.jdbc.core.JdbcTemplate;
 
+@FunctionalInterface
+public interface SpringJdbcFlywayMigration {
 
+  void migrate(JdbcTemplate jdbcTemplate) throws DataAccessException;
 }
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/Address.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/Address.java
index 332d405e9..a81fe77fc 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/Address.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/Address.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAccount.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAccount.java
index 46a9071c8..0c2468248 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAccount.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAccount.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAccountGroupKey.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAccountGroupKey.java
index 57249039c..e29667dec 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAccountGroupKey.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAccountGroupKey.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAccountGroupMembership.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAccountGroupMembership.java
index 37fdab5e2..ec61df58c 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAccountGroupMembership.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAccountGroupMembership.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -15,6 +15,7 @@
  */
 package it.infn.mw.iam.persistence.model;
 
+import java.io.Serializable;
 import java.time.Instant;
 import java.util.Date;
 
@@ -31,7 +32,10 @@
 
 @Entity
 @Table(name = "iam_account_group")
-public class IamAccountGroupMembership implements Comparable {
+public class IamAccountGroupMembership
+    implements Comparable, Serializable {
+
+  private static final long serialVersionUID = 1L;
 
   @EmbeddedId
   private IamAccountGroupKey id;
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAccountRef.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAccountRef.java
index 874ee2d5c..559fb4984 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAccountRef.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAccountRef.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAddress.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAddress.java
index aca8361c9..d687b63f9 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAddress.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAddress.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAttribute.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAttribute.java
index 5c91999e5..ad5a5784d 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAttribute.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAttribute.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAup.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAup.java
index 4ba1375a7..c39a926e2 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAup.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAup.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAupSignature.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAupSignature.java
index ac2a2d0e9..be4c74ade 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAupSignature.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAupSignature.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAuthority.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAuthority.java
index 7524f95b0..ebc2c1f9e 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAuthority.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAuthority.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamClientMatchingPolicy.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamClientMatchingPolicy.java
index 042c1099b..5e77fef42 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamClientMatchingPolicy.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamClientMatchingPolicy.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -15,6 +15,7 @@
  */
 package it.infn.mw.iam.persistence.model;
 
+import java.io.Serializable;
 import java.util.Objects;
 
 import javax.annotation.Generated;
@@ -24,7 +25,10 @@
 import javax.persistence.Enumerated;
 
 @Embeddable
-public class IamClientMatchingPolicy {
+public class IamClientMatchingPolicy implements Serializable {
+
+  private static final long serialVersionUID = 1L;
+
 
   public enum ClientMatchingPolicyType {
     ANY,
@@ -40,11 +44,6 @@ public enum ClientMatchingPolicyType {
   String matchParam;
 
 
-  public IamClientMatchingPolicy() {
-
-  }
-
-
   @Override
   public int hashCode() {
     return Objects.hash(matchParam, type);
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamEmailNotification.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamEmailNotification.java
index 88a265bdb..38544895b 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamEmailNotification.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamEmailNotification.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamExternalAuthenticationAttribute.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamExternalAuthenticationAttribute.java
index 7e00663fa..230993bd7 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamExternalAuthenticationAttribute.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamExternalAuthenticationAttribute.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamExternalAuthenticationDetails.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamExternalAuthenticationDetails.java
index c867b5418..16f0b5e30 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamExternalAuthenticationDetails.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamExternalAuthenticationDetails.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamGroup.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamGroup.java
index 19fecff24..3f12cd405 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamGroup.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamGroup.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamGroupRequest.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamGroupRequest.java
index e8c487a18..54a881a77 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamGroupRequest.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamGroupRequest.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamLabel.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamLabel.java
index f7182a92a..c5701e6cd 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamLabel.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamLabel.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamNotificationReceiver.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamNotificationReceiver.java
index 54db54306..b4503c785 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamNotificationReceiver.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamNotificationReceiver.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamOidcId.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamOidcId.java
index 14bec8554..82c125ae2 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamOidcId.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamOidcId.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamRegistrationRequest.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamRegistrationRequest.java
index e70446c11..d03e00944 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamRegistrationRequest.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamRegistrationRequest.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamSamlId.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamSamlId.java
index 84aff0ea5..592874ea1 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamSamlId.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamSamlId.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamScopeMatchingPolicy.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamScopeMatchingPolicy.java
index 4ed140da8..3520afaf5 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamScopeMatchingPolicy.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamScopeMatchingPolicy.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamScopePolicy.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamScopePolicy.java
index 686ddaccd..f2605ae70 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamScopePolicy.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamScopePolicy.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamSshKey.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamSshKey.java
index 412052b32..4744fa8fe 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamSshKey.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamSshKey.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTokenExchangePolicyEntity.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTokenExchangePolicyEntity.java
index f92ceb7aa..792a24375 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTokenExchangePolicyEntity.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTokenExchangePolicyEntity.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -22,7 +22,6 @@
 import java.util.Set;
 
 import javax.persistence.AttributeOverride;
-import javax.persistence.AttributeOverrides;
 import javax.persistence.CollectionTable;
 import javax.persistence.Column;
 import javax.persistence.ElementCollection;
@@ -62,20 +61,16 @@ public class IamTokenExchangePolicyEntity implements Serializable {
   private PolicyRule rule;
 
   @Embedded
-  @AttributeOverrides({
-      @AttributeOverride(name = "type",
-          column = @Column(name = "origin_m_type", nullable = false, length = 8)),
-      @AttributeOverride(name = "matchParam",
-          column = @Column(name = "origin_m_param", length = 256))})
+  @AttributeOverride(name = "type",
+      column = @Column(name = "origin_m_type", nullable = false, length = 8))
+  @AttributeOverride(name = "matchParam", column = @Column(name = "origin_m_param", length = 256))
   private IamClientMatchingPolicy originClient;
 
 
   @Embedded
-  @AttributeOverrides({
-      @AttributeOverride(name = "type",
-          column = @Column(name = "dest_m_type", nullable = false, length = 8)),
-      @AttributeOverride(name = "matchParam",
-          column = @Column(name = "dest_m_param", length = 256))})
+  @AttributeOverride(name = "type",
+      column = @Column(name = "dest_m_type", nullable = false, length = 8))
+  @AttributeOverride(name = "matchParam", column = @Column(name = "dest_m_param", length = 256))
   private IamClientMatchingPolicy destinationClient;
 
 
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTokenExchangeScopePolicy.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTokenExchangeScopePolicy.java
index 7c5cd310f..14ebf1426 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTokenExchangeScopePolicy.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTokenExchangeScopePolicy.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -15,6 +15,7 @@
  */
 package it.infn.mw.iam.persistence.model;
 
+import java.io.Serializable;
 import java.util.Objects;
 
 import javax.persistence.Column;
@@ -24,7 +25,9 @@
 
 
 @Embeddable
-public class IamTokenExchangeScopePolicy {
+public class IamTokenExchangeScopePolicy implements Serializable {
+
+  private static final long serialVersionUID = 1L;
 
   @Enumerated(EnumType.STRING)
   @Column(name = "rule", nullable = false, length = 6)
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamUserInfo.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamUserInfo.java
index c58a5a116..b76cc385b 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamUserInfo.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamUserInfo.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamX509Certificate.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamX509Certificate.java
index 33a282b84..f394cf0ed 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamX509Certificate.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamX509Certificate.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamX509ProxyCertificate.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamX509ProxyCertificate.java
index bde960c45..68034896b 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamX509ProxyCertificate.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamX509ProxyCertificate.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/PolicyRule.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/PolicyRule.java
index 4c66a91d3..b1b5a428f 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/PolicyRule.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/PolicyRule.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamAccountRepository.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamAccountRepository.java
index f1ea4ca27..2a20c853d 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamAccountRepository.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamAccountRepository.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamAccountRepositoryCustom.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamAccountRepositoryCustom.java
index 0b1feab61..a751db455 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamAccountRepositoryCustom.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamAccountRepositoryCustom.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamAccountRepositoryImpl.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamAccountRepositoryImpl.java
index dba494277..ffa1db110 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamAccountRepositoryImpl.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamAccountRepositoryImpl.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamAupRepository.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamAupRepository.java
index 2123425e8..71e3e8961 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamAupRepository.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamAupRepository.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamAupRepositoryCustom.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamAupRepositoryCustom.java
index c8d411127..291d02690 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamAupRepositoryCustom.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamAupRepositoryCustom.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamAupRepositoryImpl.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamAupRepositoryImpl.java
index 0d1b139d3..145d7bbc8 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamAupRepositoryImpl.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamAupRepositoryImpl.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamAupSignatureNotFoundError.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamAupSignatureNotFoundError.java
index 97b033d3f..bf102c4b6 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamAupSignatureNotFoundError.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamAupSignatureNotFoundError.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamAupSignatureRepository.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamAupSignatureRepository.java
index 75555b05c..cdbbeec4d 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamAupSignatureRepository.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamAupSignatureRepository.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamAupSignatureRepositoryCustom.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamAupSignatureRepositoryCustom.java
index 336133238..3f3df3d81 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamAupSignatureRepositoryCustom.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamAupSignatureRepositoryCustom.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamAupSignatureRepositoryImpl.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamAupSignatureRepositoryImpl.java
index 7376d65eb..4944001ba 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamAupSignatureRepositoryImpl.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamAupSignatureRepositoryImpl.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamAuthoritiesRepository.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamAuthoritiesRepository.java
index 4d147d607..1166da1ab 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamAuthoritiesRepository.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamAuthoritiesRepository.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamEmailNotificationRepository.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamEmailNotificationRepository.java
index 6e88f0008..fdb932798 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamEmailNotificationRepository.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamEmailNotificationRepository.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamExternalAuthenticationDetailsRepository.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamExternalAuthenticationDetailsRepository.java
index 7a928f112..99f077c1f 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamExternalAuthenticationDetailsRepository.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamExternalAuthenticationDetailsRepository.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamGroupRepository.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamGroupRepository.java
index 8bc17b507..38a297089 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamGroupRepository.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamGroupRepository.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamGroupRequestRepository.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamGroupRequestRepository.java
index 4f19b3251..d04a674e9 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamGroupRequestRepository.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamGroupRequestRepository.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamNotificationReceiverRepository.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamNotificationReceiverRepository.java
index 243c40992..914d2562e 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamNotificationReceiverRepository.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamNotificationReceiverRepository.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamOidcIdRepository.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamOidcIdRepository.java
index 4bc6d988b..0152cc4de 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamOidcIdRepository.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamOidcIdRepository.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamRegistrationRequestRepository.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamRegistrationRequestRepository.java
index 52cc9fc8f..234a74ca9 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamRegistrationRequestRepository.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamRegistrationRequestRepository.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamSamlIdRepository.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamSamlIdRepository.java
index 2bd3abd2f..88ab7a6ee 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamSamlIdRepository.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamSamlIdRepository.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamScopePolicyRepository.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamScopePolicyRepository.java
index f4816d73e..1bb61d472 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamScopePolicyRepository.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamScopePolicyRepository.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamScopePolicyRepositoryCustom.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamScopePolicyRepositoryCustom.java
index 3c2a7e97c..82e816730 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamScopePolicyRepositoryCustom.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamScopePolicyRepositoryCustom.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamScopePolicyRepositoryImpl.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamScopePolicyRepositoryImpl.java
index 3dedca6a5..3a6d49e5d 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamScopePolicyRepositoryImpl.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamScopePolicyRepositoryImpl.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamSshKeyRepository.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamSshKeyRepository.java
index 95d44db27..25a0cd694 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamSshKeyRepository.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamSshKeyRepository.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamTokenExchangePolicyRepository.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamTokenExchangePolicyRepository.java
index d04523f23..defbe0c2c 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamTokenExchangePolicyRepository.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamTokenExchangePolicyRepository.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/resources/db/migration/h2/V40___aup_updates.sql b/iam-persistence/src/main/resources/db/migration/h2/V40___aup_updates.sql
index a7b0099bb..27994e519 100644
--- a/iam-persistence/src/main/resources/db/migration/h2/V40___aup_updates.sql
+++ b/iam-persistence/src/main/resources/db/migration/h2/V40___aup_updates.sql
@@ -1,2 +1,2 @@
-ALTER TABLE iam_aup MODIFY text LONGTEXT NULL;
+ALTER TABLE iam_aup ALTER COLUMN text LONGTEXT NULL;
 ALTER TABLE iam_aup ADD COLUMN url VARCHAR(256);
\ No newline at end of file
diff --git a/iam-persistence/src/main/resources/db/migration/test/V100000___test_data.sql b/iam-persistence/src/main/resources/db/migration/test/V100000___test_data.sql
index 9204ebd85..9380476d8 100644
--- a/iam-persistence/src/main/resources/db/migration/test/V100000___test_data.sql
+++ b/iam-persistence/src/main/resources/db/migration/test/V100000___test_data.sql
@@ -25,6 +25,15 @@ INSERT INTO client_details (id, client_id, client_secret, client_name, dynamical
 (13, 'implicit-flow-client', null, 'Implicit Flow client', false, null, 3600, 600, 600, false, null, false),
 (14, 'public-dc-client', null, 'Public Device Code client', false, null, 3600, 600, 600, false, null, false);
 
+INSERT INTO client_details (id, client_id, client_secret, client_name, dynamically_registered,
+  refresh_token_validity_seconds, access_token_validity_seconds, id_token_validity_seconds, allow_introspection,
+  token_endpoint_auth_method, require_auth_time, token_endpoint_auth_signing_alg, jwks) VALUES
+  (15, 'jwt-auth-client_secret_jwt', 'c8e9eed0-e6e4-4a66-b16e-6f37096356a7', 'JWT Bearer Auth Client (client_secret_jwt)', 
+  false, null, 3600, 600, true, 'SECRET_JWT', false, 'HS256', null),
+  (16, 'jwt-auth-private_key_jwt', 'secret', 'JWT Bearer Auth Client (private_key_jwt)', 
+  false, null, 3600, 600, true,'PRIVATE_KEY', false, 'RS256',
+  '{"keys":[{"kty":"RSA","e":"AQAB","kid":"rsa1","n":"1y1CP181zqPNPlV1JDM7Xv0QnGswhSTHe8_XPZHxDTJkykpk_1BmgA3ovP62QRE2ORgsv5oSBI_Z_RaOc4Zx2FonjEJF2oBHtBjsAiF-pxGkM5ZPjFNgFTGp1yUUBjFDcEeIGCwPEyYSt93sQIP_0DRbViMUnpyn3xgM_a1dO5brEWR2n1Uqff1yA5NXfLS03qpl2dpH4HFY5-Zs4bvtJykpAOhoHuIQbz-hmxb9MZ3uTAwsx2HiyEJtz-suyTBHO3BM2o8UcCeyfa34ShPB8i86-sf78fOk2KeRIW1Bju3ANmdV3sxL0j29cesxKCZ06u2ZiGR3Srbft8EdLPzf-w"}]}');
+
 INSERT INTO client_scope (owner_id, scope) VALUES
   (1, 'openid'),
   (1, 'profile'),
diff --git a/iam-test-client/docker/Dockerfile b/iam-test-client/docker/Dockerfile
index 961bd1bba..7b1dce9d4 100644
--- a/iam-test-client/docker/Dockerfile
+++ b/iam-test-client/docker/Dockerfile
@@ -1,9 +1,9 @@
-FROM openjdk:8
+FROM openjdk:11
 
 RUN mkdir /app
 WORKDIR /app
 
-CMD java -XX:+UnlockExperimentalVMOptions -XX:+UseCGroupMemoryLimitForHeap ${IAM_CLIENT_JAVA_OPTS} -jar $IAM_CLIENT_JAR
+CMD java ${IAM_CLIENT_JAVA_OPTS} -jar $IAM_CLIENT_JAR
 
 # Embed TINI since compose v3 syntax do not support the init
 # option to run docker --init
diff --git a/iam-test-client/docker/Dockerfile.prod b/iam-test-client/docker/Dockerfile.prod
index 306de358d..3ddcfc6df 100644
--- a/iam-test-client/docker/Dockerfile.prod
+++ b/iam-test-client/docker/Dockerfile.prod
@@ -1,10 +1,10 @@
-FROM openjdk:8
+FROM openjdk:11
 
 RUN mkdir /app
 WORKDIR /app
 
 COPY iam-test-client.jar /app/
-CMD java -XX:+UnlockExperimentalVMOptions -XX:+UseCGroupMemoryLimitForHeap $IAM_CLIENT_JAVA_OPTS -jar iam-test-client.jar
+CMD java $IAM_CLIENT_JAVA_OPTS -jar iam-test-client.jar
 
 # Embed TINI since compose v3 syntax do not support the init
 # option to run docker --init
diff --git a/iam-test-client/pom.xml b/iam-test-client/pom.xml
index 034aec75f..74e9e90d7 100644
--- a/iam-test-client/pom.xml
+++ b/iam-test-client/pom.xml
@@ -7,7 +7,7 @@
   
     it.infn.mw
     iam-parent
-    1.7.1
+    1.8.0-spring-update-SNAPSHOT
   
 
   iam-test-client
@@ -34,7 +34,7 @@
 
     
       org.webjars
-      webjars-locator
+      webjars-locator-core
     
 
     
@@ -62,17 +62,6 @@
       spring-security-oauth2
     
 
-    
-      org.springframework.security
-      spring-security-jwt
-      
-        
-          org.bouncycastle
-          bcpkix-jdk15on
-        
-      
-    
-
     
       org.mitre
       openid-connect-client
diff --git a/iam-test-client/src/main/java/it/infn/mw/tc/IamClient.java b/iam-test-client/src/main/java/it/infn/mw/tc/IamClient.java
index adf737dc1..9ae62391f 100644
--- a/iam-test-client/src/main/java/it/infn/mw/tc/IamClient.java
+++ b/iam-test-client/src/main/java/it/infn/mw/tc/IamClient.java
@@ -30,7 +30,7 @@
 import org.mitre.openid.connect.client.service.impl.StaticClientConfigurationService;
 import org.mitre.openid.connect.client.service.impl.StaticSingleIssuerService;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.context.embedded.FilterRegistrationBean;
+import org.springframework.boot.web.servlet.FilterRegistrationBean;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.http.client.ClientHttpRequestFactory;
@@ -49,9 +49,10 @@ public class IamClient {
   private IamClientConfig iamClientConfig;
 
   @Bean
-  public FilterRegistrationBean disabledAutomaticOidcFilterRegistration(
+  public FilterRegistrationBean disabledAutomaticOidcFilterRegistration(
       OIDCAuthenticationFilter f) {
-    FilterRegistrationBean b = new FilterRegistrationBean(f);
+    FilterRegistrationBean b =
+        new FilterRegistrationBean(f);
     b.setEnabled(false);
     return b;
   }
diff --git a/iam-test-client/src/main/java/it/infn/mw/tc/IamDynamicServerConfigurationService.java b/iam-test-client/src/main/java/it/infn/mw/tc/IamDynamicServerConfigurationService.java
index 57ea736d5..3d626b377 100644
--- a/iam-test-client/src/main/java/it/infn/mw/tc/IamDynamicServerConfigurationService.java
+++ b/iam-test-client/src/main/java/it/infn/mw/tc/IamDynamicServerConfigurationService.java
@@ -64,7 +64,6 @@ private static class Fetcher extends CacheLoader {
     private static final Logger logger = LoggerFactory.getLogger(Fetcher.class);
 
     private ClientHttpRequestFactory factory;
-    private JsonParser parser = new JsonParser();
 
     public Fetcher(ClientHttpRequestFactory factory) {
       this.factory = factory;
@@ -84,7 +83,8 @@ public ServerConfiguration load(String issuer) throws Exception {
       // fetch the value
       String jsonString = restTemplate.getForObject(url, String.class);
 
-      JsonElement parsed = parser.parse(jsonString);
+      JsonElement parsed = JsonParser.parseString(jsonString);
+
       if (parsed.isJsonObject()) {
 
         JsonObject o = parsed.getAsJsonObject();
diff --git a/iam-test-client/src/main/java/it/infn/mw/tc/IamOIDCClientFilter.java b/iam-test-client/src/main/java/it/infn/mw/tc/IamOIDCClientFilter.java
index 2189104dd..631af7714 100644
--- a/iam-test-client/src/main/java/it/infn/mw/tc/IamOIDCClientFilter.java
+++ b/iam-test-client/src/main/java/it/infn/mw/tc/IamOIDCClientFilter.java
@@ -202,7 +202,7 @@ private OpenIDProviderConfiguration lookupProvider(HttpServletRequest request) {
 
   private JsonObject jsonStringSanityChecks(String jsonString) {
 
-    JsonElement jsonRoot = new JsonParser().parse(jsonString);
+    JsonElement jsonRoot = JsonParser.parseString(jsonString);
     if (!jsonRoot.isJsonObject()) {
       throw new AuthenticationServiceException(
           "Token Endpoint did not return a JSON object: " + jsonRoot);
diff --git a/iam-test-client/src/main/java/it/infn/mw/tc/IamTestClientApplication.java b/iam-test-client/src/main/java/it/infn/mw/tc/IamTestClientApplication.java
index 592f5a8d5..8fd02d50a 100644
--- a/iam-test-client/src/main/java/it/infn/mw/tc/IamTestClientApplication.java
+++ b/iam-test-client/src/main/java/it/infn/mw/tc/IamTestClientApplication.java
@@ -19,7 +19,7 @@
 import org.springframework.boot.SpringApplication;
 import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
-import org.springframework.boot.autoconfigure.web.ErrorMvcAutoConfiguration;
+import org.springframework.boot.autoconfigure.web.servlet.error.ErrorMvcAutoConfiguration;
 import org.springframework.http.HttpEntity;
 import org.springframework.http.HttpHeaders;
 import org.springframework.http.HttpMethod;
@@ -30,7 +30,6 @@
 import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
 import org.springframework.security.config.http.SessionCreationPolicy;
 import org.springframework.security.core.AuthenticationException;
-import org.springframework.security.crypto.codec.Base64;
 import org.springframework.security.web.AuthenticationEntryPoint;
 import org.springframework.security.web.context.SecurityContextPersistenceFilter;
 import org.springframework.security.web.csrf.CsrfFilter;
@@ -186,7 +185,8 @@ public String introspect(Principal principal, Model model) {
     String plainCreds =
         String.format("%s:%s", clientConfig.getClientId(), clientConfig.getClientSecret());
 
-    String base64Creds = new String(Base64.encode(plainCreds.getBytes()));
+    String base64Creds = new String(java.util.Base64.getEncoder().encode(plainCreds.getBytes()));
+    // String base64Creds = new String(Base64.encode(plainCreds.getBytes()));
 
     HttpHeaders headers = new HttpHeaders();
     headers.add("Authorization", "Basic " + base64Creds);
diff --git a/iam-test-client/src/main/java/it/infn/mw/tc/IamUserInfoFetcher.java b/iam-test-client/src/main/java/it/infn/mw/tc/IamUserInfoFetcher.java
index d4a73d6a1..83c824f6b 100644
--- a/iam-test-client/src/main/java/it/infn/mw/tc/IamUserInfoFetcher.java
+++ b/iam-test-client/src/main/java/it/infn/mw/tc/IamUserInfoFetcher.java
@@ -112,7 +112,7 @@ protected ClientHttpRequest createRequest(URI url, HttpMethod method)
 
         if (!Strings.isNullOrEmpty(userInfoString)) {
 
-          JsonObject userInfoJson = new JsonParser().parse(userInfoString).getAsJsonObject();
+          JsonObject userInfoJson = JsonParser.parseString(userInfoString).getAsJsonObject();
 
           UserInfo userInfo = fromJson(userInfoJson);
 
diff --git a/iam-test-client/src/main/java/it/infn/mw/tc/LocalController.java b/iam-test-client/src/main/java/it/infn/mw/tc/LocalController.java
index 7a8cc556f..d2442ce9f 100644
--- a/iam-test-client/src/main/java/it/infn/mw/tc/LocalController.java
+++ b/iam-test-client/src/main/java/it/infn/mw/tc/LocalController.java
@@ -5,7 +5,7 @@
 import javax.servlet.http.HttpServletRequest;
 
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.autoconfigure.web.ErrorController;
+import org.springframework.boot.web.servlet.error.ErrorController;
 import org.springframework.http.client.ClientHttpRequestFactory;
 import org.springframework.security.core.AuthenticationException;
 import org.springframework.stereotype.Controller;
@@ -60,10 +60,4 @@ public String error(HttpServletRequest request, Model model) {
 
     return "index";
   }
-
-  @Override
-  public String getErrorPath() {
-
-    return "/error";
-  }
 }
diff --git a/iam-test-client/src/main/resources/application.properties b/iam-test-client/src/main/resources/application.properties
index 461484996..f96b728bf 100644
--- a/iam-test-client/src/main/resources/application.properties
+++ b/iam-test-client/src/main/resources/application.properties
@@ -1,6 +1,6 @@
 #logging.level.org.springframework.beans.factory.support.DefaultListableBeanFactory=DEBUG
 
-#logging.level.org.springframework.security=DEBUG
-logging.level.org.springframework.mvc=DEBUG
+# logging.level.org.springframework.security=DEBUG
+# logging.level.org.springframework.mvc=DEBUG
 
 #org.mitre=DEBUG
diff --git a/iam-test-protected-resource/.gitignore b/iam-test-protected-resource/.gitignore
deleted file mode 100644
index 9ed481cb6..000000000
--- a/iam-test-protected-resource/.gitignore
+++ /dev/null
@@ -1,2 +0,0 @@
-/.apt_generated/
-/target/
diff --git a/iam-test-protected-resource/pom.xml b/iam-test-protected-resource/pom.xml
deleted file mode 100644
index 2111d81dd..000000000
--- a/iam-test-protected-resource/pom.xml
+++ /dev/null
@@ -1,100 +0,0 @@
-
-
-  4.0.0
-  
-    it.infn.mw
-    iam-parent
-    1.7.1
-  
-
-  iam-test-protected-resource
-  jar
-
-  IAM Test Protected Resource Application
-  A test protected resource application for the IAM
-
-  
-    
-    
-      org.mitre
-      openid-connect-client
-    
-    
-    
-      org.bouncycastle
-      bcpkix-jdk15on
-    
-
-    
-      org.italiangrid
-      voms-api-java
-    
-
-    
-      org.apache.httpcomponents
-      httpclient
-    
-
-    
-      org.springframework.boot
-      spring-boot-devtools
-    
-
-    
-      org.springframework.security.oauth
-      spring-security-oauth2
-    
-
-    
-      org.springframework.security
-      spring-security-jwt
-      
-        
-          org.bouncycastle
-          bcpkix-jdk15on
-        
-      
-    
-
-    
-      org.springframework.boot
-      spring-boot-starter-security
-    
-
-    
-      org.springframework.boot
-      spring-boot-starter-web
-    
-
-    
-      org.springframework.boot
-      spring-boot-starter-test
-      test
-    
-
-    
-      org.springframework.boot
-      spring-boot-configuration-processor
-      true
-    
-  
-
-  
-    
-      
-        org.springframework.boot
-        spring-boot-maven-plugin
-        
-          
-            
-              repackage
-            
-          
-        
-      
-    
-  
-
diff --git a/iam-test-protected-resource/src/main/java/it/infn/mw/pr/IamTestProtectedResourceApplication.java b/iam-test-protected-resource/src/main/java/it/infn/mw/pr/IamTestProtectedResourceApplication.java
deleted file mode 100644
index 83d70cc13..000000000
--- a/iam-test-protected-resource/src/main/java/it/infn/mw/pr/IamTestProtectedResourceApplication.java
+++ /dev/null
@@ -1,13 +0,0 @@
-package it.infn.mw.pr;
-
-import org.springframework.boot.SpringApplication;
-import org.springframework.boot.autoconfigure.SpringBootApplication;
-
-@SpringBootApplication
-public class IamTestProtectedResourceApplication {
-
-  public static void main(String[] args) {
-
-    SpringApplication.run(IamTestProtectedResourceApplication.class, args);
-  }
-}
diff --git a/iam-test-protected-resource/src/main/java/it/infn/mw/pr/InMemoryTaskService.java b/iam-test-protected-resource/src/main/java/it/infn/mw/pr/InMemoryTaskService.java
deleted file mode 100644
index 01962a966..000000000
--- a/iam-test-protected-resource/src/main/java/it/infn/mw/pr/InMemoryTaskService.java
+++ /dev/null
@@ -1,44 +0,0 @@
-package it.infn.mw.pr;
-
-import java.util.Collection;
-import java.util.HashMap;
-import java.util.Map;
-
-import org.springframework.stereotype.Service;
-
-@Service
-public class InMemoryTaskService implements TaskService {
-
-  private final Map taskStore = new HashMap<>();
-
-  @Override
-  public void saveTask(Task t) {
-
-    taskStore.put(t.getId(), t);
-
-  }
-
-  @Override
-  public Collection getTasks() {
-
-    return taskStore.values();
-  }
-
-  @Override
-  public Task getTaskById(String id) {
-
-    return taskStore.get(id);
-  }
-
-  @Override
-  public Task removeTaskById(String id) {
-
-    Task t = taskStore.get(id);
-    if (t == null) {
-      return null;
-    }
-
-    taskStore.remove(id);
-    return t;
-  }
-}
diff --git a/iam-test-protected-resource/src/main/java/it/infn/mw/pr/ProtectedResourceConfiguration.java b/iam-test-protected-resource/src/main/java/it/infn/mw/pr/ProtectedResourceConfiguration.java
deleted file mode 100644
index c899650ab..000000000
--- a/iam-test-protected-resource/src/main/java/it/infn/mw/pr/ProtectedResourceConfiguration.java
+++ /dev/null
@@ -1,80 +0,0 @@
-package it.infn.mw.pr;
-
-import org.mitre.oauth2.introspectingfilter.IntrospectingTokenService;
-import org.mitre.oauth2.introspectingfilter.service.impl.SimpleIntrospectionAuthorityGranter;
-import org.mitre.oauth2.introspectingfilter.service.impl.StaticIntrospectionConfigurationService;
-import org.mitre.oauth2.model.RegisteredClient;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.beans.factory.annotation.Value;
-import org.springframework.boot.autoconfigure.security.oauth2.resource.ResourceServerProperties;
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
-import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.http.SessionCreationPolicy;
-import org.springframework.security.oauth2.config.annotation.web.configuration.EnableResourceServer;
-import org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfigurerAdapter;
-import org.springframework.security.oauth2.config.annotation.web.configurers.ResourceServerSecurityConfigurer;
-
-@Configuration
-@EnableResourceServer
-@EnableGlobalMethodSecurity(prePostEnabled = true)
-public class ProtectedResourceConfiguration extends ResourceServerConfigurerAdapter {
-
-  @Autowired
-  ResourceServerProperties props;
-
-  @Value("${iam.client-id}")
-  String iamClientId;
-
-  @Value("${iam.client-secret}")
-  String iamClientSecret;
-
-  @Value("${iam.token-info-uri}")
-  String iamTokenInfoUri;
-
-  public SimpleIntrospectionAuthorityGranter authorityGranter() {
-    return new SimpleIntrospectionAuthorityGranter();
-  }
-
-  public RegisteredClient clientConfig() {
-
-    RegisteredClient rc = new RegisteredClient();
-    rc.setClientId(iamClientId);
-    rc.setClientSecret(iamClientSecret);
-    return rc;
-  }
-
-  public StaticIntrospectionConfigurationService introspectionConfigService() {
-
-    StaticIntrospectionConfigurationService cs = new StaticIntrospectionConfigurationService();
-    cs.setIntrospectionUrl(iamTokenInfoUri);
-    cs.setClientConfiguration(clientConfig());
-    return cs;
-  }
-
-  @Bean
-  public IntrospectingTokenService tokenService() {
-
-    IntrospectingTokenService its = new IntrospectingTokenService();
-    its.setIntrospectionConfigurationService(introspectionConfigService());
-    its.setIntrospectionAuthorityGranter(authorityGranter());
-    return its;
-  }
-
-  @Override
-  public void configure(HttpSecurity http) throws Exception {
-
-    http.authorizeRequests().anyRequest().authenticated().and().csrf().disable().sessionManagement()
-        .sessionCreationPolicy(SessionCreationPolicy.STATELESS);
-
-  }
-
-  @Override
-  public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
-
-    resources.tokenServices(tokenService());
-
-  }
-
-}
diff --git a/iam-test-protected-resource/src/main/java/it/infn/mw/pr/Task.java b/iam-test-protected-resource/src/main/java/it/infn/mw/pr/Task.java
deleted file mode 100644
index 90bdc6967..000000000
--- a/iam-test-protected-resource/src/main/java/it/infn/mw/pr/Task.java
+++ /dev/null
@@ -1,68 +0,0 @@
-package it.infn.mw.pr;
-
-import java.util.Date;
-import java.util.UUID;
-
-import javax.validation.constraints.NotNull;
-import javax.validation.constraints.Size;
-
-public class Task {
-
-  private final String id;
-
-  @NotNull
-  @Size(min = 1, max = 100)
-  private final String description;
-
-  private boolean done = false;
-
-  private final Date creationDate;
-  private Date completionDate;
-
-  public Task(String description) {
-    this.id = UUID.randomUUID().toString();
-    this.description = description;
-    this.creationDate = new Date();
-  }
-
-  public void complete() {
-
-    setDone(true);
-    setCompletionDate(new Date());
-  }
-
-  public Date getCompletionDate() {
-
-    return completionDate;
-  }
-
-  public Date getCreationDate() {
-
-    return creationDate;
-  }
-
-  public String getDescription() {
-
-    return description;
-  }
-
-  public String getId() {
-
-    return id;
-  }
-
-  public boolean isDone() {
-
-    return done;
-  }
-
-  public void setCompletionDate(Date completionDate) {
-
-    this.completionDate = completionDate;
-  }
-
-  public void setDone(boolean done) {
-
-    this.done = done;
-  }
-}
diff --git a/iam-test-protected-resource/src/main/java/it/infn/mw/pr/TaskController.java b/iam-test-protected-resource/src/main/java/it/infn/mw/pr/TaskController.java
deleted file mode 100644
index 091a2ddaa..000000000
--- a/iam-test-protected-resource/src/main/java/it/infn/mw/pr/TaskController.java
+++ /dev/null
@@ -1,59 +0,0 @@
-package it.infn.mw.pr;
-
-import java.util.Collection;
-
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.http.HttpStatus;
-import org.springframework.http.ResponseEntity;
-import org.springframework.security.access.prepost.PreAuthorize;
-import org.springframework.web.bind.annotation.PathVariable;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RequestMethod;
-import org.springframework.web.bind.annotation.RequestParam;
-import org.springframework.web.bind.annotation.RestController;
-
-@RestController
-@RequestMapping("/Tasks")
-public class TaskController {
-
-  @Autowired
-  TaskService taskService;
-
-  @PreAuthorize("#oauth2.hasScope('write-tasks') and hasRole('API')")
-  @RequestMapping(value = "/", method = RequestMethod.POST)
-  public ResponseEntity create(@RequestParam String description) {
-
-    Task t = new Task(description);
-    taskService.saveTask(t);
-    return new ResponseEntity(t, HttpStatus.CREATED);
-  }
-
-  @PreAuthorize("#oauth2.hasScope('read-tasks') and hasRole('API')")
-  @RequestMapping(value = "/", method = RequestMethod.GET)
-  public ResponseEntity> getAllTasks() {
-
-    return new ResponseEntity>(taskService.getTasks(), HttpStatus.OK);
-  }
-
-  @PreAuthorize("#oauth2.hasScope('write-tasks') and hasRole('API')")
-  @RequestMapping(value = "/{id}", method = RequestMethod.POST)
-  public ResponseEntity completeTask(@PathVariable("id") String id) {
-    Task t = taskService.getTaskById(id);
-    if (t == null) {
-      return new ResponseEntity(HttpStatus.NOT_FOUND);
-    }
-
-    t.complete();
-    return new ResponseEntity(t, HttpStatus.OK);
-  }
-
-  @PreAuthorize("#oauth2.hasScope('write-tasks') and hasRole('API')")
-  @RequestMapping(value = "/{id}", method = RequestMethod.DELETE)
-  public ResponseEntity deleteTask(@PathVariable("id") String id) {
-    Task t = taskService.removeTaskById(id);
-    if (t == null) {
-      return new ResponseEntity(HttpStatus.NOT_FOUND);
-    }
-    return new ResponseEntity(t, HttpStatus.OK);
-  }
-}
diff --git a/iam-test-protected-resource/src/main/java/it/infn/mw/pr/TaskService.java b/iam-test-protected-resource/src/main/java/it/infn/mw/pr/TaskService.java
deleted file mode 100644
index bd8f5b033..000000000
--- a/iam-test-protected-resource/src/main/java/it/infn/mw/pr/TaskService.java
+++ /dev/null
@@ -1,15 +0,0 @@
-package it.infn.mw.pr;
-
-import java.util.Collection;
-
-public interface TaskService {
-
-  void saveTask(Task t);
-
-  Collection getTasks();
-
-  Task getTaskById(String id);
-
-  Task removeTaskById(String id);
-
-}
diff --git a/iam-test-protected-resource/src/main/resources/application.yml b/iam-test-protected-resource/src/main/resources/application.yml
deleted file mode 100644
index 169413e6a..000000000
--- a/iam-test-protected-resource/src/main/resources/application.yml
+++ /dev/null
@@ -1,14 +0,0 @@
-spring:
-  mvc:
-    view:
-      suffix: .html
-
-server:
-  context-path: /iam-test-pr
-  port: ${IAM_PR_PORT:9091}
-  use-forward-headers: ${IAM_PR_USE_FORWARD_HEADERS:false}
-
-iam:
-  client-id: ${IAM_PR_CLIENT_ID:tasks-app}
-  client-secret: ${IAM_PR_CLIENT_SECRET:secret}
-  token-info-uri: ${IAM_PR_TOKENINFO_URI:http://localhost:8080/introspect}
\ No newline at end of file
diff --git a/pom.xml b/pom.xml
index e79deb640..c25bab862 100644
--- a/pom.xml
+++ b/pom.xml
@@ -4,27 +4,32 @@
   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
   4.0.0
+	
+		org.springframework.boot
+		spring-boot-starter-parent
+		2.5.6
+		 
+	
 
   it.infn.mw
   iam-parent
-  1.7.1
+  1.8.0-spring-update-SNAPSHOT
   pom
-  INDIGO Identity and Access Manager (IAM)
+  INDIGO Identity and Access Manager (IAM) - Parent POM
 
   
     UTF-8
     UTF-8
 
-    1.8
+    11
     3.3.2
     -Xmx2500m
     2.5.2
-    1.3.5.cnaf.20210803
-    1.0.1.RELEASE
+    1.3.5.cnaf-spring-update-SNAPSHOT
+    1.0.10.RELEASE
 
-    1.3.8.RELEASE
+    2.5.6
 
-    0.32
     1.6.1
     2.5.0
     1.0.20
@@ -38,16 +43,15 @@
     2.9.0
     2.2.0
 
-    4.0
-    2.2.0
-
     3.0
     0.8.3
 
-    3.0.0-M2
     1.0
     2.3.2
     2.3.2
+
+    2.5.1.RELEASE
+
     @
     iam-persistence/**/*,iam-test-client/**/*,iam-test-protected-resource/**/*
   
@@ -57,25 +61,17 @@
     iam-persistence
     iam-login-service
     iam-test-client
-    iam-test-protected-resource
   
 
   
     
 
       
-        org.springframework.boot
-        spring-boot-dependencies
-        ${spring-boot.version}
-        pom
-        import
+        org.springframework.security.oauth
+        spring-security-oauth2
+        ${spring-security-oauth2.version}
       
 
-      
-        org.webjars
-        webjars-locator-core
-        ${webjars-locator-core.version}
-      
       
         org.webjars
         angularjs
@@ -161,13 +157,9 @@
         ${mitreid.version}
       
 
+    
+
       
-      
-        org.opensaml
-        opensaml
-        
-        2.6.4
-      
 
       
         org.bouncycastle
@@ -197,27 +189,8 @@
         org.springframework.security.extensions
         spring-security-saml2-core
         ${spring-security-saml.version}
-        
-          
-            org.opensaml
-            opensaml
-          
-        
       
 
-      
-        org.flywaydb.flyway-test-extensions
-        flyway-spring-test
-        ${flyway-test.version}
-        test
-      
-
-      
-        cz.jirutka.validator
-        validator-collection
-        ${validator-collection.version}
-      
-      
       
       
         javax.annotation
@@ -267,16 +240,6 @@
           license-maven-plugin
           ${license-maven-plugin.version}
         
-        
-          org.springframework.boot
-          spring-boot-maven-plugin
-          ${spring-boot.version}
-        
-        
-          org.apache.maven.plugins
-          maven-surefire-plugin
-          3.0.0-M3
-        
       
     
 
@@ -284,7 +247,6 @@
       
         org.apache.maven.plugins
         maven-enforcer-plugin
-        ${maven-enforcer-plugin.version}
         
           
             enforce-maven
@@ -294,10 +256,10 @@
             
               
                 
-                  1.8.0
+                  11
                 
                 
-                  3.3.0
+                  3.6.0
                 
               
             
@@ -307,8 +269,6 @@
       
         org.apache.maven.plugins
         maven-source-plugin
-        2.2.1
-
         
           
             attach-sources
@@ -330,21 +290,10 @@
         
       
 
-      
-        org.apache.maven.plugins
-        maven-compiler-plugin
-        3.1
-        
-          ${java.version}
-          ${java.version}
-          UTF-8
-        
-      
 
       
         org.apache.maven.plugins
         maven-war-plugin
-        2.5
         
           false
           
@@ -376,24 +325,9 @@
         
       
 
-      
-        org.apache.maven.plugins
-        maven-jar-plugin
-        2.5
-        
-          
-            
-              true
-              true
-            
-          
-        
-      
-
       
         pl.project13.maven
         git-commit-id-plugin
-        2.1.11
         
           
             
@@ -402,7 +336,8 @@
           
         
         
-          true
+          false
+          false
           yyyy-MM-dd'T'HH:mm:ssZ
           true
           ${project.build.outputDirectory}/git.properties

From e6e8b26c136f966e81d6370c4a687b008a5ad7ce Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Tue, 23 Nov 2021 11:20:34 +0000
Subject: [PATCH 20/76] Making database schema changes for MySQL and H2

This ensures tables are created properly and contain the appropriate test data. Currently, no test data for multi-factor secrets and recovery codes exist.
---
 .gitignore                                    |   3 +-
 .../mw/iam/persistence/model/IamAccount.java  |   2 +-
 .../db/migration/h2/V2___iam_tables.sql       |   7 +-
 .../db/migration/mysql/V2___iam_tables.sql    |   7 +-
 .../prod/V3___basic_configuration.sql         |   4 +-
 .../db/migration/test/V100000___test_data.sql | 502 +++++++++---------
 .../test/V3_1___duplicate_email_user.sql      |  12 +-
 .../test/V3__basic_configuration.sql          |   4 +-
 iam-test-client/.gitignore                    |   1 +
 9 files changed, 277 insertions(+), 265 deletions(-)

diff --git a/.gitignore b/.gitignore
index 2dd068b79..fb603052d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -28,4 +28,5 @@ travis/travis-build.out
 travis/travis-mitre-build.out
 
 *.iml
-.idea
\ No newline at end of file
+.idea
+iam-test-client/.factorypath
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAccount.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAccount.java
index 0c2468248..7bab4f59b 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAccount.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAccount.java
@@ -96,7 +96,7 @@ public class IamAccount implements Serializable {
   private boolean mfaEnabled;
 
   @OneToOne(cascade = CascadeType.ALL, mappedBy = "account")
-  @JoinColumn(name = "iam_totp_mfa", referencedColumnName = "id", nullable = true)
+  @JoinColumn(name = "totp_mfa", referencedColumnName = "id", nullable = true)
   private IamTotpMfa totpMfa;
 
   @Temporal(TemporalType.TIMESTAMP)
diff --git a/iam-persistence/src/main/resources/db/migration/h2/V2___iam_tables.sql b/iam-persistence/src/main/resources/db/migration/h2/V2___iam_tables.sql
index ef0c76318..b09ea6531 100644
--- a/iam-persistence/src/main/resources/db/migration/h2/V2___iam_tables.sql
+++ b/iam-persistence/src/main/resources/db/migration/h2/V2___iam_tables.sql
@@ -1,4 +1,4 @@
-CREATE TABLE iam_account (ID BIGINT IDENTITY NOT NULL, active BOOLEAN NOT NULL, CREATIONTIME TIMESTAMP NOT NULL, LASTUPDATETIME TIMESTAMP NOT NULL, PASSWORD VARCHAR(128), USERNAME VARCHAR(128) NOT NULL UNIQUE, UUID VARCHAR(36) NOT NULL UNIQUE, user_info_id BIGINT, PRIMARY KEY (ID));
+CREATE TABLE iam_account (ID BIGINT IDENTITY NOT NULL, active BOOLEAN NOT NULL, CREATIONTIME TIMESTAMP NOT NULL, LASTUPDATETIME TIMESTAMP NOT NULL, PASSWORD VARCHAR(128), USERNAME VARCHAR(128) NOT NULL UNIQUE, UUID VARCHAR(36) NOT NULL UNIQUE, user_info_id BIGINT, mfa_enabled BOOLEAN NOT NULL, totp_mfa_id BIGINT, PRIMARY KEY (ID));
 CREATE TABLE iam_authority (ID BIGINT IDENTITY NOT NULL, auth VARCHAR(128) NOT NULL UNIQUE, PRIMARY KEY (ID));
 CREATE TABLE iam_group (ID BIGINT IDENTITY NOT NULL, CREATIONTIME TIMESTAMP NOT NULL, DESCRIPTION VARCHAR(512), LASTUPDATETIME TIMESTAMP NOT NULL, NAME VARCHAR(255) NOT NULL UNIQUE, UUID VARCHAR(36) NOT NULL UNIQUE, PRIMARY KEY (ID));
 CREATE TABLE iam_oidc_id (ID BIGINT IDENTITY NOT NULL, ISSUER VARCHAR(256) NOT NULL, SUBJECT VARCHAR(256) NOT NULL, account_id BIGINT, PRIMARY KEY (ID));
@@ -8,7 +8,12 @@ CREATE TABLE iam_user_info (ID BIGINT IDENTITY NOT NULL, BIRTHDATE VARCHAR, EMAI
 CREATE TABLE iam_x509_cert (ID BIGINT IDENTITY NOT NULL, CERTIFICATESUBJECT VARCHAR(128) NOT NULL UNIQUE, LABEL VARCHAR(36) NOT NULL UNIQUE, is_primary BOOLEAN, ACCOUNT_ID BIGINT, PRIMARY KEY (ID));
 CREATE TABLE iam_account_authority (account_id BIGINT NOT NULL, authority_id BIGINT NOT NULL, PRIMARY KEY (account_id, authority_id));
 CREATE TABLE iam_account_group (account_id BIGINT NOT NULL, group_id BIGINT NOT NULL, PRIMARY KEY (account_id, group_id));
+CREATE TABLE iam_totp_mfa (ID BIGINT NOT NULL, active BOOLEAN NOT NULL, CREATIONTIME TIMESTAMP NOT NULL, LASTUPDATETIME TIMESTAMP NOT NULL, secret VARCHAR(256), ACCOUNT_ID BIGINT, PRIMARY KEY (ID));
+CREATE TABLE iam_totp_recovery_code (ID BIGINT NOT NULL, code VARCHAR(255) NOT NULL, CREATIONTIME TIMESTAMP NOT NULL, LASTUPDATETIME TIMESTAMP NOT NULL, TOTP_MFA_ID BIGINT NOT NULL, PRIMARY KEY (ID));
 ALTER TABLE iam_account ADD CONSTRAINT FK_iam_account_user_info_id FOREIGN KEY (user_info_id) REFERENCES iam_user_info (ID);
+ALTER TABLE iam_account ADD CONSTRAINT FK_iam_account_totp_mfa_id FOREIGN KEY (totp_mfa_id) REFERENCES iam_totp_mfa (ID);
+ALTER TABLE iam_totp_mfa ADD CONSTRAINT FK_iam_totp_mfa_account_id FOREIGN KEY (ACCOUNT_ID) REFERENCES iam_account (ID);
+ALTER TABLE iam_totp_recovery_code ADD CONSTRAINT FK_iam_totp_recovery_code_totp_mfa_id FOREIGN KEY (TOTP_MFA_ID) REFERENCES iam_totp_mfa (ID);
 ALTER TABLE iam_oidc_id ADD CONSTRAINT FK_iam_oidc_id_account_id FOREIGN KEY (account_id) REFERENCES iam_account (ID);
 ALTER TABLE iam_saml_id ADD CONSTRAINT FK_iam_saml_id_account_id FOREIGN KEY (account_id) REFERENCES iam_account (ID);
 ALTER TABLE iam_ssh_key ADD CONSTRAINT FK_iam_ssh_key_ACCOUNT_ID FOREIGN KEY (ACCOUNT_ID) REFERENCES iam_account (ID);
diff --git a/iam-persistence/src/main/resources/db/migration/mysql/V2___iam_tables.sql b/iam-persistence/src/main/resources/db/migration/mysql/V2___iam_tables.sql
index 7e7f25180..8c3bd63e8 100644
--- a/iam-persistence/src/main/resources/db/migration/mysql/V2___iam_tables.sql
+++ b/iam-persistence/src/main/resources/db/migration/mysql/V2___iam_tables.sql
@@ -1,4 +1,4 @@
-CREATE TABLE iam_account (ID BIGINT AUTO_INCREMENT NOT NULL, active TINYINT(1) default 0 NOT NULL, CREATIONTIME DATETIME NOT NULL, LASTUPDATETIME DATETIME NOT NULL, PASSWORD VARCHAR(128), USERNAME VARCHAR(128) NOT NULL UNIQUE, UUID VARCHAR(36) NOT NULL UNIQUE, user_info_id BIGINT, PRIMARY KEY (ID));
+CREATE TABLE iam_account (ID BIGINT AUTO_INCREMENT NOT NULL, active TINYINT(1) default 0 NOT NULL, CREATIONTIME DATETIME NOT NULL, LASTUPDATETIME DATETIME NOT NULL, PASSWORD VARCHAR(128), USERNAME VARCHAR(128) NOT NULL UNIQUE, UUID VARCHAR(36) NOT NULL UNIQUE, user_info_id BIGINT, mfa_enabled TINYINT(1) default 0 NOT NULL, totp_mfa_id BIGINT, PRIMARY KEY (ID));
 CREATE TABLE iam_authority (ID BIGINT AUTO_INCREMENT NOT NULL, auth VARCHAR(128) NOT NULL UNIQUE, PRIMARY KEY (ID));
 CREATE TABLE iam_group (ID BIGINT AUTO_INCREMENT NOT NULL, CREATIONTIME DATETIME NOT NULL, DESCRIPTION VARCHAR(512), LASTUPDATETIME DATETIME NOT NULL, NAME VARCHAR(255) NOT NULL UNIQUE, UUID VARCHAR(36) NOT NULL UNIQUE, PRIMARY KEY (ID));
 CREATE TABLE iam_oidc_id (ID BIGINT AUTO_INCREMENT NOT NULL, ISSUER VARCHAR(256) NOT NULL, SUBJECT VARCHAR(256) NOT NULL, account_id BIGINT, PRIMARY KEY (ID));
@@ -8,7 +8,12 @@ CREATE TABLE iam_user_info (ID BIGINT AUTO_INCREMENT NOT NULL, BIRTHDATE VARCHAR
 CREATE TABLE iam_x509_cert (ID BIGINT AUTO_INCREMENT NOT NULL, CERTIFICATESUBJECT VARCHAR(128) NOT NULL UNIQUE, LABEL VARCHAR(36) NOT NULL UNIQUE, is_primary TINYINT(1) default 0, ACCOUNT_ID BIGINT, PRIMARY KEY (ID));
 CREATE TABLE iam_account_authority (account_id BIGINT NOT NULL, authority_id BIGINT NOT NULL, PRIMARY KEY (account_id, authority_id));
 CREATE TABLE iam_account_group (account_id BIGINT NOT NULL, group_id BIGINT NOT NULL, PRIMARY KEY (account_id, group_id));
+CREATE TABLE iam_totp_mfa (ID BIGINT NOT NULL, active TINYINT(1) default 0 NOT NULL, CREATIONTIME DATETIME NOT NULL, LASTUPDATETIME DATETIME NOT NULL, secret VARCHAR(256), ACCOUNT_ID BIGINT, PRIMARY KEY (ID));
+CREATE TABLE iam_totp_recovery_code (ID BIGINT NOT NULL, code VARCHAR(255) NOT NULL, CREATIONTIME DATETIME NOT NULL, LASTUPDATETIME DATETIME NOT NULL, TOTP_MFA_ID BIGINT NOT NULL, PRIMARY KEY (ID));
 ALTER TABLE iam_account ADD CONSTRAINT FK_iam_account_user_info_id FOREIGN KEY (user_info_id) REFERENCES iam_user_info (ID);
+ALTER TABLE iam_account ADD CONSTRAINT FK_iam_account_totp_mfa_id FOREIGN KEY (totp_mfa_id) REFERENCES iam_totp_mfa (ID);
+ALTER TABLE iam_totp_mfa ADD CONSTRAINT FK_iam_totp_mfa_account_id FOREIGN KEY (ACCOUNT_ID) REFERENCES iam_account (ID);
+ALTER TABLE iam_totp_recovery_code ADD CONSTRAINT FK_iam_totp_recovery_code_totp_mfa_id FOREIGN KEY (TOTP_MFA_ID) REFERENCES iam_totp_mfa (ID);
 ALTER TABLE iam_oidc_id ADD CONSTRAINT FK_iam_oidc_id_account_id FOREIGN KEY (account_id) REFERENCES iam_account (ID);
 ALTER TABLE iam_saml_id ADD CONSTRAINT FK_iam_saml_id_account_id FOREIGN KEY (account_id) REFERENCES iam_account (ID);
 ALTER TABLE iam_ssh_key ADD CONSTRAINT FK_iam_ssh_key_ACCOUNT_ID FOREIGN KEY (ACCOUNT_ID) REFERENCES iam_account (ID);
diff --git a/iam-persistence/src/main/resources/db/migration/prod/V3___basic_configuration.sql b/iam-persistence/src/main/resources/db/migration/prod/V3___basic_configuration.sql
index 7b13ae001..89429dc55 100644
--- a/iam-persistence/src/main/resources/db/migration/prod/V3___basic_configuration.sql
+++ b/iam-persistence/src/main/resources/db/migration/prod/V3___basic_configuration.sql
@@ -15,8 +15,8 @@ INSERT INTO iam_authority(ID, AUTH) VALUES
 INSERT INTO iam_user_info(ID,GIVENNAME,FAMILYNAME, EMAIL, EMAILVERIFIED) VALUES
 (1, 'Admin', 'User', 'admin@iam.test', true);
 
-INSERT INTO iam_account(id, uuid, username, password, user_info_id, creationtime, lastupdatetime, active) VALUES
-(1, '73f16d93-2441-4a50-88ff-85360d78c6b5', 'admin', 'password', 1, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true);
+INSERT INTO iam_account(id, uuid, username, password, user_info_id, creationtime, lastupdatetime, active, mfa_enabled, totp_mfa_id) VALUES
+(1, '73f16d93-2441-4a50-88ff-85360d78c6b5', 'admin', 'password', 1, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null);
 
 INSERT INTO iam_account_authority(account_id, authority_id) VALUES
 (1,1),
diff --git a/iam-persistence/src/main/resources/db/migration/test/V100000___test_data.sql b/iam-persistence/src/main/resources/db/migration/test/V100000___test_data.sql
index 9380476d8..4d0addfdc 100644
--- a/iam-persistence/src/main/resources/db/migration/test/V100000___test_data.sql
+++ b/iam-persistence/src/main/resources/db/migration/test/V100000___test_data.sql
@@ -180,8 +180,8 @@ INSERT INTO iam_user_info(ID,GIVENNAME,FAMILYNAME, EMAIL, EMAILVERIFIED, BIRTHDA
 (2, 'Test', 'User', 'test@iam.test', true, '1950-01-01','M');
 
 
-INSERT INTO iam_account(id, uuid, username, password, user_info_id, creationtime, lastupdatetime, active) VALUES
-(2, '80e5fb8d-b7c8-451a-89ba-346ae278a66f', 'test', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 2, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true);
+INSERT INTO iam_account(id, uuid, username, password, user_info_id, creationtime, lastupdatetime, active, mfa_enabled, totp_mfa_id) VALUES
+(2, '80e5fb8d-b7c8-451a-89ba-346ae278a66f', 'test', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 2, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null);
 
 
 INSERT INTO iam_oidc_id(issuer, subject, account_id) VALUES
@@ -503,255 +503,255 @@ INSERT INTO iam_user_info(ID,GIVENNAME,FAMILYNAME, EMAIL, EMAILVERIFIED) VALUES
 (346, 'Test-346','User', 'test-346@test.org', true),
 (347, 'Test-347','User', 'test-347@test.org', true);
 
-INSERT INTO iam_account(id, uuid, username, password, user_info_id, creationtime, lastupdatetime, active) VALUES
-(100, 'f2ce8cb2-a1db-4884-9ef0-d8842cc02b4a', 'test_100', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 100, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(101, '1a78b3b8-22d2-4746-9269-df55aceb036f', 'test_101', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 101, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(102, 'a07d60c6-7ffa-475f-98e4-f9f648aa278b', 'test_102', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 102, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(103, '56e1b885-ea25-4ffc-ba17-fcde2b097d02', 'test_103', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 103, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(104, '67d2794d-c7fb-406e-9bc1-b66f43cbe60f', 'test_104', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 104, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(105, 'd11e04f7-f369-4de6-9375-394f7d886ac7', 'test_105', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 105, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(106, 'bbc76b76-9f9e-443b-8c63-cd775c50c6f3', 'test_106', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 106, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(107, 'b15c850c-e6e0-4afb-a02d-374653bb102e', 'test_107', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 107, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(108, 'afada6e8-d50d-47f6-912e-d6261605c771', 'test_108', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 108, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(109, 'fa3b4c97-4787-4b49-a32c-5b4c74d5a7c8', 'test_109', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 109, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(110, '33165df6-4d49-4728-883c-3fd42720d46b', 'test_110', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 110, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(111, '15fb8d3a-003d-4ef9-8349-867d81d4ae9c', 'test_111', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 111, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(112, '7a4dda33-c2e5-4304-998a-3fa4df481123', 'test_112', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 112, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(113, '7013f989-0a95-43b5-8637-2e2360a73bb3', 'test_113', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 113, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(114, '12caabc8-4766-4028-98ff-f4d7f288a5f0', 'test_114', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 114, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(115, 'f463ad2b-5814-4877-bb62-f954c67a8044', 'test_115', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 115, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(116, '28c656c4-5489-4654-a257-0806c6bab905', 'test_116', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 116, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(117, '11be5a72-9416-45fc-a0a7-f3e23c54bfda', 'test_117', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 117, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(118, '3cea2c01-786e-41a3-8fdf-4229cc4e3742', 'test_118', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 118, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(119, 'e0247677-4542-4df3-8d75-8efa11e70911', 'test_119', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 119, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(120, 'd905a115-d726-4e11-ba1f-b8482177bb05', 'test_120', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 120, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(121, '3479afd1-584c-4479-b6e2-25f6cef2f842', 'test_121', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 121, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(122, '8d4f467d-cb68-4feb-b898-71e4487e6820', 'test_122', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 122, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(123, '0ddee1c2-1426-4b83-b520-e20bdd8ef9b3', 'test_123', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 123, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(124, 'b8b638be-6e09-4dbe-bcc0-776c2403e8c7', 'test_124', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 124, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(125, '1dc3108a-b5c0-4e5b-accd-925054075bc4', 'test_125', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 125, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(126, '5eed3374-c131-4513-84b7-dd0ff965da35', 'test_126', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 126, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(127, '2d0b4c36-0301-49f6-a20b-23b6ca48cee2', 'test_127', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 127, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(128, 'db46065a-ba62-423d-9397-7bc6fab371a5', 'test_128', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 128, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(129, 'd9dbaabf-c51a-45e5-aee1-25134ba283ac', 'test_129', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 129, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(130, '5678f40a-f361-464c-aa71-ffb48d163aaa', 'test_130', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 130, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(131, '209ae3b9-e266-4e57-a639-db29f61a7594', 'test_131', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 131, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(132, 'f3fac505-d5c9-4d9c-83af-3976f357f19c', 'test_132', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 132, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(133, '13bfd34b-1dda-452e-bd9a-284aabccf07d', 'test_133', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 133, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(134, '15ccd152-1537-48d4-a55a-fd6565e5d86f', 'test_134', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 134, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(135, '6b2f4fc1-3e98-4f64-8fb4-517d2d4b3fa3', 'test_135', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 135, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(136, '398081ee-9c3c-4e5d-802c-90a4579030d4', 'test_136', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 136, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(137, '89a32317-dd45-481d-91a4-080e30c1f29e', 'test_137', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 137, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(138, '6dc0aa56-011d-45b8-bf26-cb03e8b40ccf', 'test_138', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 138, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(139, 'cd62277e-5acf-41af-acea-b4d208cba29e', 'test_139', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 139, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(140, '0ae29eac-64ee-45b4-a2e7-e58b34c7ff0e', 'test_140', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 140, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(141, '0f7fe907-fa84-429e-8057-02d809375ba3', 'test_141', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 141, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(142, '7aa4a733-d318-4392-b3d3-6618263f667d', 'test_142', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 142, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(143, 'b1d9b1ac-e77c-4d55-a895-cf0788ed2174', 'test_143', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 143, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(144, 'f975f1f7-ad05-4d66-9905-d44c13cbd08b', 'test_144', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 144, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(145, '857f6e6d-e415-4850-a82b-59d557864910', 'test_145', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 145, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(146, '4e1c059c-1d06-4997-8bfa-5bd09fdb4571', 'test_146', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 146, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(147, 'f4a0bc7f-b279-4caf-b8d1-c86a3c106f62', 'test_147', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 147, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(148, '007bbb9d-55b1-4f5e-80a5-bbcb22073db4', 'test_148', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 148, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(149, 'a1d22bbf-9afe-49da-b75d-b58f825db351', 'test_149', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 149, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(150, '8c2351d5-5460-4b2d-b1bb-7b086130090e', 'test_150', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 150, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(151, 'e6651896-66f8-4f63-b44f-71710fdb947c', 'test_151', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 151, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(152, 'caf04a3c-8f35-40a3-99b6-48ba6a05d8b8', 'test_152', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 152, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(153, 'd501e485-a306-4c9d-9baf-cc75f2321cfd', 'test_153', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 153, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(154, '57466d38-cae8-48bf-ac67-2cfc0266b5b0', 'test_154', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 154, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(155, '4bd5f059-f014-4356-8083-9c1a77adb6fd', 'test_155', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 155, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(156, '69130f52-f251-46fd-99ee-d646938e5f3f', 'test_156', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 156, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(157, 'dedfb4f0-a545-44b3-abba-dd77103db894', 'test_157', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 157, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(158, 'b5d98a8b-3780-4ace-ace1-ac12829dc469', 'test_158', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 158, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(159, '17de2f08-37fe-469d-b7b1-0e9ea9c6d2d8', 'test_159', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 159, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(160, '313abc40-4c88-45df-89e7-bd7bbf97b0fd', 'test_160', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 160, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(161, 'c5d7fc06-16fc-4711-be37-27bbf2c2c07c', 'test_161', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 161, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(162, 'ca31bf4d-f5da-4fc4-ae36-fd3cc0d35d7f', 'test_162', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 162, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(163, 'dc98bb8e-4b91-4915-86fb-476c9503a936', 'test_163', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 163, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(164, '79dd006c-0e4c-4a79-8600-ef8a0ae5bc04', 'test_164', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 164, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(165, '05cdc1f7-7787-43d6-80c6-588277fefb9b', 'test_165', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 165, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(166, 'dcdeb139-71ab-44f5-a709-ab33fec49882', 'test_166', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 166, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(167, '35a98804-b05e-47b0-917b-d72a4d4a5240', 'test_167', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 167, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(168, '5e4d4351-82c7-438d-8f83-ee2b7ebe1fe3', 'test_168', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 168, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(169, 'e1a205e2-f202-402d-8542-4cfc529ef514', 'test_169', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 169, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(170, 'a2e6271e-5b30-42d1-a211-494b98832676', 'test_170', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 170, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(171, '68515954-75ea-4022-9581-4cb4d28c6d6d', 'test_171', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 171, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(172, '41663b84-06b5-4787-a49e-1f745ca1eab3', 'test_172', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 172, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(173, 'b257f456-bdae-4c58-8519-756abbda462a', 'test_173', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 173, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(174, 'd848b9cb-05e4-4dcf-b9b7-431d83c41810', 'test_174', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 174, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(175, 'b6859250-dcca-47ef-b013-f609468d2389', 'test_175', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 175, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(176, 'e18bc682-897b-4696-a5ef-eee37a52a3de', 'test_176', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 176, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(177, '6b00471d-f496-4335-8209-5a9e13d18b9e', 'test_177', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 177, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(178, '35664644-7b32-4503-86f4-76adbb57762c', 'test_178', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 178, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(179, '7890415f-6563-4f25-bdf3-a5f45159a1b1', 'test_179', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 179, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(180, 'a1edf880-e270-4dac-b69f-73e61c517397', 'test_180', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 180, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(181, '73520029-5901-4022-b9da-38ccd73fe799', 'test_181', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 181, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(182, 'de5825a3-c585-45b3-88a1-7e5e80686826', 'test_182', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 182, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(183, 'bb50b80a-f471-4f64-85fb-4e5051708a4a', 'test_183', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 183, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(184, 'b7aa98b9-30da-468c-8566-06a5b804c4b9', 'test_184', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 184, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(185, 'c230e253-f874-4365-8b0e-7ba5ebc1cc26', 'test_185', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 185, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(186, '7593dbbf-9286-460b-a234-32b560817f60', 'test_186', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 186, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(187, 'ee1e2ce5-da23-4576-84e3-ad7cf4e0ce26', 'test_187', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 187, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(188, 'bf1cc1be-f405-4282-b7be-9a4578670046', 'test_188', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 188, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(189, 'e5ed670a-f944-40f0-8c10-d41c3350ead5', 'test_189', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 189, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(190, '8370db5c-e196-451a-9f5f-9b99c570cf46', 'test_190', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 190, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(191, '81498342-d247-4a60-80de-2c4cb4b1a84d', 'test_191', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 191, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(192, '213f1b3c-516e-4a6f-9785-d8c85d32f83e', 'test_192', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 192, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(193, '08ba27e6-b1b5-4d9e-a64a-6b5bc538bf43', 'test_193', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 193, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(194, 'cf0cfa8e-377c-44a0-a6d1-a74ce1de08fb', 'test_194', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 194, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(195, '2ea66412-8dc2-4081-8d48-e3637ca82604', 'test_195', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 195, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(196, '4ed466eb-ee51-4433-9d0f-3a56216698a2', 'test_196', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 196, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(197, 'cc03fc51-097d-43d6-bb6c-a0df72ec4838', 'test_197', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 197, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(198, '11844e66-8146-4263-aaa6-1fde7e5cfc58', 'test_198', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 198, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(199, 'b5a954c6-69a9-473c-a4c4-83c4f7a88c1c', 'test_199', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 199, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(200, '167e359e-7833-4ce2-9f8b-f035cee39505', 'test_200', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 200, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(201, '5afb5430-a023-4a50-aa92-b134a0fb68b3', 'test_201', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 201, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(202, 'de17b155-307c-4f9b-81f3-7f8b73d2526a', 'test_202', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 202, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(203, 'c966145b-ac05-4a2c-874d-f7b585d1d03b', 'test_203', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 203, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(204, '1d88ea5a-ab5f-40b1-bd48-f18f86eef5d9', 'test_204', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 204, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(205, '6cb0be93-7829-4bfc-ba4a-4d2cdff45447', 'test_205', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 205, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(206, 'e31a2ca7-fcaa-4b98-aac9-7e78f8605851', 'test_206', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 206, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(207, 'f26899b7-64e0-4c16-9134-cef3774f1614', 'test_207', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 207, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(208, '606cf6ab-6b5e-45d1-83b8-e535b197d2f0', 'test_208', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 208, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(209, '617bfc4e-17b1-4ca7-b736-58a74c267747', 'test_209', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 209, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(210, 'e5c26b7a-17bd-47ce-aac8-1430c57b8152', 'test_210', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 210, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(211, '7747bff5-b1e5-49b9-9a87-f93a5b790df0', 'test_211', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 211, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(212, 'c6e5b631-1e91-4ecd-8358-214eec07a91d', 'test_212', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 212, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(213, 'a874c7bd-97ac-4f48-bda5-7d3305d9067d', 'test_213', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 213, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(214, 'c7938cc2-8032-424b-8f49-85558f95364b', 'test_214', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 214, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(215, '46017ce9-d4dd-4ddc-8b73-d596e23d25ad', 'test_215', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 215, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(216, 'd5e66fd2-232e-476d-8de0-2bc1eb59630d', 'test_216', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 216, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(217, '097dc614-bc56-4f5f-a190-3ca1716a6400', 'test_217', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 217, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(218, 'a3b97132-067f-4839-9b99-830a7fb659d4', 'test_218', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 218, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(219, '8d35557f-7451-4c54-bb17-9c3d204c48d3', 'test_219', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 219, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(220, 'a6fba1ff-a5d7-4907-8cd4-1caa27cad85d', 'test_220', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 220, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(221, '427feb36-4401-4971-83de-f93672c028aa', 'test_221', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 221, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(222, '66541083-b1ab-4966-9f8b-8a1109fce0e0', 'test_222', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 222, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(223, '9939c37c-a9b9-43b7-9a4b-aacc470d47c4', 'test_223', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 223, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(224, '754379a0-bdc2-4a2d-9828-9480926b30ad', 'test_224', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 224, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(225, '18c870a1-9e2c-48fb-8a52-259e55e2052e', 'test_225', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 225, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(226, '02df9a97-b44c-4c46-ab3a-c11010d45e18', 'test_226', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 226, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(227, '20f609f7-c128-46b5-abeb-d16d46aab9ad', 'test_227', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 227, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(228, '75067ca5-872c-4149-85ad-f6685f14efc0', 'test_228', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 228, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(229, 'b8639303-d15f-4c81-b9d2-2863f53737c3', 'test_229', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 229, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(230, 'a0c4d9ea-7659-4009-ac7c-a3f089def76d', 'test_230', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 230, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(231, 'd3605113-fb9a-4640-b6fe-9931594eba6c', 'test_231', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 231, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(232, 'bf59d2cc-dd79-4ad6-9637-b04098768600', 'test_232', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 232, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(233, '304d5f24-274e-4fd6-aca4-97b761d1bd0c', 'test_233', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 233, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(234, '0d9491c3-c28b-4c11-8e28-14d93e612e35', 'test_234', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 234, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(235, 'f73a809f-78a6-4214-8060-d6037fe391aa', 'test_235', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 235, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(236, '11cc494a-86a4-44d2-b5fd-06438f95d6a4', 'test_236', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 236, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(237, '55b2e8cc-aaa4-4a8b-8a83-f732188cfab2', 'test_237', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 237, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(238, 'ebe14f0a-7bf7-4614-83c8-1e2da963139a', 'test_238', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 238, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(239, '3e83b092-95a1-4ee4-ac1f-e9df2f3954ad', 'test_239', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 239, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(240, '7304efcc-7974-453e-b2db-fdcc848f8a24', 'test_240', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 240, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(241, '6b0b51e8-f058-42a6-a9ed-3b6ebde935d8', 'test_241', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 241, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(242, 'c10f6de1-a64d-4f8f-bd0a-47bcd72ab8f7', 'test_242', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 242, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(243, '5537408c-41c6-4ee5-8f59-ca70fcdbd0ae', 'test_243', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 243, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(244, '0a920520-e271-42a6-8dc1-89f090023c89', 'test_244', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 244, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(245, 'a5120b27-cdd5-4209-b3da-bdf4b53db140', 'test_245', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 245, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(246, 'cd0f900a-dab8-4a49-805d-97e57cb5ad4c', 'test_246', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 246, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(247, '53b8b68c-0a11-411a-9b4d-01d58c9c0ff0', 'test_247', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 247, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(248, '57114ddf-7bb8-4e68-952a-faa83bf276bf', 'test_248', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 248, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(249, 'fa04c6fe-1bf0-489e-b0df-9fa4756bb90b', 'test_249', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 249, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(250, '5bf5b365-962e-4f6d-9576-94d5ac66cc3c', 'test_250', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 250, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(251, 'eca96575-798c-4919-ba93-4f0eca487490', 'test_251', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 251, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(252, 'd4e52ad1-ac1c-4f68-8d97-6858c8534f84', 'test_252', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 252, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(253, '74f88528-b57b-4482-a417-e7e8cf5ccd87', 'test_253', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 253, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(254, 'f1b969bd-2e43-4981-80d1-baeba6afd456', 'test_254', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 254, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(255, '11f5bcd3-096b-4b0f-8f1b-fa9292e3f5f3', 'test_255', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 255, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(256, 'b937e637-c00b-48de-8dd4-fae260cd9fb9', 'test_256', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 256, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(257, '49886ca5-c9a8-4c1f-9ef0-4784495e943c', 'test_257', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 257, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(258, '5cf6bbba-f2bf-4704-b288-36edb49a3c7a', 'test_258', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 258, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(259, '0a246675-78f2-47d3-a716-f9b85de0e885', 'test_259', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 259, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(260, 'b1e2509b-e9e4-40f8-b5c3-4e230e675ca8', 'test_260', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 260, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(261, 'c423ca4a-54b4-40f3-859d-d39f7d4cf266', 'test_261', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 261, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(262, '1452d005-8038-4092-ba0d-bd690dfdb2e2', 'test_262', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 262, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(263, 'f39a1721-6aeb-4f1e-90be-f54684ece8f0', 'test_263', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 263, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(264, 'ec2b02db-6eb2-4b9e-aa3b-ef53b6daf005', 'test_264', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 264, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(265, 'a6809581-e7b7-4d70-bfdd-c1f302322ee3', 'test_265', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 265, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(266, '794e2ba9-518d-4494-8ef0-01669807e10a', 'test_266', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 266, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(267, 'c258f48e-7f30-4c16-bd2d-6eed81529157', 'test_267', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 267, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(268, 'b7501b84-3a14-44d7-97da-271c416cbd16', 'test_268', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 268, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(269, '88b529d5-7804-4c4d-9f35-aa7dd1df0a37', 'test_269', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 269, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(270, '0c1b65d3-dee3-4429-864f-115fbbc6a2f4', 'test_270', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 270, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(271, '01667b0f-b397-47c1-8cdb-adb3ea7cba06', 'test_271', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 271, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(272, 'c8909fda-0453-4f74-a683-bd613fdc70c5', 'test_272', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 272, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(273, '796b8703-6f42-433f-b9e6-b115b4df25b0', 'test_273', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 273, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(274, 'de8f11f6-7298-4633-ad38-cc94e03314fd', 'test_274', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 274, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(275, 'e097f4e6-9c2d-4f35-912e-bd37f5cdec00', 'test_275', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 275, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(276, '3e0dab1e-c41f-4c0d-b2e3-d056ba6a3c60', 'test_276', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 276, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(277, 'b24cb998-40b7-471c-b55a-48b58b98b2e5', 'test_277', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 277, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(278, 'ab2113f4-56a2-4d1d-83a6-a54a763e371e', 'test_278', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 278, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(279, '2a2beb83-ccbf-413f-ade2-2fd2f79e5f49', 'test_279', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 279, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(280, 'ac53405d-8813-4cf7-ac12-fad7629d5602', 'test_280', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 280, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(281, 'b6c7b0e1-38b5-4e00-a22d-45c03d5fdeac', 'test_281', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 281, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(282, '8e41ff90-42f5-4736-89a6-24246917555c', 'test_282', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 282, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(283, '2b46023a-316f-41ae-955e-01185d67d7a5', 'test_283', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 283, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(284, '74c72c06-391e-4c72-92e7-92a5b75ac2da', 'test_284', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 284, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(285, '3e1246c2-96f9-4937-be0c-eb187822c3c7', 'test_285', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 285, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(286, '7f0e0193-b743-4394-b3e5-86e01813c094', 'test_286', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 286, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(287, '886cd06c-c30a-48df-b793-be4bfa2c1eb9', 'test_287', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 287, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(288, 'cb7cf6cd-bd2e-4956-be86-5d5935417098', 'test_288', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 288, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(289, 'd2e92f17-c26b-44dd-9c60-ca69b0f55b6d', 'test_289', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 289, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(290, 'ea3a53a1-b451-4d7b-9b9f-2b6790de314d', 'test_290', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 290, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(291, '723f2b0d-3473-445c-a6f2-9c8bb12b6019', 'test_291', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 291, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(292, '8f04e723-bb30-4952-a8f5-214845e525dc', 'test_292', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 292, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(293, '56e1991e-47e1-4136-9bd0-cd94fa40b3c8', 'test_293', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 293, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(294, 'b5ef5b82-483e-4331-ba84-78ece1f72602', 'test_294', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 294, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(295, '8238ae4e-5f13-42a3-9d6c-ea60f0ee64a1', 'test_295', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 295, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(296, '800a6a1d-1f63-4052-a14a-fcb56ab7e98b', 'test_296', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 296, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(297, '2eb884c0-8953-434d-898f-a162ffd44102', 'test_297', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 297, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(298, '06363941-bac6-4cc1-b56f-82d9d64d7c12', 'test_298', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 298, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(299, 'd8468131-79a2-4003-bf0a-e034a3455af9', 'test_299', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 299, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(300, 'e8e5f9d3-4473-46d9-b893-a195d5ccc6b4', 'test_300', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 300, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(301, '57db1144-49b7-4930-a214-9bba56c0eab6', 'test_301', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 301, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(302, '668a6ec5-142f-467d-891a-57fe10faf4bb', 'test_302', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 302, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(303, '9bcd9772-6c90-4c14-8ff4-16fa54744c87', 'test_303', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 303, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(304, '6c37ac4e-5213-4d60-8070-fadf3fa3ca38', 'test_304', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 304, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(305, 'fb5d7ea0-249f-4a0e-97aa-caa015d148e4', 'test_305', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 305, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(306, '26035205-595c-433a-8aba-4e0d6ce103a3', 'test_306', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 306, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(307, '1e4a6346-9da9-417c-bfbf-1a3cded61e12', 'test_307', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 307, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(308, '3af98cba-0cd4-4ea1-bcdc-c4c91672f038', 'test_308', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 308, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(309, 'a073f7ce-dfdc-424c-b4d0-bec7acaae445', 'test_309', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 309, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(310, '6524988e-5916-4410-a740-58d1e57d3f93', 'test_310', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 310, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(311, '58a190c4-789e-4c97-9fbb-245d3a58c8fe', 'test_311', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 311, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(312, '3244773f-b74b-461d-bf9a-916a05980c99', 'test_312', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 312, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(313, 'aaed5fa8-6555-43d2-adf4-c672008f8c92', 'test_313', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 313, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(314, 'f32415ac-f0fb-4815-bbef-27ba6115a1cc', 'test_314', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 314, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(315, '2030b697-b729-40c4-91b1-592e19fd4e73', 'test_315', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 315, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(316, 'ee47b98e-ebd5-44ae-8c9a-cbec609415b0', 'test_316', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 316, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(317, 'a47459c2-a709-4601-9151-cb57ae13bc8c', 'test_317', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 317, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(318, '5e274495-2c02-4f75-9ce2-c730e2686be9', 'test_318', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 318, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(319, 'f5f04ca8-f693-4758-9aa6-9a3c55938937', 'test_319', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 319, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(320, '5f876faf-2ad7-41f3-906d-2edd9fd2907d', 'test_320', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 320, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(321, '3d0665c6-db74-4d48-91cc-ebe39bbae605', 'test_321', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 321, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(322, '86c19bce-cb25-47a4-8aba-29c8ad4fc87d', 'test_322', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 322, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(323, 'efa06619-2301-4cb4-b9fa-6e9bddef94d7', 'test_323', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 323, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(324, '3cfc5976-aa7f-4281-8b43-6ea6eee1ac80', 'test_324', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 324, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(325, '19a56d56-1f57-45e6-9c2e-466a17d8c7ba', 'test_325', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 325, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(326, '026a45cf-cbeb-4ea9-8d20-21efbe206bad', 'test_326', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 326, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(327, '48312cae-f61d-4f87-9b20-a957d1e919ce', 'test_327', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 327, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(328, 'e06abc58-f451-4e9e-ac4f-51d5e9d424a6', 'test_328', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 328, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(329, '10b58273-4b30-4caf-954c-a1873ca4d6b5', 'test_329', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 329, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(330, '008892b7-6479-4e68-adf2-39e7ac29e66e', 'test_330', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 330, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(331, '7f864422-153c-4681-8c9e-4e942dce9548', 'test_331', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 331, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(332, '67c5538e-0363-4650-a42e-ba25746b4239', 'test_332', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 332, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(333, '208210c1-1601-47ae-883f-cdb16e0f802b', 'test_333', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 333, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(334, 'bb08395a-a0f0-490d-9d23-6f2f76b41514', 'test_334', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 334, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(335, '050c1a8e-256d-41ab-bd3a-3abe54d01b32', 'test_335', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 335, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(336, 'cf016005-9207-4a2d-a8fe-91c278029a18', 'test_336', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 336, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(337, '950a5d40-e604-4f6c-82dd-2b60a578d9aa', 'test_337', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 337, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(338, '3e00662d-6917-4759-b9a9-be8eda02f63b', 'test_338', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 338, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(339, 'bb339af3-2038-4f17-b489-46d4b7542cb6', 'test_339', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 339, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(340, '3927f6d5-5d90-4192-b84c-cebda90c0b0a', 'test_340', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 340, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(341, 'e6b29f71-bb4a-420b-8442-1f7639109465', 'test_341', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 341, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(342, 'ff7909b6-a90c-43c7-96fc-c375d439e373', 'test_342', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 342, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(343, '6f9902ca-7674-4f2f-b2e1-aeb3701bae14', 'test_343', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 343, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(344, '36d75eda-7573-474a-8aeb-f8555464154f', 'test_344', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 344, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(345, 'd3c489ae-3f03-48fe-9248-927a8bb3297f', 'test_345', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 345, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(346, '18764a4e-8b01-478e-80b3-217cc37d49c7', 'test_346', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 346, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
-(347, '00075d1c-f486-41a0-98f8-06f0354b8416', 'test_347', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 347, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true);
+INSERT INTO iam_account(id, uuid, username, password, user_info_id, creationtime, lastupdatetime, active, mfa_enabled, totp_mfa_id) VALUES
+(100, 'f2ce8cb2-a1db-4884-9ef0-d8842cc02b4a', 'test_100', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 100, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(101, '1a78b3b8-22d2-4746-9269-df55aceb036f', 'test_101', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 101, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(102, 'a07d60c6-7ffa-475f-98e4-f9f648aa278b', 'test_102', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 102, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(103, '56e1b885-ea25-4ffc-ba17-fcde2b097d02', 'test_103', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 103, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(104, '67d2794d-c7fb-406e-9bc1-b66f43cbe60f', 'test_104', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 104, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(105, 'd11e04f7-f369-4de6-9375-394f7d886ac7', 'test_105', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 105, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(106, 'bbc76b76-9f9e-443b-8c63-cd775c50c6f3', 'test_106', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 106, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(107, 'b15c850c-e6e0-4afb-a02d-374653bb102e', 'test_107', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 107, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(108, 'afada6e8-d50d-47f6-912e-d6261605c771', 'test_108', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 108, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(109, 'fa3b4c97-4787-4b49-a32c-5b4c74d5a7c8', 'test_109', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 109, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(110, '33165df6-4d49-4728-883c-3fd42720d46b', 'test_110', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 110, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(111, '15fb8d3a-003d-4ef9-8349-867d81d4ae9c', 'test_111', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 111, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(112, '7a4dda33-c2e5-4304-998a-3fa4df481123', 'test_112', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 112, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(113, '7013f989-0a95-43b5-8637-2e2360a73bb3', 'test_113', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 113, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(114, '12caabc8-4766-4028-98ff-f4d7f288a5f0', 'test_114', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 114, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(115, 'f463ad2b-5814-4877-bb62-f954c67a8044', 'test_115', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 115, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(116, '28c656c4-5489-4654-a257-0806c6bab905', 'test_116', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 116, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(117, '11be5a72-9416-45fc-a0a7-f3e23c54bfda', 'test_117', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 117, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(118, '3cea2c01-786e-41a3-8fdf-4229cc4e3742', 'test_118', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 118, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(119, 'e0247677-4542-4df3-8d75-8efa11e70911', 'test_119', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 119, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(120, 'd905a115-d726-4e11-ba1f-b8482177bb05', 'test_120', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 120, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(121, '3479afd1-584c-4479-b6e2-25f6cef2f842', 'test_121', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 121, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(122, '8d4f467d-cb68-4feb-b898-71e4487e6820', 'test_122', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 122, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(123, '0ddee1c2-1426-4b83-b520-e20bdd8ef9b3', 'test_123', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 123, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(124, 'b8b638be-6e09-4dbe-bcc0-776c2403e8c7', 'test_124', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 124, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(125, '1dc3108a-b5c0-4e5b-accd-925054075bc4', 'test_125', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 125, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(126, '5eed3374-c131-4513-84b7-dd0ff965da35', 'test_126', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 126, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(127, '2d0b4c36-0301-49f6-a20b-23b6ca48cee2', 'test_127', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 127, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(128, 'db46065a-ba62-423d-9397-7bc6fab371a5', 'test_128', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 128, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(129, 'd9dbaabf-c51a-45e5-aee1-25134ba283ac', 'test_129', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 129, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(130, '5678f40a-f361-464c-aa71-ffb48d163aaa', 'test_130', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 130, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(131, '209ae3b9-e266-4e57-a639-db29f61a7594', 'test_131', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 131, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(132, 'f3fac505-d5c9-4d9c-83af-3976f357f19c', 'test_132', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 132, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(133, '13bfd34b-1dda-452e-bd9a-284aabccf07d', 'test_133', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 133, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(134, '15ccd152-1537-48d4-a55a-fd6565e5d86f', 'test_134', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 134, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(135, '6b2f4fc1-3e98-4f64-8fb4-517d2d4b3fa3', 'test_135', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 135, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(136, '398081ee-9c3c-4e5d-802c-90a4579030d4', 'test_136', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 136, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(137, '89a32317-dd45-481d-91a4-080e30c1f29e', 'test_137', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 137, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(138, '6dc0aa56-011d-45b8-bf26-cb03e8b40ccf', 'test_138', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 138, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(139, 'cd62277e-5acf-41af-acea-b4d208cba29e', 'test_139', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 139, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(140, '0ae29eac-64ee-45b4-a2e7-e58b34c7ff0e', 'test_140', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 140, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(141, '0f7fe907-fa84-429e-8057-02d809375ba3', 'test_141', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 141, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(142, '7aa4a733-d318-4392-b3d3-6618263f667d', 'test_142', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 142, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(143, 'b1d9b1ac-e77c-4d55-a895-cf0788ed2174', 'test_143', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 143, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(144, 'f975f1f7-ad05-4d66-9905-d44c13cbd08b', 'test_144', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 144, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(145, '857f6e6d-e415-4850-a82b-59d557864910', 'test_145', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 145, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(146, '4e1c059c-1d06-4997-8bfa-5bd09fdb4571', 'test_146', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 146, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(147, 'f4a0bc7f-b279-4caf-b8d1-c86a3c106f62', 'test_147', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 147, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(148, '007bbb9d-55b1-4f5e-80a5-bbcb22073db4', 'test_148', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 148, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(149, 'a1d22bbf-9afe-49da-b75d-b58f825db351', 'test_149', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 149, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(150, '8c2351d5-5460-4b2d-b1bb-7b086130090e', 'test_150', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 150, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(151, 'e6651896-66f8-4f63-b44f-71710fdb947c', 'test_151', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 151, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(152, 'caf04a3c-8f35-40a3-99b6-48ba6a05d8b8', 'test_152', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 152, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(153, 'd501e485-a306-4c9d-9baf-cc75f2321cfd', 'test_153', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 153, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(154, '57466d38-cae8-48bf-ac67-2cfc0266b5b0', 'test_154', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 154, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(155, '4bd5f059-f014-4356-8083-9c1a77adb6fd', 'test_155', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 155, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(156, '69130f52-f251-46fd-99ee-d646938e5f3f', 'test_156', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 156, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(157, 'dedfb4f0-a545-44b3-abba-dd77103db894', 'test_157', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 157, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(158, 'b5d98a8b-3780-4ace-ace1-ac12829dc469', 'test_158', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 158, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(159, '17de2f08-37fe-469d-b7b1-0e9ea9c6d2d8', 'test_159', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 159, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(160, '313abc40-4c88-45df-89e7-bd7bbf97b0fd', 'test_160', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 160, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(161, 'c5d7fc06-16fc-4711-be37-27bbf2c2c07c', 'test_161', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 161, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(162, 'ca31bf4d-f5da-4fc4-ae36-fd3cc0d35d7f', 'test_162', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 162, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(163, 'dc98bb8e-4b91-4915-86fb-476c9503a936', 'test_163', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 163, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(164, '79dd006c-0e4c-4a79-8600-ef8a0ae5bc04', 'test_164', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 164, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(165, '05cdc1f7-7787-43d6-80c6-588277fefb9b', 'test_165', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 165, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(166, 'dcdeb139-71ab-44f5-a709-ab33fec49882', 'test_166', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 166, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(167, '35a98804-b05e-47b0-917b-d72a4d4a5240', 'test_167', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 167, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(168, '5e4d4351-82c7-438d-8f83-ee2b7ebe1fe3', 'test_168', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 168, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(169, 'e1a205e2-f202-402d-8542-4cfc529ef514', 'test_169', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 169, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(170, 'a2e6271e-5b30-42d1-a211-494b98832676', 'test_170', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 170, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(171, '68515954-75ea-4022-9581-4cb4d28c6d6d', 'test_171', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 171, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(172, '41663b84-06b5-4787-a49e-1f745ca1eab3', 'test_172', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 172, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(173, 'b257f456-bdae-4c58-8519-756abbda462a', 'test_173', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 173, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(174, 'd848b9cb-05e4-4dcf-b9b7-431d83c41810', 'test_174', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 174, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(175, 'b6859250-dcca-47ef-b013-f609468d2389', 'test_175', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 175, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(176, 'e18bc682-897b-4696-a5ef-eee37a52a3de', 'test_176', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 176, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(177, '6b00471d-f496-4335-8209-5a9e13d18b9e', 'test_177', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 177, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(178, '35664644-7b32-4503-86f4-76adbb57762c', 'test_178', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 178, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(179, '7890415f-6563-4f25-bdf3-a5f45159a1b1', 'test_179', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 179, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(180, 'a1edf880-e270-4dac-b69f-73e61c517397', 'test_180', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 180, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(181, '73520029-5901-4022-b9da-38ccd73fe799', 'test_181', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 181, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(182, 'de5825a3-c585-45b3-88a1-7e5e80686826', 'test_182', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 182, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(183, 'bb50b80a-f471-4f64-85fb-4e5051708a4a', 'test_183', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 183, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(184, 'b7aa98b9-30da-468c-8566-06a5b804c4b9', 'test_184', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 184, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(185, 'c230e253-f874-4365-8b0e-7ba5ebc1cc26', 'test_185', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 185, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(186, '7593dbbf-9286-460b-a234-32b560817f60', 'test_186', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 186, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(187, 'ee1e2ce5-da23-4576-84e3-ad7cf4e0ce26', 'test_187', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 187, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(188, 'bf1cc1be-f405-4282-b7be-9a4578670046', 'test_188', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 188, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(189, 'e5ed670a-f944-40f0-8c10-d41c3350ead5', 'test_189', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 189, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(190, '8370db5c-e196-451a-9f5f-9b99c570cf46', 'test_190', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 190, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(191, '81498342-d247-4a60-80de-2c4cb4b1a84d', 'test_191', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 191, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(192, '213f1b3c-516e-4a6f-9785-d8c85d32f83e', 'test_192', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 192, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(193, '08ba27e6-b1b5-4d9e-a64a-6b5bc538bf43', 'test_193', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 193, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(194, 'cf0cfa8e-377c-44a0-a6d1-a74ce1de08fb', 'test_194', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 194, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(195, '2ea66412-8dc2-4081-8d48-e3637ca82604', 'test_195', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 195, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(196, '4ed466eb-ee51-4433-9d0f-3a56216698a2', 'test_196', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 196, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(197, 'cc03fc51-097d-43d6-bb6c-a0df72ec4838', 'test_197', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 197, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(198, '11844e66-8146-4263-aaa6-1fde7e5cfc58', 'test_198', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 198, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(199, 'b5a954c6-69a9-473c-a4c4-83c4f7a88c1c', 'test_199', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 199, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(200, '167e359e-7833-4ce2-9f8b-f035cee39505', 'test_200', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 200, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(201, '5afb5430-a023-4a50-aa92-b134a0fb68b3', 'test_201', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 201, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(202, 'de17b155-307c-4f9b-81f3-7f8b73d2526a', 'test_202', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 202, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(203, 'c966145b-ac05-4a2c-874d-f7b585d1d03b', 'test_203', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 203, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(204, '1d88ea5a-ab5f-40b1-bd48-f18f86eef5d9', 'test_204', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 204, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(205, '6cb0be93-7829-4bfc-ba4a-4d2cdff45447', 'test_205', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 205, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(206, 'e31a2ca7-fcaa-4b98-aac9-7e78f8605851', 'test_206', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 206, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(207, 'f26899b7-64e0-4c16-9134-cef3774f1614', 'test_207', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 207, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(208, '606cf6ab-6b5e-45d1-83b8-e535b197d2f0', 'test_208', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 208, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(209, '617bfc4e-17b1-4ca7-b736-58a74c267747', 'test_209', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 209, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(210, 'e5c26b7a-17bd-47ce-aac8-1430c57b8152', 'test_210', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 210, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(211, '7747bff5-b1e5-49b9-9a87-f93a5b790df0', 'test_211', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 211, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(212, 'c6e5b631-1e91-4ecd-8358-214eec07a91d', 'test_212', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 212, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(213, 'a874c7bd-97ac-4f48-bda5-7d3305d9067d', 'test_213', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 213, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(214, 'c7938cc2-8032-424b-8f49-85558f95364b', 'test_214', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 214, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(215, '46017ce9-d4dd-4ddc-8b73-d596e23d25ad', 'test_215', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 215, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(216, 'd5e66fd2-232e-476d-8de0-2bc1eb59630d', 'test_216', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 216, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(217, '097dc614-bc56-4f5f-a190-3ca1716a6400', 'test_217', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 217, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(218, 'a3b97132-067f-4839-9b99-830a7fb659d4', 'test_218', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 218, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(219, '8d35557f-7451-4c54-bb17-9c3d204c48d3', 'test_219', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 219, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(220, 'a6fba1ff-a5d7-4907-8cd4-1caa27cad85d', 'test_220', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 220, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(221, '427feb36-4401-4971-83de-f93672c028aa', 'test_221', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 221, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(222, '66541083-b1ab-4966-9f8b-8a1109fce0e0', 'test_222', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 222, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(223, '9939c37c-a9b9-43b7-9a4b-aacc470d47c4', 'test_223', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 223, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(224, '754379a0-bdc2-4a2d-9828-9480926b30ad', 'test_224', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 224, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(225, '18c870a1-9e2c-48fb-8a52-259e55e2052e', 'test_225', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 225, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(226, '02df9a97-b44c-4c46-ab3a-c11010d45e18', 'test_226', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 226, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(227, '20f609f7-c128-46b5-abeb-d16d46aab9ad', 'test_227', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 227, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(228, '75067ca5-872c-4149-85ad-f6685f14efc0', 'test_228', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 228, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(229, 'b8639303-d15f-4c81-b9d2-2863f53737c3', 'test_229', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 229, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(230, 'a0c4d9ea-7659-4009-ac7c-a3f089def76d', 'test_230', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 230, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(231, 'd3605113-fb9a-4640-b6fe-9931594eba6c', 'test_231', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 231, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(232, 'bf59d2cc-dd79-4ad6-9637-b04098768600', 'test_232', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 232, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(233, '304d5f24-274e-4fd6-aca4-97b761d1bd0c', 'test_233', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 233, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(234, '0d9491c3-c28b-4c11-8e28-14d93e612e35', 'test_234', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 234, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(235, 'f73a809f-78a6-4214-8060-d6037fe391aa', 'test_235', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 235, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(236, '11cc494a-86a4-44d2-b5fd-06438f95d6a4', 'test_236', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 236, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(237, '55b2e8cc-aaa4-4a8b-8a83-f732188cfab2', 'test_237', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 237, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(238, 'ebe14f0a-7bf7-4614-83c8-1e2da963139a', 'test_238', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 238, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(239, '3e83b092-95a1-4ee4-ac1f-e9df2f3954ad', 'test_239', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 239, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(240, '7304efcc-7974-453e-b2db-fdcc848f8a24', 'test_240', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 240, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(241, '6b0b51e8-f058-42a6-a9ed-3b6ebde935d8', 'test_241', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 241, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(242, 'c10f6de1-a64d-4f8f-bd0a-47bcd72ab8f7', 'test_242', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 242, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(243, '5537408c-41c6-4ee5-8f59-ca70fcdbd0ae', 'test_243', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 243, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(244, '0a920520-e271-42a6-8dc1-89f090023c89', 'test_244', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 244, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(245, 'a5120b27-cdd5-4209-b3da-bdf4b53db140', 'test_245', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 245, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(246, 'cd0f900a-dab8-4a49-805d-97e57cb5ad4c', 'test_246', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 246, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(247, '53b8b68c-0a11-411a-9b4d-01d58c9c0ff0', 'test_247', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 247, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(248, '57114ddf-7bb8-4e68-952a-faa83bf276bf', 'test_248', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 248, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(249, 'fa04c6fe-1bf0-489e-b0df-9fa4756bb90b', 'test_249', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 249, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(250, '5bf5b365-962e-4f6d-9576-94d5ac66cc3c', 'test_250', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 250, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(251, 'eca96575-798c-4919-ba93-4f0eca487490', 'test_251', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 251, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(252, 'd4e52ad1-ac1c-4f68-8d97-6858c8534f84', 'test_252', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 252, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(253, '74f88528-b57b-4482-a417-e7e8cf5ccd87', 'test_253', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 253, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(254, 'f1b969bd-2e43-4981-80d1-baeba6afd456', 'test_254', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 254, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(255, '11f5bcd3-096b-4b0f-8f1b-fa9292e3f5f3', 'test_255', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 255, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(256, 'b937e637-c00b-48de-8dd4-fae260cd9fb9', 'test_256', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 256, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(257, '49886ca5-c9a8-4c1f-9ef0-4784495e943c', 'test_257', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 257, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(258, '5cf6bbba-f2bf-4704-b288-36edb49a3c7a', 'test_258', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 258, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(259, '0a246675-78f2-47d3-a716-f9b85de0e885', 'test_259', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 259, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(260, 'b1e2509b-e9e4-40f8-b5c3-4e230e675ca8', 'test_260', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 260, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(261, 'c423ca4a-54b4-40f3-859d-d39f7d4cf266', 'test_261', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 261, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(262, '1452d005-8038-4092-ba0d-bd690dfdb2e2', 'test_262', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 262, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(263, 'f39a1721-6aeb-4f1e-90be-f54684ece8f0', 'test_263', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 263, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(264, 'ec2b02db-6eb2-4b9e-aa3b-ef53b6daf005', 'test_264', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 264, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(265, 'a6809581-e7b7-4d70-bfdd-c1f302322ee3', 'test_265', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 265, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(266, '794e2ba9-518d-4494-8ef0-01669807e10a', 'test_266', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 266, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(267, 'c258f48e-7f30-4c16-bd2d-6eed81529157', 'test_267', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 267, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(268, 'b7501b84-3a14-44d7-97da-271c416cbd16', 'test_268', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 268, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(269, '88b529d5-7804-4c4d-9f35-aa7dd1df0a37', 'test_269', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 269, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(270, '0c1b65d3-dee3-4429-864f-115fbbc6a2f4', 'test_270', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 270, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(271, '01667b0f-b397-47c1-8cdb-adb3ea7cba06', 'test_271', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 271, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(272, 'c8909fda-0453-4f74-a683-bd613fdc70c5', 'test_272', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 272, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(273, '796b8703-6f42-433f-b9e6-b115b4df25b0', 'test_273', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 273, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(274, 'de8f11f6-7298-4633-ad38-cc94e03314fd', 'test_274', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 274, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(275, 'e097f4e6-9c2d-4f35-912e-bd37f5cdec00', 'test_275', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 275, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(276, '3e0dab1e-c41f-4c0d-b2e3-d056ba6a3c60', 'test_276', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 276, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(277, 'b24cb998-40b7-471c-b55a-48b58b98b2e5', 'test_277', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 277, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(278, 'ab2113f4-56a2-4d1d-83a6-a54a763e371e', 'test_278', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 278, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(279, '2a2beb83-ccbf-413f-ade2-2fd2f79e5f49', 'test_279', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 279, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(280, 'ac53405d-8813-4cf7-ac12-fad7629d5602', 'test_280', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 280, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(281, 'b6c7b0e1-38b5-4e00-a22d-45c03d5fdeac', 'test_281', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 281, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(282, '8e41ff90-42f5-4736-89a6-24246917555c', 'test_282', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 282, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(283, '2b46023a-316f-41ae-955e-01185d67d7a5', 'test_283', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 283, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(284, '74c72c06-391e-4c72-92e7-92a5b75ac2da', 'test_284', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 284, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(285, '3e1246c2-96f9-4937-be0c-eb187822c3c7', 'test_285', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 285, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(286, '7f0e0193-b743-4394-b3e5-86e01813c094', 'test_286', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 286, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(287, '886cd06c-c30a-48df-b793-be4bfa2c1eb9', 'test_287', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 287, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(288, 'cb7cf6cd-bd2e-4956-be86-5d5935417098', 'test_288', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 288, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(289, 'd2e92f17-c26b-44dd-9c60-ca69b0f55b6d', 'test_289', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 289, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(290, 'ea3a53a1-b451-4d7b-9b9f-2b6790de314d', 'test_290', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 290, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(291, '723f2b0d-3473-445c-a6f2-9c8bb12b6019', 'test_291', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 291, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(292, '8f04e723-bb30-4952-a8f5-214845e525dc', 'test_292', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 292, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(293, '56e1991e-47e1-4136-9bd0-cd94fa40b3c8', 'test_293', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 293, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(294, 'b5ef5b82-483e-4331-ba84-78ece1f72602', 'test_294', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 294, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(295, '8238ae4e-5f13-42a3-9d6c-ea60f0ee64a1', 'test_295', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 295, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(296, '800a6a1d-1f63-4052-a14a-fcb56ab7e98b', 'test_296', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 296, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(297, '2eb884c0-8953-434d-898f-a162ffd44102', 'test_297', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 297, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(298, '06363941-bac6-4cc1-b56f-82d9d64d7c12', 'test_298', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 298, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(299, 'd8468131-79a2-4003-bf0a-e034a3455af9', 'test_299', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 299, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(300, 'e8e5f9d3-4473-46d9-b893-a195d5ccc6b4', 'test_300', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 300, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(301, '57db1144-49b7-4930-a214-9bba56c0eab6', 'test_301', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 301, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(302, '668a6ec5-142f-467d-891a-57fe10faf4bb', 'test_302', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 302, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(303, '9bcd9772-6c90-4c14-8ff4-16fa54744c87', 'test_303', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 303, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(304, '6c37ac4e-5213-4d60-8070-fadf3fa3ca38', 'test_304', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 304, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(305, 'fb5d7ea0-249f-4a0e-97aa-caa015d148e4', 'test_305', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 305, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(306, '26035205-595c-433a-8aba-4e0d6ce103a3', 'test_306', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 306, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(307, '1e4a6346-9da9-417c-bfbf-1a3cded61e12', 'test_307', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 307, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(308, '3af98cba-0cd4-4ea1-bcdc-c4c91672f038', 'test_308', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 308, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(309, 'a073f7ce-dfdc-424c-b4d0-bec7acaae445', 'test_309', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 309, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(310, '6524988e-5916-4410-a740-58d1e57d3f93', 'test_310', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 310, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(311, '58a190c4-789e-4c97-9fbb-245d3a58c8fe', 'test_311', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 311, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(312, '3244773f-b74b-461d-bf9a-916a05980c99', 'test_312', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 312, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(313, 'aaed5fa8-6555-43d2-adf4-c672008f8c92', 'test_313', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 313, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(314, 'f32415ac-f0fb-4815-bbef-27ba6115a1cc', 'test_314', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 314, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(315, '2030b697-b729-40c4-91b1-592e19fd4e73', 'test_315', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 315, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(316, 'ee47b98e-ebd5-44ae-8c9a-cbec609415b0', 'test_316', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 316, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(317, 'a47459c2-a709-4601-9151-cb57ae13bc8c', 'test_317', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 317, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(318, '5e274495-2c02-4f75-9ce2-c730e2686be9', 'test_318', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 318, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(319, 'f5f04ca8-f693-4758-9aa6-9a3c55938937', 'test_319', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 319, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(320, '5f876faf-2ad7-41f3-906d-2edd9fd2907d', 'test_320', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 320, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(321, '3d0665c6-db74-4d48-91cc-ebe39bbae605', 'test_321', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 321, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(322, '86c19bce-cb25-47a4-8aba-29c8ad4fc87d', 'test_322', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 322, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(323, 'efa06619-2301-4cb4-b9fa-6e9bddef94d7', 'test_323', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 323, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(324, '3cfc5976-aa7f-4281-8b43-6ea6eee1ac80', 'test_324', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 324, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(325, '19a56d56-1f57-45e6-9c2e-466a17d8c7ba', 'test_325', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 325, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(326, '026a45cf-cbeb-4ea9-8d20-21efbe206bad', 'test_326', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 326, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(327, '48312cae-f61d-4f87-9b20-a957d1e919ce', 'test_327', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 327, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(328, 'e06abc58-f451-4e9e-ac4f-51d5e9d424a6', 'test_328', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 328, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(329, '10b58273-4b30-4caf-954c-a1873ca4d6b5', 'test_329', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 329, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(330, '008892b7-6479-4e68-adf2-39e7ac29e66e', 'test_330', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 330, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(331, '7f864422-153c-4681-8c9e-4e942dce9548', 'test_331', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 331, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(332, '67c5538e-0363-4650-a42e-ba25746b4239', 'test_332', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 332, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(333, '208210c1-1601-47ae-883f-cdb16e0f802b', 'test_333', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 333, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(334, 'bb08395a-a0f0-490d-9d23-6f2f76b41514', 'test_334', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 334, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(335, '050c1a8e-256d-41ab-bd3a-3abe54d01b32', 'test_335', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 335, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(336, 'cf016005-9207-4a2d-a8fe-91c278029a18', 'test_336', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 336, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(337, '950a5d40-e604-4f6c-82dd-2b60a578d9aa', 'test_337', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 337, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(338, '3e00662d-6917-4759-b9a9-be8eda02f63b', 'test_338', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 338, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(339, 'bb339af3-2038-4f17-b489-46d4b7542cb6', 'test_339', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 339, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(340, '3927f6d5-5d90-4192-b84c-cebda90c0b0a', 'test_340', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 340, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(341, 'e6b29f71-bb4a-420b-8442-1f7639109465', 'test_341', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 341, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(342, 'ff7909b6-a90c-43c7-96fc-c375d439e373', 'test_342', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 342, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(343, '6f9902ca-7674-4f2f-b2e1-aeb3701bae14', 'test_343', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 343, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(344, '36d75eda-7573-474a-8aeb-f8555464154f', 'test_344', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 344, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(345, 'd3c489ae-3f03-48fe-9248-927a8bb3297f', 'test_345', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 345, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(346, '18764a4e-8b01-478e-80b3-217cc37d49c7', 'test_346', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 346, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
+(347, '00075d1c-f486-41a0-98f8-06f0354b8416', 'test_347', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 347, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null);
 
 INSERT into iam_account_authority(account_id, authority_id) VALUES
 (100,2),
diff --git a/iam-persistence/src/main/resources/db/migration/test/V3_1___duplicate_email_user.sql b/iam-persistence/src/main/resources/db/migration/test/V3_1___duplicate_email_user.sql
index 3649750bf..21bd1a023 100644
--- a/iam-persistence/src/main/resources/db/migration/test/V3_1___duplicate_email_user.sql
+++ b/iam-persistence/src/main/resources/db/migration/test/V3_1___duplicate_email_user.sql
@@ -1,20 +1,20 @@
 INSERT INTO iam_user_info(ID,GIVENNAME,FAMILYNAME, EMAIL, EMAILVERIFIED, BIRTHDATE, GENDER) VALUES
 (3, 'Duplicate', 'Email 0', 'admin@iam.test', true, '1950-01-01', 'M');
 
-INSERT INTO iam_account(id, uuid, username, password, user_info_id, creationtime, lastupdatetime, active) VALUES
+INSERT INTO iam_account(id, uuid, username, password, user_info_id, creationtime, lastupdatetime, active, mfa_enabled, totp_mfa_id) VALUES
 (3, 'bffc67b7-47fe-410c-a6a0-cf00173a8fbb', 'dup_email_0', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 
-3, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true);
+3, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null);
 
 INSERT INTO iam_user_info(ID,GIVENNAME,FAMILYNAME, EMAIL, EMAILVERIFIED, BIRTHDATE, GENDER) VALUES
 (4, 'Duplicate ', 'Email 1', 'duplicate@iam.test', true, '1950-01-01', 'M');
 
-INSERT INTO iam_account(id, uuid, username, password, user_info_id, creationtime, lastupdatetime, active) VALUES
+INSERT INTO iam_account(id, uuid, username, password, user_info_id, creationtime, lastupdatetime, active, mfa_enabled, totp_mfa_id) VALUES
 (4, '0a6fa72a-fb75-4a6c-9734-bfe673df70b3', 'dup_email_1', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 
-4, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true);
+4, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null);
 
 INSERT INTO iam_user_info(ID,GIVENNAME,FAMILYNAME, EMAIL, EMAILVERIFIED, BIRTHDATE, GENDER) VALUES
 (5, 'Duplicate ', 'Email 2', 'duplicate@iam.test', true, '1950-01-01', 'M');
 
-INSERT INTO iam_account(id, uuid, username, password, user_info_id, creationtime, lastupdatetime, active) VALUES
+INSERT INTO iam_account(id, uuid, username, password, user_info_id, creationtime, lastupdatetime, active, mfa_enabled, totp_mfa_id) VALUES
 (5, 'd836e5ec-246c-456c-8476-923ee2f831c8', 'dup_email_2', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 
-5, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true);
\ No newline at end of file
+5, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null);
\ No newline at end of file
diff --git a/iam-persistence/src/main/resources/db/migration/test/V3__basic_configuration.sql b/iam-persistence/src/main/resources/db/migration/test/V3__basic_configuration.sql
index 4592cc377..ac7d9650b 100644
--- a/iam-persistence/src/main/resources/db/migration/test/V3__basic_configuration.sql
+++ b/iam-persistence/src/main/resources/db/migration/test/V3__basic_configuration.sql
@@ -7,8 +7,8 @@ INSERT INTO iam_authority(ID, AUTH) VALUES
 INSERT INTO iam_user_info(ID,GIVENNAME,FAMILYNAME, EMAIL, EMAILVERIFIED, BIRTHDATE, PICTURE, GENDER) VALUES
 (1, 'Admin', 'User', 'admin@iam.test', true, '1950-01-01', null, 'M');
 
-INSERT INTO iam_account(id, uuid, username, password, user_info_id, creationtime, lastupdatetime, active) VALUES
-(1, '73f16d93-2441-4a50-88ff-85360d78c6b5', 'admin', 'password', 1, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true);
+INSERT INTO iam_account(id, uuid, username, password, user_info_id, creationtime, lastupdatetime, active, mfa_enabled, totp_mfa_id) VALUES
+(1, '73f16d93-2441-4a50-88ff-85360d78c6b5', 'admin', 'password', 1, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null);
 
 INSERT INTO iam_oidc_id(issuer, subject, account_id) VALUES
 ('https://accounts.google.com', '114132403455520317223', 1);
diff --git a/iam-test-client/.gitignore b/iam-test-client/.gitignore
index 9ed481cb6..a8c4c132a 100644
--- a/iam-test-client/.gitignore
+++ b/iam-test-client/.gitignore
@@ -1,2 +1,3 @@
 /.apt_generated/
 /target/
+.factorypath

From 84c843407a0042230e56dfea2ee34b8e58998985 Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Tue, 23 Nov 2021 14:42:02 +0000
Subject: [PATCH 21/76] Ignoring .factorypath autogenerated file

---
 iam-test-client/.factorypath | 82 ------------------------------------
 1 file changed, 82 deletions(-)
 delete mode 100644 iam-test-client/.factorypath

diff --git a/iam-test-client/.factorypath b/iam-test-client/.factorypath
deleted file mode 100644
index f3186a492..000000000
--- a/iam-test-client/.factorypath
+++ /dev/null
@@ -1,82 +0,0 @@
-
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-

From ccbc0816e80315e24bd5cecec4e424f681e3e0d6 Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Wed, 24 Nov 2021 16:42:38 +0000
Subject: [PATCH 22/76] Backend for adding TOTP secret to a user

This is currently done through a GET request because I couldn't get a POST request to work. Will investigate this as a TOTP needs to be passed for verification anyway.

Secrets and recovery codes are generated through the user account service and then added in plaintext. Later on, will add functionality for encrypting them
---
 iam-login-service/pom.xml                     |   7 +
 .../AuthenticatorAppController.java           |  93 ++++
 .../authenticator_app/CodeDTO.java            |  35 ++
 .../MultiFactorEvent.java                     |  14 +
 .../MultiFactorSecretAddedEvent.java          |  15 +
 .../MultiFactorSecretRemovedEvent.java        |  15 +
 .../AuthenticatorAppDisabledEvent.java        |  16 +
 .../AuthenticatorAppEnabledEvent.java         |  16 +
 .../infn/mw/iam/config/IamTotpMfaConfig.java  |  45 ++
 .../config/security/IamApiSecurityConfig.java |   1 +
 .../core/user/DefaultIamAccountService.java   |  69 ++-
 .../mw/iam/core/user/IamAccountService.java   |  35 +-
 .../MfaSecretAlreadyBoundException.java       |  13 +
 .../exception/MfaSecretNotFoundException.java |  13 +
 .../authenticator-app.controller.js           |   4 +-
 .../services/authenticator-app.service.js     |  34 +-
 .../home/enable-authenticator-app.html        |   3 +-
 .../mw/iam/persistence/model/IamAccount.java  |  15 +-
 .../mw/iam/persistence/model/IamTotpMfa.java  |  40 +-
 .../model/IamTotpRecoveryCode.java            |  37 +-
 .../db/migration/h2/V2___iam_tables.sql       |   8 +-
 .../db/migration/mysql/V2___iam_tables.sql    |   8 +-
 .../prod/V3___basic_configuration.sql         |   4 +-
 .../db/migration/test/V100000___test_data.sql | 502 +++++++++---------
 .../test/V3_1___duplicate_email_user.sql      |  12 +-
 .../test/V3__basic_configuration.sql          |   4 +-
 pom.xml                                       |   7 -
 27 files changed, 682 insertions(+), 383 deletions(-)
 create mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppController.java
 create mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/CodeDTO.java
 create mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/MultiFactorEvent.java
 create mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/MultiFactorSecretAddedEvent.java
 create mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/MultiFactorSecretRemovedEvent.java
 create mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/authenticator_app/AuthenticatorAppDisabledEvent.java
 create mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/authenticator_app/AuthenticatorAppEnabledEvent.java
 create mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/config/IamTotpMfaConfig.java
 create mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/MfaSecretAlreadyBoundException.java
 create mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/MfaSecretNotFoundException.java

diff --git a/iam-login-service/pom.xml b/iam-login-service/pom.xml
index 58e2c0632..10c40f202 100644
--- a/iam-login-service/pom.xml
+++ b/iam-login-service/pom.xml
@@ -342,6 +342,13 @@
       jaxb-runtime
     
 
+    
+    
+      dev.samstevens.totp
+      totp
+      1.7.1
+    
+
   
   
     iam-login-service
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppController.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppController.java
new file mode 100644
index 000000000..6d9f43667
--- /dev/null
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppController.java
@@ -0,0 +1,93 @@
+package it.infn.mw.iam.api.account.multi_factor_authentication.authenticator_app;
+
+import javax.validation.Valid;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.http.MediaType;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.security.oauth2.provider.OAuth2Authentication;
+import org.springframework.transaction.annotation.Transactional;
+import org.springframework.web.bind.annotation.ModelAttribute;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
+import org.springframework.web.bind.annotation.ResponseBody;
+
+import it.infn.mw.iam.api.common.NoSuchAccountError;
+import it.infn.mw.iam.core.user.IamAccountService;
+import it.infn.mw.iam.persistence.model.IamAccount;
+import it.infn.mw.iam.persistence.repository.IamAccountRepository;
+
+import org.springframework.stereotype.Controller;
+
+@SuppressWarnings("deprecation")
+@Controller
+@RequestMapping("/iam/authenticator-app")
+public class AuthenticatorAppController {
+
+  final IamAccountService service;
+  final IamAccountRepository accountRepository;
+
+  @Autowired
+  public AuthenticatorAppController(IamAccountService service,
+      IamAccountRepository accountRepository) {
+    this.service = service;
+    this.accountRepository = accountRepository;
+  }
+
+  // TODO switch to this post method from get request, post method not currently working
+  @PreAuthorize("hasRole('USER')")
+  @RequestMapping(value = "/enable", method = RequestMethod.POST,
+      produces = MediaType.TEXT_PLAIN_VALUE)
+  @ResponseBody
+  public void enableAuthenticatorApp(@Valid CodeDTO code) {
+    final String username = getUsernameFromSecurityContext();
+    IamAccount account = accountRepository.findByUsername(username)
+      .orElseThrow(() -> NoSuchAccountError.forUsername(username));
+
+    service.addTotpMfaSecret(account);
+
+    // TODO checks to see if provided code valid
+  }
+
+  @PreAuthorize("hasRole('USER')")
+  @RequestMapping(value = "/enabled", method = RequestMethod.GET,
+      produces = MediaType.TEXT_PLAIN_VALUE)
+  @ResponseBody
+  public void getenableAuthenticatorApp() {
+    final String username = getUsernameFromSecurityContext();
+    IamAccount account = accountRepository.findByUsername(username)
+      .orElseThrow(() -> NoSuchAccountError.forUsername(username));
+
+    service.addTotpMfaSecret(account);
+
+    // TODO checks to see if provided code valid
+  }
+
+  @PreAuthorize("hasRole('USER')")
+  @RequestMapping(method = RequestMethod.POST, value = "/disable",
+      produces = MediaType.TEXT_PLAIN_VALUE)
+  @ResponseBody
+  public void disableAuthenticatorApp(@ModelAttribute @Valid CodeDTO code) {
+    final String username = getUsernameFromSecurityContext();
+    IamAccount account = accountRepository.findByUsername(username)
+      .orElseThrow(() -> NoSuchAccountError.forUsername(username));
+
+    // TODO checks to see if provided code valid
+
+    service.removeTotpMfaSecret(account);
+  }
+
+  private String getUsernameFromSecurityContext() {
+
+    Authentication auth = SecurityContextHolder.getContext().getAuthentication();
+    if (auth instanceof OAuth2Authentication) {
+      OAuth2Authentication oauth = (OAuth2Authentication) auth;
+      auth = oauth.getUserAuthentication();
+    }
+    return auth.getName();
+  }
+}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/CodeDTO.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/CodeDTO.java
new file mode 100644
index 000000000..8a3ab71f9
--- /dev/null
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/CodeDTO.java
@@ -0,0 +1,35 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.infn.mw.iam.api.account.multi_factor_authentication.authenticator_app;
+
+import javax.validation.constraints.NotEmpty;
+
+import org.hibernate.validator.constraints.Length;
+
+public class CodeDTO {
+
+  @NotEmpty(message = "Code cannot be empty")
+  @Length(min = 6, max = 6, message = "Code must be six characters in length")
+  private String code;
+
+  public String getCode() {
+    return code;
+  }
+
+  public void setCode(final String code) {
+    this.code = code;
+  }
+}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/MultiFactorEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/MultiFactorEvent.java
new file mode 100644
index 000000000..2359af311
--- /dev/null
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/MultiFactorEvent.java
@@ -0,0 +1,14 @@
+package it.infn.mw.iam.audit.events.account.multi_factor_authentication;
+
+import it.infn.mw.iam.audit.events.account.AccountEvent;
+import it.infn.mw.iam.persistence.model.IamAccount;
+
+public class MultiFactorEvent extends AccountEvent {
+
+  // TODO determine this
+  // private static final long serialVersionUID = 1L;
+
+  protected MultiFactorEvent(Object source, IamAccount account, String message) {
+    super(source, account, message);
+  }
+}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/MultiFactorSecretAddedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/MultiFactorSecretAddedEvent.java
new file mode 100644
index 000000000..7c355d17d
--- /dev/null
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/MultiFactorSecretAddedEvent.java
@@ -0,0 +1,15 @@
+package it.infn.mw.iam.audit.events.account.multi_factor_authentication;
+
+import it.infn.mw.iam.persistence.model.IamAccount;
+
+public class MultiFactorSecretAddedEvent extends MultiFactorEvent {
+
+  public static final String TEMPLATE = "Multi-factor secret added to account '%s'";
+
+  // TODO add this in
+  // private static final long serialVersionUID = 3213253939764135733L;
+
+  public MultiFactorSecretAddedEvent(Object source, IamAccount account) {
+    super(source, account, String.format(TEMPLATE, account.getUsername()));
+  }
+}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/MultiFactorSecretRemovedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/MultiFactorSecretRemovedEvent.java
new file mode 100644
index 000000000..fc8b29fdb
--- /dev/null
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/MultiFactorSecretRemovedEvent.java
@@ -0,0 +1,15 @@
+package it.infn.mw.iam.audit.events.account.multi_factor_authentication;
+
+import it.infn.mw.iam.persistence.model.IamAccount;
+
+public class MultiFactorSecretRemovedEvent extends MultiFactorEvent {
+
+  public static final String TEMPLATE = "Multi-factor secret removed from account '%s'";
+
+  // TODO add this in
+  // private static final long serialVersionUID = 3213253939764135733L;
+
+  public MultiFactorSecretRemovedEvent(Object source, IamAccount account) {
+    super(source, account, String.format(TEMPLATE, account.getUsername()));
+  }
+}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/authenticator_app/AuthenticatorAppDisabledEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/authenticator_app/AuthenticatorAppDisabledEvent.java
new file mode 100644
index 000000000..6ac77340c
--- /dev/null
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/authenticator_app/AuthenticatorAppDisabledEvent.java
@@ -0,0 +1,16 @@
+package it.infn.mw.iam.audit.events.account.multi_factor_authentication.authenticator_app;
+
+import it.infn.mw.iam.audit.events.account.AccountEvent;
+import it.infn.mw.iam.persistence.model.IamAccount;
+
+public class AuthenticatorAppDisabledEvent extends AccountEvent {
+
+  public static final String TEMPLATE = "Account '%s' has disabled MFA through authenticator app";
+
+  // TODO add this in
+  // private static final long serialVersionUID = 3213253939764135733L;
+
+  public AuthenticatorAppDisabledEvent(Object source, IamAccount account) {
+    super(source, account, String.format(TEMPLATE, account.getUsername()));
+  }
+}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/authenticator_app/AuthenticatorAppEnabledEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/authenticator_app/AuthenticatorAppEnabledEvent.java
new file mode 100644
index 000000000..83841ff19
--- /dev/null
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/authenticator_app/AuthenticatorAppEnabledEvent.java
@@ -0,0 +1,16 @@
+package it.infn.mw.iam.audit.events.account.multi_factor_authentication.authenticator_app;
+
+import it.infn.mw.iam.audit.events.account.AccountEvent;
+import it.infn.mw.iam.persistence.model.IamAccount;
+
+public class AuthenticatorAppEnabledEvent extends AccountEvent {
+
+  public static final String TEMPLATE = "Account '%s' has enabled MFA through authenticator app";
+
+  // TODO add this in
+  // private static final long serialVersionUID = 3213253939764135733L;
+
+  public AuthenticatorAppEnabledEvent(Object source, IamAccount account) {
+    super(source, account, String.format(TEMPLATE, account.getUsername()));
+  }
+}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/IamTotpMfaConfig.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/IamTotpMfaConfig.java
new file mode 100644
index 000000000..b0edafdc9
--- /dev/null
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/IamTotpMfaConfig.java
@@ -0,0 +1,45 @@
+package it.infn.mw.iam.config;
+
+import dev.samstevens.totp.code.CodeVerifier;
+import dev.samstevens.totp.code.DefaultCodeGenerator;
+import dev.samstevens.totp.code.DefaultCodeVerifier;
+import dev.samstevens.totp.qr.QrGenerator;
+import dev.samstevens.totp.qr.ZxingPngQrGenerator;
+import dev.samstevens.totp.recovery.RecoveryCodeGenerator;
+import dev.samstevens.totp.time.SystemTimeProvider;
+import org.springframework.beans.factory.annotation.Qualifier;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+
+import dev.samstevens.totp.secret.DefaultSecretGenerator;
+import dev.samstevens.totp.secret.SecretGenerator;
+
+// TODO add admin config options from properties file
+
+@Configuration
+public class IamTotpMfaConfig {
+
+  @Bean
+  @Qualifier("secretGenerator")
+  public SecretGenerator secretGenerator() {
+    return new DefaultSecretGenerator();
+  }
+
+  @Bean
+  @Qualifier("qrGenerator")
+  public QrGenerator qrGenerator() {
+    return new ZxingPngQrGenerator();
+  }
+
+  @Bean
+  @Qualifier("codeVerifier")
+  public CodeVerifier codeVerifier() {
+    return new DefaultCodeVerifier(new DefaultCodeGenerator(), new SystemTimeProvider());
+  }
+
+  @Bean
+  @Qualifier("recoveryCodeGenerator")
+  public RecoveryCodeGenerator recoveryCodeGenerator() {
+    return new RecoveryCodeGenerator();
+  }
+}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamApiSecurityConfig.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamApiSecurityConfig.java
index 4fa7c1c3b..91b93acb1 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamApiSecurityConfig.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamApiSecurityConfig.java
@@ -129,6 +129,7 @@ protected void configure(final HttpSecurity http) throws Exception {
         .and()
           .authorizeRequests()
             .antMatchers("/iam/password-reset/**").permitAll()
+            .antMatchers(POST, "/iam/authenticator-app/**").permitAll()
             .antMatchers(POST, "/registration/create").permitAll()
             .antMatchers(GET, "/registration/insufficient-auth").permitAll()
             .antMatchers(GET, "/registration/username-available/**").permitAll()
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/DefaultIamAccountService.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/DefaultIamAccountService.java
index ec1d90acc..69f57aa04 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/DefaultIamAccountService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/DefaultIamAccountService.java
@@ -18,11 +18,19 @@
 import static com.google.common.base.Preconditions.checkArgument;
 import static com.google.common.base.Preconditions.checkNotNull;
 import static com.google.common.base.Strings.isNullOrEmpty;
+import it.infn.mw.iam.audit.events.account.multi_factor_authentication.MultiFactorSecretAddedEvent;
+import it.infn.mw.iam.audit.events.account.multi_factor_authentication.MultiFactorSecretRemovedEvent;
 import static it.infn.mw.iam.core.lifecycle.ExpiredAccountsHandler.LIFECYCLE_STATUS_LABEL;
+import it.infn.mw.iam.core.user.exception.MfaSecretAlreadyBoundException;
+import it.infn.mw.iam.core.user.exception.MfaSecretNotFoundException;
+import it.infn.mw.iam.persistence.model.IamTotpMfa;
+import it.infn.mw.iam.persistence.model.IamTotpRecoveryCode;
+
 import static java.util.Objects.isNull;
 
 import java.time.Clock;
 import java.util.Date;
+import java.util.HashSet;
 import java.util.LinkedHashSet;
 import java.util.List;
 import java.util.Optional;
@@ -41,6 +49,8 @@
 import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
 
+import dev.samstevens.totp.recovery.RecoveryCodeGenerator;
+import dev.samstevens.totp.secret.SecretGenerator;
 import it.infn.mw.iam.audit.events.account.AccountCreatedEvent;
 import it.infn.mw.iam.audit.events.account.AccountDisabledEvent;
 import it.infn.mw.iam.audit.events.account.AccountEndTimeUpdatedEvent;
@@ -80,12 +90,15 @@ public class DefaultIamAccountService implements IamAccountService, ApplicationE
   private final PasswordEncoder passwordEncoder;
   private ApplicationEventPublisher eventPublisher;
   private final OAuth2TokenEntityService tokenService;
+  private final SecretGenerator secretGenerator;
+  private final RecoveryCodeGenerator recoveryCodeGenerator;
 
   @Autowired
   public DefaultIamAccountService(Clock clock, IamAccountRepository accountRepo,
       IamGroupRepository groupRepo, IamAuthoritiesRepository authoritiesRepo,
       PasswordEncoder passwordEncoder, ApplicationEventPublisher eventPublisher,
-      OAuth2TokenEntityService tokenService) {
+      OAuth2TokenEntityService tokenService, SecretGenerator secretGenerator,
+      RecoveryCodeGenerator recoveryCodeGenerator) {
 
     this.clock = clock;
     this.accountRepo = accountRepo;
@@ -94,6 +107,8 @@ public DefaultIamAccountService(Clock clock, IamAccountRepository accountRepo,
     this.passwordEncoder = passwordEncoder;
     this.eventPublisher = eventPublisher;
     this.tokenService = tokenService;
+    this.secretGenerator = secretGenerator;
+    this.recoveryCodeGenerator = recoveryCodeGenerator;
   }
 
   private void labelSetEvent(IamAccount account, IamLabel label) {
@@ -120,6 +135,14 @@ private void attributeRemovedEvent(IamAccount account, IamAttribute attribute) {
     eventPublisher.publishEvent(new AccountAttributeRemovedEvent(this, account, attribute));
   }
 
+  private void multiFactorSecretAddedEvent(IamAccount account) {
+    eventPublisher.publishEvent(new MultiFactorSecretAddedEvent(this, account));
+  }
+
+  private void multiFactorSecretRemovedEvent(IamAccount account) {
+    eventPublisher.publishEvent(new MultiFactorSecretRemovedEvent(this, account));
+  }
+
   @Override
   public IamAccount createAccount(IamAccount account) {
     checkNotNull(account, "Cannot create a null account");
@@ -558,4 +581,48 @@ public IamAccount removeSshKey(IamAccount account, IamSshKey key) {
   public void setApplicationEventPublisher(ApplicationEventPublisher applicationEventPublisher) {
     eventPublisher = applicationEventPublisher;
   }
+
+  // TODO encrypt secret and recovery codes
+  // TODO move this secret generation to its own class
+  @Override
+  public IamAccount addTotpMfaSecret(IamAccount account) {
+    if (!isNull(account.getTotpMfa())) {
+      throw new MfaSecretAlreadyBoundException(
+          "A multi-factor secret is already assigned to this account");
+    }
+
+    IamTotpMfa totpMfa = new IamTotpMfa(account);
+    totpMfa.setSecret(secretGenerator.generate());
+
+    String[] recoveryCodeStrings = recoveryCodeGenerator.generateCodes(6);
+    Set recoveryCodes = new HashSet<>();
+    for (String code : recoveryCodeStrings) {
+      IamTotpRecoveryCode recoveryCode = new IamTotpRecoveryCode(totpMfa);
+      recoveryCode.setCode(code);
+      recoveryCodes.add(recoveryCode);
+    }
+
+    totpMfa.setRecoveryCodes(recoveryCodes);
+    account.setTotpMfa(totpMfa);
+    totpMfa.setAccount(account);
+    account.touch();
+
+    accountRepo.save(account);
+    multiFactorSecretAddedEvent(account);
+    return account;
+  }
+
+  @Override
+  public IamAccount removeTotpMfaSecret(IamAccount account) {
+    if (isNull(account.getTotpMfa())) {
+      throw new MfaSecretNotFoundException("No multi-factor secret is attached to this account");
+    }
+
+    account.setTotpMfa(null);
+    account.touch();
+
+    accountRepo.save(account);
+    multiFactorSecretRemovedEvent(account);
+    return account;
+  }
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/IamAccountService.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/IamAccountService.java
index d608893ea..8bc4e1c7b 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/IamAccountService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/IamAccountService.java
@@ -33,14 +33,15 @@
  */
 public interface IamAccountService {
 
-  
+
   /**
    * Finds an account by UUID
-   * @param uuid 
+   * 
+   * @param uuid
    * @return an {@link Optional} iam account
    */
   Optional findByUuid(String uuid);
-  
+
   /**
    * Creates a new {@link IamAccount}, after some checks.
    * 
@@ -93,29 +94,32 @@ public interface IamAccountService {
    * @return the updated account
    */
   IamAccount deleteLabel(IamAccount account, IamLabel label);
-  
+
   /**
    * Sets end time for a given account
+   * 
    * @param account
    * @param endTime
    * @return the updated account
    */
   IamAccount setAccountEndTime(IamAccount account, Date endTime);
-  
+
   /**
    * Disables account
+   * 
    * @param account
    * @return the updated account
    */
   IamAccount disableAccount(IamAccount account);
-  
+
   /**
    * Restores account
+   * 
    * @param account
    * @return the updated account
    */
   IamAccount restoreAccount(IamAccount account);
-  
+
   /**
    * Sets an attribute for the account
    * 
@@ -180,4 +184,21 @@ public interface IamAccountService {
    */
   IamAccount removeSshKey(IamAccount account, IamSshKey key);
 
+  /**
+   * Adds a multi-factor secret to an account
+   * 
+   * @param account
+   * @param totpMfa
+   * @return the updated account
+   */
+  IamAccount addTotpMfaSecret(IamAccount account);
+
+  /**
+   * Removes a multi-factor secret from an account
+   * 
+   * @param account
+   * @return the updated account
+   */
+  IamAccount removeTotpMfaSecret(IamAccount account);
+
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/MfaSecretAlreadyBoundException.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/MfaSecretAlreadyBoundException.java
new file mode 100644
index 000000000..e5a8bc840
--- /dev/null
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/MfaSecretAlreadyBoundException.java
@@ -0,0 +1,13 @@
+package it.infn.mw.iam.core.user.exception;
+
+public class MfaSecretAlreadyBoundException extends IamAccountException {
+  
+  /**
+   * TODO assign serialVersionUID
+   */
+  // private static final long serialVersionUID = 4103663720620113509L;
+
+  public MfaSecretAlreadyBoundException(String message) {
+    super(message);
+  }
+}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/MfaSecretNotFoundException.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/MfaSecretNotFoundException.java
new file mode 100644
index 000000000..966545821
--- /dev/null
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/MfaSecretNotFoundException.java
@@ -0,0 +1,13 @@
+package it.infn.mw.iam.core.user.exception;
+
+public class MfaSecretNotFoundException extends IamAccountException {
+
+  /**
+   * TODO assign serialVersionUID
+   */
+  // private static final long serialVersionUID = 4103663720620113509L;
+
+  public MfaSecretNotFoundException(String message) {
+    super(message);
+  }
+}
diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/authenticator-app.controller.js b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/authenticator-app.controller.js
index edf3f6039..cc12cefc5 100644
--- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/authenticator-app.controller.js
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/authenticator-app.controller.js
@@ -42,8 +42,8 @@
         code: ''
       };
 
-      if ($scope.userMfaForm) {
-        $scope.userMfaForm.$setPristine();
+      if ($scope.authenticatorAppForm) {
+        $scope.authenticatorAppForm.$setPristine();
       }
     }
 
diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/services/authenticator-app.service.js b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/services/authenticator-app.service.js
index 5b28f4f6b..0144a8622 100644
--- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/services/authenticator-app.service.js
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/services/authenticator-app.service.js
@@ -30,25 +30,27 @@ function AuthenticatorAppService($http, $httpParamSerializerJQLike){
 	
 	// TODO two functions are broadly similar. This could be simplified into the foundations for step-up authentication
 	function enableAuthenticatorApp(code){
+
+		return $http.get('/iam/authenticator-app/enabled');
 		
-		var data = $httpParamSerializerJQLike({
-				code: code
-		});
+		// var data = $httpParamSerializerJQLike({
+		// 		code: code
+		// });
 		
-		var config = {
-			headers : {
-				'Accept' : 'text/plain',
-				'Content-Type': 'application/x-www-form-urlencoded'
-			},
-			transformRequest: function(obj) {
-		        var str = [];
-		        for(var p in obj)
-		        str.push(encodeURIComponent(p) + "=" + encodeURIComponent(obj[p]));
-		        return str.join("&");
-		    }
-		};
+		// var config = {
+		// 	headers : {
+		// 		'Accept' : 'text/plain',
+		// 		'Content-Type': 'application/x-www-form-urlencoded'
+		// 	},
+		// 	transformRequest: function(obj) {
+		//         var str = [];
+		//         for(var p in obj)
+		//         str.push(encodeURIComponent(p) + "=" + encodeURIComponent(obj[p]));
+		//         return str.join("&");
+		//     }
+		// }; 
 		
-		return $http.post('/iam/authenticator-app/enable', data, config);	
+		// return $http.post('/iam/authenticator-app/enable', data, config);
 	};
 	
 	function disableAuthenticatorApp(code){
diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/enable-authenticator-app.html b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/enable-authenticator-app.html
index 403919f31..b113b705a 100644
--- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/enable-authenticator-app.html
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/enable-authenticator-app.html
@@ -43,7 +43,8 @@ 
Enable authenticator app

     

 
   

-    
+    
+    
     
     
   

diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAccount.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAccount.java
index 7bab4f59b..67374ed67 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAccount.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAccount.java
@@ -92,11 +92,8 @@ public class IamAccount implements Serializable {
   @JoinColumn(name = "user_info_id")
   private IamUserInfo userInfo;
 
-  @Column(name = "mfa_enabled", nullable = false)
-  private boolean mfaEnabled;
-
-  @OneToOne(cascade = CascadeType.ALL, mappedBy = "account")
-  @JoinColumn(name = "totp_mfa", referencedColumnName = "id", nullable = true)
+  @OneToOne(cascade = CascadeType.ALL)
+  @JoinColumn(name = "totp_mfa_id", nullable = true)
   private IamTotpMfa totpMfa;
 
   @Temporal(TemporalType.TIMESTAMP)
@@ -252,14 +249,6 @@ public void setActive(final boolean active) {
     this.active = active;
   }
 
-  public boolean isMfaEnabled() {
-    return mfaEnabled;
-  }
-
-  public void setMfaEnabled(final boolean mfaEnabled) {
-    this.mfaEnabled = mfaEnabled;
-  }
-
   public IamTotpMfa getTotpMfa() {
     return totpMfa;
   }
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpMfa.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpMfa.java
index 5e2eebf5a..edb91a3fb 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpMfa.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpMfa.java
@@ -16,7 +16,6 @@
 package it.infn.mw.iam.persistence.model;
 
 import java.io.Serializable;
-import java.util.Date;
 import java.util.HashSet;
 import java.util.Set;
 
@@ -30,12 +29,11 @@
 import javax.persistence.OneToMany;
 import javax.persistence.OneToOne;
 import javax.persistence.Table;
-import javax.persistence.Temporal;
-import javax.persistence.TemporalType;
 
 @Entity
 @Table(name = "iam_totp_mfa")
 public class IamTotpMfa implements Serializable {
+
   @Id
   @GeneratedValue(strategy = GenerationType.IDENTITY)
   private Long id;
@@ -46,14 +44,6 @@ public class IamTotpMfa implements Serializable {
   @Column(name = "secret")
   private String secret;
 
-  @Temporal(TemporalType.TIMESTAMP)
-  @Column(name = "creationtime", nullable = false)
-  private Date creationTime;
-
-  @Temporal(TemporalType.TIMESTAMP)
-  @Column(name = "lastupdatetime", nullable = false)
-  private Date lastUpdateTime;
-
   @Column(name = "active", nullable = false)
   private boolean active;
 
@@ -65,8 +55,8 @@ public class IamTotpMfa implements Serializable {
 
   public IamTotpMfa() {}
 
-  public IamTotpMfa(String secret) {
-    this.secret = secret;
+  public IamTotpMfa(IamAccount account) {
+    this.account = account;
   }
 
   public Long getId() {
@@ -93,26 +83,6 @@ public void setSecret(final String secret) {
     this.secret = secret;
   }
 
-  public Date getCreationTime() {
-
-    return creationTime;
-  }
-
-  public void setCreationTime(final Date creationTime) {
-
-    this.creationTime = creationTime;
-  }
-
-  public Date getLastUpdateTime() {
-
-    return lastUpdateTime;
-  }
-
-  public void setLastUpdateTime(final Date lastUpdateTime) {
-
-    this.lastUpdateTime = lastUpdateTime;
-  }
-
   public boolean isActive() {
 
     return active;
@@ -136,6 +106,10 @@ public void setRecoveryCodes(final Set recoveryCodes) {
     }
   }
 
+  public void regenerateRecoveryCodes() {
+    // TODO
+  }
+
   @Override
   public String toString() {
     return "IamAccount [id=" + id + ", secret=" + secret + ", active=" + active + "]";
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpRecoveryCode.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpRecoveryCode.java
index f5f964c08..6ba4df9b2 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpRecoveryCode.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpRecoveryCode.java
@@ -16,7 +16,6 @@
 package it.infn.mw.iam.persistence.model;
 
 import java.io.Serializable;
-import java.util.Date;
 
 import javax.persistence.Column;
 import javax.persistence.Entity;
@@ -27,8 +26,6 @@
 import javax.persistence.JoinColumn;
 import javax.persistence.ManyToOne;
 import javax.persistence.Table;
-import javax.persistence.Temporal;
-import javax.persistence.TemporalType;
 
 @Entity
 @Table(name = "iam_totp_recovery_code")
@@ -42,21 +39,13 @@ public class IamTotpRecoveryCode implements Serializable {
   private String code;
 
   @ManyToOne(fetch = FetchType.EAGER)
-  @JoinColumn(referencedColumnName = "id", nullable = false)
+  @JoinColumn(referencedColumnName = "id", nullable = false, name = "totp_mfa_id")
   private IamTotpMfa totpMfa;
 
-  @Temporal(TemporalType.TIMESTAMP)
-  @Column(name = "creationtime", nullable = false)
-  private Date creationTime;
-
-  @Temporal(TemporalType.TIMESTAMP)
-  @Column(name = "lastupdatetime", nullable = false)
-  private Date lastUpdateTime;
-
   public IamTotpRecoveryCode() {}
 
-  public IamTotpRecoveryCode(String code) {
-    this.code = code;
+  public IamTotpRecoveryCode(IamTotpMfa totpMfa) {
+    this.totpMfa = totpMfa;
   }
 
   public Long getId() {
@@ -83,26 +72,6 @@ public void setCode(final String code) {
     this.code = code;
   }
 
-  public Date getCreationTime() {
-
-    return creationTime;
-  }
-
-  public void setCreationTime(final Date creationTime) {
-
-    this.creationTime = creationTime;
-  }
-
-  public Date getLastUpdateTime() {
-
-    return lastUpdateTime;
-  }
-
-  public void setLastUpdateTime(final Date lastUpdateTime) {
-
-    this.lastUpdateTime = lastUpdateTime;
-  }
-
   @Override
   public String toString() {
     return "IamAccount [id=" + id + ", code=" + code + "]";
diff --git a/iam-persistence/src/main/resources/db/migration/h2/V2___iam_tables.sql b/iam-persistence/src/main/resources/db/migration/h2/V2___iam_tables.sql
index b09ea6531..821396514 100644
--- a/iam-persistence/src/main/resources/db/migration/h2/V2___iam_tables.sql
+++ b/iam-persistence/src/main/resources/db/migration/h2/V2___iam_tables.sql
@@ -1,4 +1,4 @@
-CREATE TABLE iam_account (ID BIGINT IDENTITY NOT NULL, active BOOLEAN NOT NULL, CREATIONTIME TIMESTAMP NOT NULL, LASTUPDATETIME TIMESTAMP NOT NULL, PASSWORD VARCHAR(128), USERNAME VARCHAR(128) NOT NULL UNIQUE, UUID VARCHAR(36) NOT NULL UNIQUE, user_info_id BIGINT, mfa_enabled BOOLEAN NOT NULL, totp_mfa_id BIGINT, PRIMARY KEY (ID));
+CREATE TABLE iam_account (ID BIGINT IDENTITY NOT NULL, active BOOLEAN NOT NULL, CREATIONTIME TIMESTAMP NOT NULL, LASTUPDATETIME TIMESTAMP NOT NULL, PASSWORD VARCHAR(128), USERNAME VARCHAR(128) NOT NULL UNIQUE, UUID VARCHAR(36) NOT NULL UNIQUE, user_info_id BIGINT, totp_mfa_id BIGINT, PRIMARY KEY (ID));
 CREATE TABLE iam_authority (ID BIGINT IDENTITY NOT NULL, auth VARCHAR(128) NOT NULL UNIQUE, PRIMARY KEY (ID));
 CREATE TABLE iam_group (ID BIGINT IDENTITY NOT NULL, CREATIONTIME TIMESTAMP NOT NULL, DESCRIPTION VARCHAR(512), LASTUPDATETIME TIMESTAMP NOT NULL, NAME VARCHAR(255) NOT NULL UNIQUE, UUID VARCHAR(36) NOT NULL UNIQUE, PRIMARY KEY (ID));
 CREATE TABLE iam_oidc_id (ID BIGINT IDENTITY NOT NULL, ISSUER VARCHAR(256) NOT NULL, SUBJECT VARCHAR(256) NOT NULL, account_id BIGINT, PRIMARY KEY (ID));
@@ -8,12 +8,12 @@ CREATE TABLE iam_user_info (ID BIGINT IDENTITY NOT NULL, BIRTHDATE VARCHAR, EMAI
 CREATE TABLE iam_x509_cert (ID BIGINT IDENTITY NOT NULL, CERTIFICATESUBJECT VARCHAR(128) NOT NULL UNIQUE, LABEL VARCHAR(36) NOT NULL UNIQUE, is_primary BOOLEAN, ACCOUNT_ID BIGINT, PRIMARY KEY (ID));
 CREATE TABLE iam_account_authority (account_id BIGINT NOT NULL, authority_id BIGINT NOT NULL, PRIMARY KEY (account_id, authority_id));
 CREATE TABLE iam_account_group (account_id BIGINT NOT NULL, group_id BIGINT NOT NULL, PRIMARY KEY (account_id, group_id));
-CREATE TABLE iam_totp_mfa (ID BIGINT NOT NULL, active BOOLEAN NOT NULL, CREATIONTIME TIMESTAMP NOT NULL, LASTUPDATETIME TIMESTAMP NOT NULL, secret VARCHAR(256), ACCOUNT_ID BIGINT, PRIMARY KEY (ID));
-CREATE TABLE iam_totp_recovery_code (ID BIGINT NOT NULL, code VARCHAR(255) NOT NULL, CREATIONTIME TIMESTAMP NOT NULL, LASTUPDATETIME TIMESTAMP NOT NULL, TOTP_MFA_ID BIGINT NOT NULL, PRIMARY KEY (ID));
+CREATE TABLE iam_totp_mfa (ID BIGINT IDENTITY NOT NULL, active BOOLEAN NOT NULL, secret VARCHAR(256), ACCOUNT_ID BIGINT, PRIMARY KEY (ID));
+CREATE TABLE iam_totp_recovery_code (ID BIGINT IDENTITY NOT NULL, code VARCHAR(255) NOT NULL, totp_mfa_id BIGINT NOT NULL, PRIMARY KEY (ID));
 ALTER TABLE iam_account ADD CONSTRAINT FK_iam_account_user_info_id FOREIGN KEY (user_info_id) REFERENCES iam_user_info (ID);
 ALTER TABLE iam_account ADD CONSTRAINT FK_iam_account_totp_mfa_id FOREIGN KEY (totp_mfa_id) REFERENCES iam_totp_mfa (ID);
 ALTER TABLE iam_totp_mfa ADD CONSTRAINT FK_iam_totp_mfa_account_id FOREIGN KEY (ACCOUNT_ID) REFERENCES iam_account (ID);
-ALTER TABLE iam_totp_recovery_code ADD CONSTRAINT FK_iam_totp_recovery_code_totp_mfa_id FOREIGN KEY (TOTP_MFA_ID) REFERENCES iam_totp_mfa (ID);
+ALTER TABLE iam_totp_recovery_code ADD CONSTRAINT FK_iam_totp_recovery_code_totp_mfa_id FOREIGN KEY (totp_mfa_id) REFERENCES iam_totp_mfa (ID);
 ALTER TABLE iam_oidc_id ADD CONSTRAINT FK_iam_oidc_id_account_id FOREIGN KEY (account_id) REFERENCES iam_account (ID);
 ALTER TABLE iam_saml_id ADD CONSTRAINT FK_iam_saml_id_account_id FOREIGN KEY (account_id) REFERENCES iam_account (ID);
 ALTER TABLE iam_ssh_key ADD CONSTRAINT FK_iam_ssh_key_ACCOUNT_ID FOREIGN KEY (ACCOUNT_ID) REFERENCES iam_account (ID);
diff --git a/iam-persistence/src/main/resources/db/migration/mysql/V2___iam_tables.sql b/iam-persistence/src/main/resources/db/migration/mysql/V2___iam_tables.sql
index 8c3bd63e8..b6a301533 100644
--- a/iam-persistence/src/main/resources/db/migration/mysql/V2___iam_tables.sql
+++ b/iam-persistence/src/main/resources/db/migration/mysql/V2___iam_tables.sql
@@ -1,4 +1,4 @@
-CREATE TABLE iam_account (ID BIGINT AUTO_INCREMENT NOT NULL, active TINYINT(1) default 0 NOT NULL, CREATIONTIME DATETIME NOT NULL, LASTUPDATETIME DATETIME NOT NULL, PASSWORD VARCHAR(128), USERNAME VARCHAR(128) NOT NULL UNIQUE, UUID VARCHAR(36) NOT NULL UNIQUE, user_info_id BIGINT, mfa_enabled TINYINT(1) default 0 NOT NULL, totp_mfa_id BIGINT, PRIMARY KEY (ID));
+CREATE TABLE iam_account (ID BIGINT AUTO_INCREMENT NOT NULL, active TINYINT(1) default 0 NOT NULL, CREATIONTIME DATETIME NOT NULL, LASTUPDATETIME DATETIME NOT NULL, PASSWORD VARCHAR(128), USERNAME VARCHAR(128) NOT NULL UNIQUE, UUID VARCHAR(36) NOT NULL UNIQUE, user_info_id BIGINT, totp_mfa_id BIGINT, PRIMARY KEY (ID));
 CREATE TABLE iam_authority (ID BIGINT AUTO_INCREMENT NOT NULL, auth VARCHAR(128) NOT NULL UNIQUE, PRIMARY KEY (ID));
 CREATE TABLE iam_group (ID BIGINT AUTO_INCREMENT NOT NULL, CREATIONTIME DATETIME NOT NULL, DESCRIPTION VARCHAR(512), LASTUPDATETIME DATETIME NOT NULL, NAME VARCHAR(255) NOT NULL UNIQUE, UUID VARCHAR(36) NOT NULL UNIQUE, PRIMARY KEY (ID));
 CREATE TABLE iam_oidc_id (ID BIGINT AUTO_INCREMENT NOT NULL, ISSUER VARCHAR(256) NOT NULL, SUBJECT VARCHAR(256) NOT NULL, account_id BIGINT, PRIMARY KEY (ID));
@@ -8,12 +8,12 @@ CREATE TABLE iam_user_info (ID BIGINT AUTO_INCREMENT NOT NULL, BIRTHDATE VARCHAR
 CREATE TABLE iam_x509_cert (ID BIGINT AUTO_INCREMENT NOT NULL, CERTIFICATESUBJECT VARCHAR(128) NOT NULL UNIQUE, LABEL VARCHAR(36) NOT NULL UNIQUE, is_primary TINYINT(1) default 0, ACCOUNT_ID BIGINT, PRIMARY KEY (ID));
 CREATE TABLE iam_account_authority (account_id BIGINT NOT NULL, authority_id BIGINT NOT NULL, PRIMARY KEY (account_id, authority_id));
 CREATE TABLE iam_account_group (account_id BIGINT NOT NULL, group_id BIGINT NOT NULL, PRIMARY KEY (account_id, group_id));
-CREATE TABLE iam_totp_mfa (ID BIGINT NOT NULL, active TINYINT(1) default 0 NOT NULL, CREATIONTIME DATETIME NOT NULL, LASTUPDATETIME DATETIME NOT NULL, secret VARCHAR(256), ACCOUNT_ID BIGINT, PRIMARY KEY (ID));
-CREATE TABLE iam_totp_recovery_code (ID BIGINT NOT NULL, code VARCHAR(255) NOT NULL, CREATIONTIME DATETIME NOT NULL, LASTUPDATETIME DATETIME NOT NULL, TOTP_MFA_ID BIGINT NOT NULL, PRIMARY KEY (ID));
+CREATE TABLE iam_totp_mfa (ID BIGINT AUTO_INCREMENT NOT NULL, active TINYINT(1) default 0 NOT NULL, secret VARCHAR(256), ACCOUNT_ID BIGINT, PRIMARY KEY (ID));
+CREATE TABLE iam_totp_recovery_code (ID BIGINT AUTO_INCREMENT NOT NULL, code VARCHAR(255) NOT NULL, totp_mfa_id BIGINT NOT NULL, PRIMARY KEY (ID));
 ALTER TABLE iam_account ADD CONSTRAINT FK_iam_account_user_info_id FOREIGN KEY (user_info_id) REFERENCES iam_user_info (ID);
 ALTER TABLE iam_account ADD CONSTRAINT FK_iam_account_totp_mfa_id FOREIGN KEY (totp_mfa_id) REFERENCES iam_totp_mfa (ID);
 ALTER TABLE iam_totp_mfa ADD CONSTRAINT FK_iam_totp_mfa_account_id FOREIGN KEY (ACCOUNT_ID) REFERENCES iam_account (ID);
-ALTER TABLE iam_totp_recovery_code ADD CONSTRAINT FK_iam_totp_recovery_code_totp_mfa_id FOREIGN KEY (TOTP_MFA_ID) REFERENCES iam_totp_mfa (ID);
+ALTER TABLE iam_totp_recovery_code ADD CONSTRAINT FK_iam_totp_recovery_code_totp_mfa_id FOREIGN KEY (totp_mfa_id) REFERENCES iam_totp_mfa (ID);
 ALTER TABLE iam_oidc_id ADD CONSTRAINT FK_iam_oidc_id_account_id FOREIGN KEY (account_id) REFERENCES iam_account (ID);
 ALTER TABLE iam_saml_id ADD CONSTRAINT FK_iam_saml_id_account_id FOREIGN KEY (account_id) REFERENCES iam_account (ID);
 ALTER TABLE iam_ssh_key ADD CONSTRAINT FK_iam_ssh_key_ACCOUNT_ID FOREIGN KEY (ACCOUNT_ID) REFERENCES iam_account (ID);
diff --git a/iam-persistence/src/main/resources/db/migration/prod/V3___basic_configuration.sql b/iam-persistence/src/main/resources/db/migration/prod/V3___basic_configuration.sql
index 89429dc55..5a046892a 100644
--- a/iam-persistence/src/main/resources/db/migration/prod/V3___basic_configuration.sql
+++ b/iam-persistence/src/main/resources/db/migration/prod/V3___basic_configuration.sql
@@ -15,8 +15,8 @@ INSERT INTO iam_authority(ID, AUTH) VALUES
 INSERT INTO iam_user_info(ID,GIVENNAME,FAMILYNAME, EMAIL, EMAILVERIFIED) VALUES
 (1, 'Admin', 'User', 'admin@iam.test', true);
 
-INSERT INTO iam_account(id, uuid, username, password, user_info_id, creationtime, lastupdatetime, active, mfa_enabled, totp_mfa_id) VALUES
-(1, '73f16d93-2441-4a50-88ff-85360d78c6b5', 'admin', 'password', 1, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null);
+INSERT INTO iam_account(id, uuid, username, password, user_info_id, creationtime, lastupdatetime, active, totp_mfa_id) VALUES
+(1, '73f16d93-2441-4a50-88ff-85360d78c6b5', 'admin', 'password', 1, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null);
 
 INSERT INTO iam_account_authority(account_id, authority_id) VALUES
 (1,1),
diff --git a/iam-persistence/src/main/resources/db/migration/test/V100000___test_data.sql b/iam-persistence/src/main/resources/db/migration/test/V100000___test_data.sql
index 4d0addfdc..f52daa784 100644
--- a/iam-persistence/src/main/resources/db/migration/test/V100000___test_data.sql
+++ b/iam-persistence/src/main/resources/db/migration/test/V100000___test_data.sql
@@ -180,8 +180,8 @@ INSERT INTO iam_user_info(ID,GIVENNAME,FAMILYNAME, EMAIL, EMAILVERIFIED, BIRTHDA
 (2, 'Test', 'User', 'test@iam.test', true, '1950-01-01','M');
 
 
-INSERT INTO iam_account(id, uuid, username, password, user_info_id, creationtime, lastupdatetime, active, mfa_enabled, totp_mfa_id) VALUES
-(2, '80e5fb8d-b7c8-451a-89ba-346ae278a66f', 'test', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 2, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null);
+INSERT INTO iam_account(id, uuid, username, password, user_info_id, creationtime, lastupdatetime, active, totp_mfa_id) VALUES
+(2, '80e5fb8d-b7c8-451a-89ba-346ae278a66f', 'test', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 2, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null);
 
 
 INSERT INTO iam_oidc_id(issuer, subject, account_id) VALUES
@@ -503,255 +503,255 @@ INSERT INTO iam_user_info(ID,GIVENNAME,FAMILYNAME, EMAIL, EMAILVERIFIED) VALUES
 (346, 'Test-346','User', 'test-346@test.org', true),
 (347, 'Test-347','User', 'test-347@test.org', true);
 
-INSERT INTO iam_account(id, uuid, username, password, user_info_id, creationtime, lastupdatetime, active, mfa_enabled, totp_mfa_id) VALUES
-(100, 'f2ce8cb2-a1db-4884-9ef0-d8842cc02b4a', 'test_100', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 100, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(101, '1a78b3b8-22d2-4746-9269-df55aceb036f', 'test_101', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 101, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(102, 'a07d60c6-7ffa-475f-98e4-f9f648aa278b', 'test_102', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 102, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(103, '56e1b885-ea25-4ffc-ba17-fcde2b097d02', 'test_103', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 103, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(104, '67d2794d-c7fb-406e-9bc1-b66f43cbe60f', 'test_104', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 104, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(105, 'd11e04f7-f369-4de6-9375-394f7d886ac7', 'test_105', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 105, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(106, 'bbc76b76-9f9e-443b-8c63-cd775c50c6f3', 'test_106', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 106, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(107, 'b15c850c-e6e0-4afb-a02d-374653bb102e', 'test_107', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 107, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(108, 'afada6e8-d50d-47f6-912e-d6261605c771', 'test_108', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 108, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(109, 'fa3b4c97-4787-4b49-a32c-5b4c74d5a7c8', 'test_109', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 109, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(110, '33165df6-4d49-4728-883c-3fd42720d46b', 'test_110', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 110, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(111, '15fb8d3a-003d-4ef9-8349-867d81d4ae9c', 'test_111', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 111, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(112, '7a4dda33-c2e5-4304-998a-3fa4df481123', 'test_112', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 112, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(113, '7013f989-0a95-43b5-8637-2e2360a73bb3', 'test_113', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 113, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(114, '12caabc8-4766-4028-98ff-f4d7f288a5f0', 'test_114', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 114, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(115, 'f463ad2b-5814-4877-bb62-f954c67a8044', 'test_115', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 115, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(116, '28c656c4-5489-4654-a257-0806c6bab905', 'test_116', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 116, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(117, '11be5a72-9416-45fc-a0a7-f3e23c54bfda', 'test_117', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 117, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(118, '3cea2c01-786e-41a3-8fdf-4229cc4e3742', 'test_118', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 118, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(119, 'e0247677-4542-4df3-8d75-8efa11e70911', 'test_119', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 119, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(120, 'd905a115-d726-4e11-ba1f-b8482177bb05', 'test_120', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 120, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(121, '3479afd1-584c-4479-b6e2-25f6cef2f842', 'test_121', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 121, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(122, '8d4f467d-cb68-4feb-b898-71e4487e6820', 'test_122', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 122, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(123, '0ddee1c2-1426-4b83-b520-e20bdd8ef9b3', 'test_123', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 123, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(124, 'b8b638be-6e09-4dbe-bcc0-776c2403e8c7', 'test_124', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 124, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(125, '1dc3108a-b5c0-4e5b-accd-925054075bc4', 'test_125', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 125, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(126, '5eed3374-c131-4513-84b7-dd0ff965da35', 'test_126', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 126, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(127, '2d0b4c36-0301-49f6-a20b-23b6ca48cee2', 'test_127', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 127, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(128, 'db46065a-ba62-423d-9397-7bc6fab371a5', 'test_128', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 128, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(129, 'd9dbaabf-c51a-45e5-aee1-25134ba283ac', 'test_129', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 129, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(130, '5678f40a-f361-464c-aa71-ffb48d163aaa', 'test_130', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 130, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(131, '209ae3b9-e266-4e57-a639-db29f61a7594', 'test_131', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 131, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(132, 'f3fac505-d5c9-4d9c-83af-3976f357f19c', 'test_132', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 132, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(133, '13bfd34b-1dda-452e-bd9a-284aabccf07d', 'test_133', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 133, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(134, '15ccd152-1537-48d4-a55a-fd6565e5d86f', 'test_134', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 134, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(135, '6b2f4fc1-3e98-4f64-8fb4-517d2d4b3fa3', 'test_135', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 135, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(136, '398081ee-9c3c-4e5d-802c-90a4579030d4', 'test_136', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 136, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(137, '89a32317-dd45-481d-91a4-080e30c1f29e', 'test_137', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 137, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(138, '6dc0aa56-011d-45b8-bf26-cb03e8b40ccf', 'test_138', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 138, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(139, 'cd62277e-5acf-41af-acea-b4d208cba29e', 'test_139', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 139, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(140, '0ae29eac-64ee-45b4-a2e7-e58b34c7ff0e', 'test_140', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 140, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(141, '0f7fe907-fa84-429e-8057-02d809375ba3', 'test_141', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 141, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(142, '7aa4a733-d318-4392-b3d3-6618263f667d', 'test_142', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 142, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(143, 'b1d9b1ac-e77c-4d55-a895-cf0788ed2174', 'test_143', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 143, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(144, 'f975f1f7-ad05-4d66-9905-d44c13cbd08b', 'test_144', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 144, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(145, '857f6e6d-e415-4850-a82b-59d557864910', 'test_145', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 145, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(146, '4e1c059c-1d06-4997-8bfa-5bd09fdb4571', 'test_146', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 146, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(147, 'f4a0bc7f-b279-4caf-b8d1-c86a3c106f62', 'test_147', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 147, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(148, '007bbb9d-55b1-4f5e-80a5-bbcb22073db4', 'test_148', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 148, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(149, 'a1d22bbf-9afe-49da-b75d-b58f825db351', 'test_149', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 149, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(150, '8c2351d5-5460-4b2d-b1bb-7b086130090e', 'test_150', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 150, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(151, 'e6651896-66f8-4f63-b44f-71710fdb947c', 'test_151', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 151, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(152, 'caf04a3c-8f35-40a3-99b6-48ba6a05d8b8', 'test_152', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 152, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(153, 'd501e485-a306-4c9d-9baf-cc75f2321cfd', 'test_153', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 153, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(154, '57466d38-cae8-48bf-ac67-2cfc0266b5b0', 'test_154', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 154, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(155, '4bd5f059-f014-4356-8083-9c1a77adb6fd', 'test_155', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 155, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(156, '69130f52-f251-46fd-99ee-d646938e5f3f', 'test_156', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 156, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(157, 'dedfb4f0-a545-44b3-abba-dd77103db894', 'test_157', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 157, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(158, 'b5d98a8b-3780-4ace-ace1-ac12829dc469', 'test_158', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 158, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(159, '17de2f08-37fe-469d-b7b1-0e9ea9c6d2d8', 'test_159', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 159, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(160, '313abc40-4c88-45df-89e7-bd7bbf97b0fd', 'test_160', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 160, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(161, 'c5d7fc06-16fc-4711-be37-27bbf2c2c07c', 'test_161', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 161, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(162, 'ca31bf4d-f5da-4fc4-ae36-fd3cc0d35d7f', 'test_162', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 162, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(163, 'dc98bb8e-4b91-4915-86fb-476c9503a936', 'test_163', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 163, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(164, '79dd006c-0e4c-4a79-8600-ef8a0ae5bc04', 'test_164', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 164, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(165, '05cdc1f7-7787-43d6-80c6-588277fefb9b', 'test_165', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 165, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(166, 'dcdeb139-71ab-44f5-a709-ab33fec49882', 'test_166', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 166, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(167, '35a98804-b05e-47b0-917b-d72a4d4a5240', 'test_167', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 167, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(168, '5e4d4351-82c7-438d-8f83-ee2b7ebe1fe3', 'test_168', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 168, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(169, 'e1a205e2-f202-402d-8542-4cfc529ef514', 'test_169', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 169, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(170, 'a2e6271e-5b30-42d1-a211-494b98832676', 'test_170', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 170, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(171, '68515954-75ea-4022-9581-4cb4d28c6d6d', 'test_171', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 171, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(172, '41663b84-06b5-4787-a49e-1f745ca1eab3', 'test_172', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 172, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(173, 'b257f456-bdae-4c58-8519-756abbda462a', 'test_173', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 173, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(174, 'd848b9cb-05e4-4dcf-b9b7-431d83c41810', 'test_174', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 174, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(175, 'b6859250-dcca-47ef-b013-f609468d2389', 'test_175', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 175, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(176, 'e18bc682-897b-4696-a5ef-eee37a52a3de', 'test_176', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 176, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(177, '6b00471d-f496-4335-8209-5a9e13d18b9e', 'test_177', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 177, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(178, '35664644-7b32-4503-86f4-76adbb57762c', 'test_178', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 178, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(179, '7890415f-6563-4f25-bdf3-a5f45159a1b1', 'test_179', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 179, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(180, 'a1edf880-e270-4dac-b69f-73e61c517397', 'test_180', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 180, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(181, '73520029-5901-4022-b9da-38ccd73fe799', 'test_181', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 181, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(182, 'de5825a3-c585-45b3-88a1-7e5e80686826', 'test_182', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 182, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(183, 'bb50b80a-f471-4f64-85fb-4e5051708a4a', 'test_183', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 183, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(184, 'b7aa98b9-30da-468c-8566-06a5b804c4b9', 'test_184', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 184, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(185, 'c230e253-f874-4365-8b0e-7ba5ebc1cc26', 'test_185', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 185, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(186, '7593dbbf-9286-460b-a234-32b560817f60', 'test_186', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 186, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(187, 'ee1e2ce5-da23-4576-84e3-ad7cf4e0ce26', 'test_187', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 187, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(188, 'bf1cc1be-f405-4282-b7be-9a4578670046', 'test_188', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 188, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(189, 'e5ed670a-f944-40f0-8c10-d41c3350ead5', 'test_189', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 189, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(190, '8370db5c-e196-451a-9f5f-9b99c570cf46', 'test_190', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 190, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(191, '81498342-d247-4a60-80de-2c4cb4b1a84d', 'test_191', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 191, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(192, '213f1b3c-516e-4a6f-9785-d8c85d32f83e', 'test_192', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 192, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(193, '08ba27e6-b1b5-4d9e-a64a-6b5bc538bf43', 'test_193', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 193, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(194, 'cf0cfa8e-377c-44a0-a6d1-a74ce1de08fb', 'test_194', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 194, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(195, '2ea66412-8dc2-4081-8d48-e3637ca82604', 'test_195', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 195, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(196, '4ed466eb-ee51-4433-9d0f-3a56216698a2', 'test_196', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 196, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(197, 'cc03fc51-097d-43d6-bb6c-a0df72ec4838', 'test_197', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 197, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(198, '11844e66-8146-4263-aaa6-1fde7e5cfc58', 'test_198', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 198, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(199, 'b5a954c6-69a9-473c-a4c4-83c4f7a88c1c', 'test_199', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 199, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(200, '167e359e-7833-4ce2-9f8b-f035cee39505', 'test_200', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 200, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(201, '5afb5430-a023-4a50-aa92-b134a0fb68b3', 'test_201', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 201, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(202, 'de17b155-307c-4f9b-81f3-7f8b73d2526a', 'test_202', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 202, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(203, 'c966145b-ac05-4a2c-874d-f7b585d1d03b', 'test_203', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 203, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(204, '1d88ea5a-ab5f-40b1-bd48-f18f86eef5d9', 'test_204', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 204, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(205, '6cb0be93-7829-4bfc-ba4a-4d2cdff45447', 'test_205', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 205, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(206, 'e31a2ca7-fcaa-4b98-aac9-7e78f8605851', 'test_206', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 206, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(207, 'f26899b7-64e0-4c16-9134-cef3774f1614', 'test_207', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 207, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(208, '606cf6ab-6b5e-45d1-83b8-e535b197d2f0', 'test_208', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 208, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(209, '617bfc4e-17b1-4ca7-b736-58a74c267747', 'test_209', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 209, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(210, 'e5c26b7a-17bd-47ce-aac8-1430c57b8152', 'test_210', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 210, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(211, '7747bff5-b1e5-49b9-9a87-f93a5b790df0', 'test_211', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 211, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(212, 'c6e5b631-1e91-4ecd-8358-214eec07a91d', 'test_212', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 212, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(213, 'a874c7bd-97ac-4f48-bda5-7d3305d9067d', 'test_213', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 213, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(214, 'c7938cc2-8032-424b-8f49-85558f95364b', 'test_214', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 214, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(215, '46017ce9-d4dd-4ddc-8b73-d596e23d25ad', 'test_215', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 215, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(216, 'd5e66fd2-232e-476d-8de0-2bc1eb59630d', 'test_216', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 216, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(217, '097dc614-bc56-4f5f-a190-3ca1716a6400', 'test_217', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 217, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(218, 'a3b97132-067f-4839-9b99-830a7fb659d4', 'test_218', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 218, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(219, '8d35557f-7451-4c54-bb17-9c3d204c48d3', 'test_219', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 219, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(220, 'a6fba1ff-a5d7-4907-8cd4-1caa27cad85d', 'test_220', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 220, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(221, '427feb36-4401-4971-83de-f93672c028aa', 'test_221', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 221, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(222, '66541083-b1ab-4966-9f8b-8a1109fce0e0', 'test_222', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 222, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(223, '9939c37c-a9b9-43b7-9a4b-aacc470d47c4', 'test_223', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 223, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(224, '754379a0-bdc2-4a2d-9828-9480926b30ad', 'test_224', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 224, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(225, '18c870a1-9e2c-48fb-8a52-259e55e2052e', 'test_225', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 225, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(226, '02df9a97-b44c-4c46-ab3a-c11010d45e18', 'test_226', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 226, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(227, '20f609f7-c128-46b5-abeb-d16d46aab9ad', 'test_227', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 227, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(228, '75067ca5-872c-4149-85ad-f6685f14efc0', 'test_228', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 228, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(229, 'b8639303-d15f-4c81-b9d2-2863f53737c3', 'test_229', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 229, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(230, 'a0c4d9ea-7659-4009-ac7c-a3f089def76d', 'test_230', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 230, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(231, 'd3605113-fb9a-4640-b6fe-9931594eba6c', 'test_231', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 231, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(232, 'bf59d2cc-dd79-4ad6-9637-b04098768600', 'test_232', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 232, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(233, '304d5f24-274e-4fd6-aca4-97b761d1bd0c', 'test_233', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 233, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(234, '0d9491c3-c28b-4c11-8e28-14d93e612e35', 'test_234', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 234, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(235, 'f73a809f-78a6-4214-8060-d6037fe391aa', 'test_235', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 235, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(236, '11cc494a-86a4-44d2-b5fd-06438f95d6a4', 'test_236', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 236, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(237, '55b2e8cc-aaa4-4a8b-8a83-f732188cfab2', 'test_237', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 237, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(238, 'ebe14f0a-7bf7-4614-83c8-1e2da963139a', 'test_238', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 238, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(239, '3e83b092-95a1-4ee4-ac1f-e9df2f3954ad', 'test_239', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 239, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(240, '7304efcc-7974-453e-b2db-fdcc848f8a24', 'test_240', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 240, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(241, '6b0b51e8-f058-42a6-a9ed-3b6ebde935d8', 'test_241', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 241, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(242, 'c10f6de1-a64d-4f8f-bd0a-47bcd72ab8f7', 'test_242', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 242, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(243, '5537408c-41c6-4ee5-8f59-ca70fcdbd0ae', 'test_243', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 243, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(244, '0a920520-e271-42a6-8dc1-89f090023c89', 'test_244', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 244, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(245, 'a5120b27-cdd5-4209-b3da-bdf4b53db140', 'test_245', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 245, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(246, 'cd0f900a-dab8-4a49-805d-97e57cb5ad4c', 'test_246', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 246, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(247, '53b8b68c-0a11-411a-9b4d-01d58c9c0ff0', 'test_247', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 247, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(248, '57114ddf-7bb8-4e68-952a-faa83bf276bf', 'test_248', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 248, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(249, 'fa04c6fe-1bf0-489e-b0df-9fa4756bb90b', 'test_249', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 249, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(250, '5bf5b365-962e-4f6d-9576-94d5ac66cc3c', 'test_250', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 250, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(251, 'eca96575-798c-4919-ba93-4f0eca487490', 'test_251', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 251, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(252, 'd4e52ad1-ac1c-4f68-8d97-6858c8534f84', 'test_252', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 252, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(253, '74f88528-b57b-4482-a417-e7e8cf5ccd87', 'test_253', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 253, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(254, 'f1b969bd-2e43-4981-80d1-baeba6afd456', 'test_254', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 254, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(255, '11f5bcd3-096b-4b0f-8f1b-fa9292e3f5f3', 'test_255', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 255, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(256, 'b937e637-c00b-48de-8dd4-fae260cd9fb9', 'test_256', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 256, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(257, '49886ca5-c9a8-4c1f-9ef0-4784495e943c', 'test_257', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 257, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(258, '5cf6bbba-f2bf-4704-b288-36edb49a3c7a', 'test_258', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 258, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(259, '0a246675-78f2-47d3-a716-f9b85de0e885', 'test_259', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 259, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(260, 'b1e2509b-e9e4-40f8-b5c3-4e230e675ca8', 'test_260', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 260, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(261, 'c423ca4a-54b4-40f3-859d-d39f7d4cf266', 'test_261', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 261, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(262, '1452d005-8038-4092-ba0d-bd690dfdb2e2', 'test_262', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 262, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(263, 'f39a1721-6aeb-4f1e-90be-f54684ece8f0', 'test_263', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 263, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(264, 'ec2b02db-6eb2-4b9e-aa3b-ef53b6daf005', 'test_264', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 264, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(265, 'a6809581-e7b7-4d70-bfdd-c1f302322ee3', 'test_265', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 265, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(266, '794e2ba9-518d-4494-8ef0-01669807e10a', 'test_266', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 266, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(267, 'c258f48e-7f30-4c16-bd2d-6eed81529157', 'test_267', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 267, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(268, 'b7501b84-3a14-44d7-97da-271c416cbd16', 'test_268', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 268, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(269, '88b529d5-7804-4c4d-9f35-aa7dd1df0a37', 'test_269', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 269, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(270, '0c1b65d3-dee3-4429-864f-115fbbc6a2f4', 'test_270', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 270, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(271, '01667b0f-b397-47c1-8cdb-adb3ea7cba06', 'test_271', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 271, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(272, 'c8909fda-0453-4f74-a683-bd613fdc70c5', 'test_272', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 272, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(273, '796b8703-6f42-433f-b9e6-b115b4df25b0', 'test_273', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 273, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(274, 'de8f11f6-7298-4633-ad38-cc94e03314fd', 'test_274', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 274, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(275, 'e097f4e6-9c2d-4f35-912e-bd37f5cdec00', 'test_275', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 275, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(276, '3e0dab1e-c41f-4c0d-b2e3-d056ba6a3c60', 'test_276', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 276, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(277, 'b24cb998-40b7-471c-b55a-48b58b98b2e5', 'test_277', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 277, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(278, 'ab2113f4-56a2-4d1d-83a6-a54a763e371e', 'test_278', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 278, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(279, '2a2beb83-ccbf-413f-ade2-2fd2f79e5f49', 'test_279', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 279, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(280, 'ac53405d-8813-4cf7-ac12-fad7629d5602', 'test_280', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 280, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(281, 'b6c7b0e1-38b5-4e00-a22d-45c03d5fdeac', 'test_281', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 281, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(282, '8e41ff90-42f5-4736-89a6-24246917555c', 'test_282', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 282, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(283, '2b46023a-316f-41ae-955e-01185d67d7a5', 'test_283', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 283, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(284, '74c72c06-391e-4c72-92e7-92a5b75ac2da', 'test_284', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 284, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(285, '3e1246c2-96f9-4937-be0c-eb187822c3c7', 'test_285', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 285, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(286, '7f0e0193-b743-4394-b3e5-86e01813c094', 'test_286', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 286, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(287, '886cd06c-c30a-48df-b793-be4bfa2c1eb9', 'test_287', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 287, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(288, 'cb7cf6cd-bd2e-4956-be86-5d5935417098', 'test_288', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 288, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(289, 'd2e92f17-c26b-44dd-9c60-ca69b0f55b6d', 'test_289', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 289, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(290, 'ea3a53a1-b451-4d7b-9b9f-2b6790de314d', 'test_290', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 290, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(291, '723f2b0d-3473-445c-a6f2-9c8bb12b6019', 'test_291', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 291, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(292, '8f04e723-bb30-4952-a8f5-214845e525dc', 'test_292', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 292, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(293, '56e1991e-47e1-4136-9bd0-cd94fa40b3c8', 'test_293', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 293, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(294, 'b5ef5b82-483e-4331-ba84-78ece1f72602', 'test_294', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 294, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(295, '8238ae4e-5f13-42a3-9d6c-ea60f0ee64a1', 'test_295', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 295, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(296, '800a6a1d-1f63-4052-a14a-fcb56ab7e98b', 'test_296', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 296, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(297, '2eb884c0-8953-434d-898f-a162ffd44102', 'test_297', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 297, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(298, '06363941-bac6-4cc1-b56f-82d9d64d7c12', 'test_298', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 298, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(299, 'd8468131-79a2-4003-bf0a-e034a3455af9', 'test_299', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 299, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(300, 'e8e5f9d3-4473-46d9-b893-a195d5ccc6b4', 'test_300', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 300, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(301, '57db1144-49b7-4930-a214-9bba56c0eab6', 'test_301', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 301, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(302, '668a6ec5-142f-467d-891a-57fe10faf4bb', 'test_302', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 302, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(303, '9bcd9772-6c90-4c14-8ff4-16fa54744c87', 'test_303', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 303, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(304, '6c37ac4e-5213-4d60-8070-fadf3fa3ca38', 'test_304', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 304, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(305, 'fb5d7ea0-249f-4a0e-97aa-caa015d148e4', 'test_305', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 305, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(306, '26035205-595c-433a-8aba-4e0d6ce103a3', 'test_306', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 306, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(307, '1e4a6346-9da9-417c-bfbf-1a3cded61e12', 'test_307', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 307, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(308, '3af98cba-0cd4-4ea1-bcdc-c4c91672f038', 'test_308', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 308, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(309, 'a073f7ce-dfdc-424c-b4d0-bec7acaae445', 'test_309', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 309, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(310, '6524988e-5916-4410-a740-58d1e57d3f93', 'test_310', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 310, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(311, '58a190c4-789e-4c97-9fbb-245d3a58c8fe', 'test_311', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 311, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(312, '3244773f-b74b-461d-bf9a-916a05980c99', 'test_312', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 312, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(313, 'aaed5fa8-6555-43d2-adf4-c672008f8c92', 'test_313', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 313, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(314, 'f32415ac-f0fb-4815-bbef-27ba6115a1cc', 'test_314', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 314, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(315, '2030b697-b729-40c4-91b1-592e19fd4e73', 'test_315', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 315, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(316, 'ee47b98e-ebd5-44ae-8c9a-cbec609415b0', 'test_316', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 316, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(317, 'a47459c2-a709-4601-9151-cb57ae13bc8c', 'test_317', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 317, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(318, '5e274495-2c02-4f75-9ce2-c730e2686be9', 'test_318', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 318, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(319, 'f5f04ca8-f693-4758-9aa6-9a3c55938937', 'test_319', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 319, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(320, '5f876faf-2ad7-41f3-906d-2edd9fd2907d', 'test_320', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 320, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(321, '3d0665c6-db74-4d48-91cc-ebe39bbae605', 'test_321', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 321, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(322, '86c19bce-cb25-47a4-8aba-29c8ad4fc87d', 'test_322', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 322, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(323, 'efa06619-2301-4cb4-b9fa-6e9bddef94d7', 'test_323', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 323, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(324, '3cfc5976-aa7f-4281-8b43-6ea6eee1ac80', 'test_324', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 324, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(325, '19a56d56-1f57-45e6-9c2e-466a17d8c7ba', 'test_325', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 325, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(326, '026a45cf-cbeb-4ea9-8d20-21efbe206bad', 'test_326', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 326, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(327, '48312cae-f61d-4f87-9b20-a957d1e919ce', 'test_327', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 327, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(328, 'e06abc58-f451-4e9e-ac4f-51d5e9d424a6', 'test_328', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 328, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(329, '10b58273-4b30-4caf-954c-a1873ca4d6b5', 'test_329', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 329, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(330, '008892b7-6479-4e68-adf2-39e7ac29e66e', 'test_330', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 330, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(331, '7f864422-153c-4681-8c9e-4e942dce9548', 'test_331', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 331, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(332, '67c5538e-0363-4650-a42e-ba25746b4239', 'test_332', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 332, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(333, '208210c1-1601-47ae-883f-cdb16e0f802b', 'test_333', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 333, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(334, 'bb08395a-a0f0-490d-9d23-6f2f76b41514', 'test_334', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 334, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(335, '050c1a8e-256d-41ab-bd3a-3abe54d01b32', 'test_335', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 335, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(336, 'cf016005-9207-4a2d-a8fe-91c278029a18', 'test_336', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 336, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(337, '950a5d40-e604-4f6c-82dd-2b60a578d9aa', 'test_337', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 337, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(338, '3e00662d-6917-4759-b9a9-be8eda02f63b', 'test_338', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 338, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(339, 'bb339af3-2038-4f17-b489-46d4b7542cb6', 'test_339', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 339, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(340, '3927f6d5-5d90-4192-b84c-cebda90c0b0a', 'test_340', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 340, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(341, 'e6b29f71-bb4a-420b-8442-1f7639109465', 'test_341', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 341, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(342, 'ff7909b6-a90c-43c7-96fc-c375d439e373', 'test_342', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 342, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(343, '6f9902ca-7674-4f2f-b2e1-aeb3701bae14', 'test_343', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 343, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(344, '36d75eda-7573-474a-8aeb-f8555464154f', 'test_344', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 344, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(345, 'd3c489ae-3f03-48fe-9248-927a8bb3297f', 'test_345', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 345, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(346, '18764a4e-8b01-478e-80b3-217cc37d49c7', 'test_346', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 346, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null),
-(347, '00075d1c-f486-41a0-98f8-06f0354b8416', 'test_347', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 347, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null);
+INSERT INTO iam_account(id, uuid, username, password, user_info_id, creationtime, lastupdatetime, active, totp_mfa_id) VALUES
+(100, 'f2ce8cb2-a1db-4884-9ef0-d8842cc02b4a', 'test_100', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 100, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(101, '1a78b3b8-22d2-4746-9269-df55aceb036f', 'test_101', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 101, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(102, 'a07d60c6-7ffa-475f-98e4-f9f648aa278b', 'test_102', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 102, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(103, '56e1b885-ea25-4ffc-ba17-fcde2b097d02', 'test_103', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 103, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(104, '67d2794d-c7fb-406e-9bc1-b66f43cbe60f', 'test_104', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 104, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(105, 'd11e04f7-f369-4de6-9375-394f7d886ac7', 'test_105', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 105, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(106, 'bbc76b76-9f9e-443b-8c63-cd775c50c6f3', 'test_106', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 106, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(107, 'b15c850c-e6e0-4afb-a02d-374653bb102e', 'test_107', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 107, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(108, 'afada6e8-d50d-47f6-912e-d6261605c771', 'test_108', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 108, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(109, 'fa3b4c97-4787-4b49-a32c-5b4c74d5a7c8', 'test_109', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 109, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(110, '33165df6-4d49-4728-883c-3fd42720d46b', 'test_110', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 110, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(111, '15fb8d3a-003d-4ef9-8349-867d81d4ae9c', 'test_111', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 111, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(112, '7a4dda33-c2e5-4304-998a-3fa4df481123', 'test_112', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 112, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(113, '7013f989-0a95-43b5-8637-2e2360a73bb3', 'test_113', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 113, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(114, '12caabc8-4766-4028-98ff-f4d7f288a5f0', 'test_114', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 114, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(115, 'f463ad2b-5814-4877-bb62-f954c67a8044', 'test_115', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 115, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(116, '28c656c4-5489-4654-a257-0806c6bab905', 'test_116', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 116, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(117, '11be5a72-9416-45fc-a0a7-f3e23c54bfda', 'test_117', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 117, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(118, '3cea2c01-786e-41a3-8fdf-4229cc4e3742', 'test_118', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 118, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(119, 'e0247677-4542-4df3-8d75-8efa11e70911', 'test_119', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 119, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(120, 'd905a115-d726-4e11-ba1f-b8482177bb05', 'test_120', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 120, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(121, '3479afd1-584c-4479-b6e2-25f6cef2f842', 'test_121', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 121, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(122, '8d4f467d-cb68-4feb-b898-71e4487e6820', 'test_122', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 122, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(123, '0ddee1c2-1426-4b83-b520-e20bdd8ef9b3', 'test_123', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 123, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(124, 'b8b638be-6e09-4dbe-bcc0-776c2403e8c7', 'test_124', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 124, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(125, '1dc3108a-b5c0-4e5b-accd-925054075bc4', 'test_125', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 125, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(126, '5eed3374-c131-4513-84b7-dd0ff965da35', 'test_126', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 126, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(127, '2d0b4c36-0301-49f6-a20b-23b6ca48cee2', 'test_127', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 127, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(128, 'db46065a-ba62-423d-9397-7bc6fab371a5', 'test_128', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 128, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(129, 'd9dbaabf-c51a-45e5-aee1-25134ba283ac', 'test_129', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 129, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(130, '5678f40a-f361-464c-aa71-ffb48d163aaa', 'test_130', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 130, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(131, '209ae3b9-e266-4e57-a639-db29f61a7594', 'test_131', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 131, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(132, 'f3fac505-d5c9-4d9c-83af-3976f357f19c', 'test_132', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 132, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(133, '13bfd34b-1dda-452e-bd9a-284aabccf07d', 'test_133', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 133, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(134, '15ccd152-1537-48d4-a55a-fd6565e5d86f', 'test_134', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 134, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(135, '6b2f4fc1-3e98-4f64-8fb4-517d2d4b3fa3', 'test_135', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 135, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(136, '398081ee-9c3c-4e5d-802c-90a4579030d4', 'test_136', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 136, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(137, '89a32317-dd45-481d-91a4-080e30c1f29e', 'test_137', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 137, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(138, '6dc0aa56-011d-45b8-bf26-cb03e8b40ccf', 'test_138', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 138, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(139, 'cd62277e-5acf-41af-acea-b4d208cba29e', 'test_139', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 139, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(140, '0ae29eac-64ee-45b4-a2e7-e58b34c7ff0e', 'test_140', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 140, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(141, '0f7fe907-fa84-429e-8057-02d809375ba3', 'test_141', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 141, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(142, '7aa4a733-d318-4392-b3d3-6618263f667d', 'test_142', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 142, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(143, 'b1d9b1ac-e77c-4d55-a895-cf0788ed2174', 'test_143', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 143, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(144, 'f975f1f7-ad05-4d66-9905-d44c13cbd08b', 'test_144', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 144, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(145, '857f6e6d-e415-4850-a82b-59d557864910', 'test_145', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 145, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(146, '4e1c059c-1d06-4997-8bfa-5bd09fdb4571', 'test_146', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 146, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(147, 'f4a0bc7f-b279-4caf-b8d1-c86a3c106f62', 'test_147', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 147, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(148, '007bbb9d-55b1-4f5e-80a5-bbcb22073db4', 'test_148', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 148, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(149, 'a1d22bbf-9afe-49da-b75d-b58f825db351', 'test_149', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 149, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(150, '8c2351d5-5460-4b2d-b1bb-7b086130090e', 'test_150', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 150, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(151, 'e6651896-66f8-4f63-b44f-71710fdb947c', 'test_151', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 151, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(152, 'caf04a3c-8f35-40a3-99b6-48ba6a05d8b8', 'test_152', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 152, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(153, 'd501e485-a306-4c9d-9baf-cc75f2321cfd', 'test_153', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 153, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(154, '57466d38-cae8-48bf-ac67-2cfc0266b5b0', 'test_154', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 154, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(155, '4bd5f059-f014-4356-8083-9c1a77adb6fd', 'test_155', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 155, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(156, '69130f52-f251-46fd-99ee-d646938e5f3f', 'test_156', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 156, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(157, 'dedfb4f0-a545-44b3-abba-dd77103db894', 'test_157', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 157, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(158, 'b5d98a8b-3780-4ace-ace1-ac12829dc469', 'test_158', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 158, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(159, '17de2f08-37fe-469d-b7b1-0e9ea9c6d2d8', 'test_159', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 159, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(160, '313abc40-4c88-45df-89e7-bd7bbf97b0fd', 'test_160', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 160, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(161, 'c5d7fc06-16fc-4711-be37-27bbf2c2c07c', 'test_161', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 161, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(162, 'ca31bf4d-f5da-4fc4-ae36-fd3cc0d35d7f', 'test_162', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 162, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(163, 'dc98bb8e-4b91-4915-86fb-476c9503a936', 'test_163', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 163, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(164, '79dd006c-0e4c-4a79-8600-ef8a0ae5bc04', 'test_164', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 164, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(165, '05cdc1f7-7787-43d6-80c6-588277fefb9b', 'test_165', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 165, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(166, 'dcdeb139-71ab-44f5-a709-ab33fec49882', 'test_166', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 166, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(167, '35a98804-b05e-47b0-917b-d72a4d4a5240', 'test_167', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 167, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(168, '5e4d4351-82c7-438d-8f83-ee2b7ebe1fe3', 'test_168', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 168, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(169, 'e1a205e2-f202-402d-8542-4cfc529ef514', 'test_169', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 169, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(170, 'a2e6271e-5b30-42d1-a211-494b98832676', 'test_170', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 170, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(171, '68515954-75ea-4022-9581-4cb4d28c6d6d', 'test_171', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 171, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(172, '41663b84-06b5-4787-a49e-1f745ca1eab3', 'test_172', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 172, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(173, 'b257f456-bdae-4c58-8519-756abbda462a', 'test_173', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 173, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(174, 'd848b9cb-05e4-4dcf-b9b7-431d83c41810', 'test_174', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 174, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(175, 'b6859250-dcca-47ef-b013-f609468d2389', 'test_175', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 175, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(176, 'e18bc682-897b-4696-a5ef-eee37a52a3de', 'test_176', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 176, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(177, '6b00471d-f496-4335-8209-5a9e13d18b9e', 'test_177', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 177, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(178, '35664644-7b32-4503-86f4-76adbb57762c', 'test_178', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 178, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(179, '7890415f-6563-4f25-bdf3-a5f45159a1b1', 'test_179', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 179, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(180, 'a1edf880-e270-4dac-b69f-73e61c517397', 'test_180', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 180, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(181, '73520029-5901-4022-b9da-38ccd73fe799', 'test_181', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 181, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(182, 'de5825a3-c585-45b3-88a1-7e5e80686826', 'test_182', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 182, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(183, 'bb50b80a-f471-4f64-85fb-4e5051708a4a', 'test_183', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 183, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(184, 'b7aa98b9-30da-468c-8566-06a5b804c4b9', 'test_184', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 184, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(185, 'c230e253-f874-4365-8b0e-7ba5ebc1cc26', 'test_185', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 185, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(186, '7593dbbf-9286-460b-a234-32b560817f60', 'test_186', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 186, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(187, 'ee1e2ce5-da23-4576-84e3-ad7cf4e0ce26', 'test_187', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 187, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(188, 'bf1cc1be-f405-4282-b7be-9a4578670046', 'test_188', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 188, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(189, 'e5ed670a-f944-40f0-8c10-d41c3350ead5', 'test_189', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 189, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(190, '8370db5c-e196-451a-9f5f-9b99c570cf46', 'test_190', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 190, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(191, '81498342-d247-4a60-80de-2c4cb4b1a84d', 'test_191', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 191, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(192, '213f1b3c-516e-4a6f-9785-d8c85d32f83e', 'test_192', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 192, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(193, '08ba27e6-b1b5-4d9e-a64a-6b5bc538bf43', 'test_193', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 193, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(194, 'cf0cfa8e-377c-44a0-a6d1-a74ce1de08fb', 'test_194', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 194, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(195, '2ea66412-8dc2-4081-8d48-e3637ca82604', 'test_195', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 195, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(196, '4ed466eb-ee51-4433-9d0f-3a56216698a2', 'test_196', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 196, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(197, 'cc03fc51-097d-43d6-bb6c-a0df72ec4838', 'test_197', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 197, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(198, '11844e66-8146-4263-aaa6-1fde7e5cfc58', 'test_198', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 198, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(199, 'b5a954c6-69a9-473c-a4c4-83c4f7a88c1c', 'test_199', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 199, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(200, '167e359e-7833-4ce2-9f8b-f035cee39505', 'test_200', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 200, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(201, '5afb5430-a023-4a50-aa92-b134a0fb68b3', 'test_201', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 201, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(202, 'de17b155-307c-4f9b-81f3-7f8b73d2526a', 'test_202', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 202, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(203, 'c966145b-ac05-4a2c-874d-f7b585d1d03b', 'test_203', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 203, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(204, '1d88ea5a-ab5f-40b1-bd48-f18f86eef5d9', 'test_204', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 204, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(205, '6cb0be93-7829-4bfc-ba4a-4d2cdff45447', 'test_205', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 205, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(206, 'e31a2ca7-fcaa-4b98-aac9-7e78f8605851', 'test_206', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 206, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(207, 'f26899b7-64e0-4c16-9134-cef3774f1614', 'test_207', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 207, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(208, '606cf6ab-6b5e-45d1-83b8-e535b197d2f0', 'test_208', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 208, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(209, '617bfc4e-17b1-4ca7-b736-58a74c267747', 'test_209', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 209, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(210, 'e5c26b7a-17bd-47ce-aac8-1430c57b8152', 'test_210', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 210, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(211, '7747bff5-b1e5-49b9-9a87-f93a5b790df0', 'test_211', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 211, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(212, 'c6e5b631-1e91-4ecd-8358-214eec07a91d', 'test_212', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 212, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(213, 'a874c7bd-97ac-4f48-bda5-7d3305d9067d', 'test_213', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 213, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(214, 'c7938cc2-8032-424b-8f49-85558f95364b', 'test_214', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 214, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(215, '46017ce9-d4dd-4ddc-8b73-d596e23d25ad', 'test_215', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 215, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(216, 'd5e66fd2-232e-476d-8de0-2bc1eb59630d', 'test_216', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 216, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(217, '097dc614-bc56-4f5f-a190-3ca1716a6400', 'test_217', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 217, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(218, 'a3b97132-067f-4839-9b99-830a7fb659d4', 'test_218', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 218, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(219, '8d35557f-7451-4c54-bb17-9c3d204c48d3', 'test_219', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 219, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(220, 'a6fba1ff-a5d7-4907-8cd4-1caa27cad85d', 'test_220', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 220, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(221, '427feb36-4401-4971-83de-f93672c028aa', 'test_221', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 221, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(222, '66541083-b1ab-4966-9f8b-8a1109fce0e0', 'test_222', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 222, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(223, '9939c37c-a9b9-43b7-9a4b-aacc470d47c4', 'test_223', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 223, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(224, '754379a0-bdc2-4a2d-9828-9480926b30ad', 'test_224', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 224, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(225, '18c870a1-9e2c-48fb-8a52-259e55e2052e', 'test_225', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 225, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(226, '02df9a97-b44c-4c46-ab3a-c11010d45e18', 'test_226', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 226, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(227, '20f609f7-c128-46b5-abeb-d16d46aab9ad', 'test_227', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 227, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(228, '75067ca5-872c-4149-85ad-f6685f14efc0', 'test_228', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 228, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(229, 'b8639303-d15f-4c81-b9d2-2863f53737c3', 'test_229', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 229, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(230, 'a0c4d9ea-7659-4009-ac7c-a3f089def76d', 'test_230', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 230, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(231, 'd3605113-fb9a-4640-b6fe-9931594eba6c', 'test_231', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 231, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(232, 'bf59d2cc-dd79-4ad6-9637-b04098768600', 'test_232', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 232, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(233, '304d5f24-274e-4fd6-aca4-97b761d1bd0c', 'test_233', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 233, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(234, '0d9491c3-c28b-4c11-8e28-14d93e612e35', 'test_234', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 234, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(235, 'f73a809f-78a6-4214-8060-d6037fe391aa', 'test_235', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 235, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(236, '11cc494a-86a4-44d2-b5fd-06438f95d6a4', 'test_236', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 236, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(237, '55b2e8cc-aaa4-4a8b-8a83-f732188cfab2', 'test_237', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 237, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(238, 'ebe14f0a-7bf7-4614-83c8-1e2da963139a', 'test_238', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 238, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(239, '3e83b092-95a1-4ee4-ac1f-e9df2f3954ad', 'test_239', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 239, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(240, '7304efcc-7974-453e-b2db-fdcc848f8a24', 'test_240', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 240, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(241, '6b0b51e8-f058-42a6-a9ed-3b6ebde935d8', 'test_241', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 241, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(242, 'c10f6de1-a64d-4f8f-bd0a-47bcd72ab8f7', 'test_242', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 242, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(243, '5537408c-41c6-4ee5-8f59-ca70fcdbd0ae', 'test_243', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 243, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(244, '0a920520-e271-42a6-8dc1-89f090023c89', 'test_244', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 244, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(245, 'a5120b27-cdd5-4209-b3da-bdf4b53db140', 'test_245', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 245, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(246, 'cd0f900a-dab8-4a49-805d-97e57cb5ad4c', 'test_246', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 246, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(247, '53b8b68c-0a11-411a-9b4d-01d58c9c0ff0', 'test_247', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 247, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(248, '57114ddf-7bb8-4e68-952a-faa83bf276bf', 'test_248', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 248, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(249, 'fa04c6fe-1bf0-489e-b0df-9fa4756bb90b', 'test_249', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 249, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(250, '5bf5b365-962e-4f6d-9576-94d5ac66cc3c', 'test_250', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 250, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(251, 'eca96575-798c-4919-ba93-4f0eca487490', 'test_251', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 251, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(252, 'd4e52ad1-ac1c-4f68-8d97-6858c8534f84', 'test_252', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 252, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(253, '74f88528-b57b-4482-a417-e7e8cf5ccd87', 'test_253', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 253, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(254, 'f1b969bd-2e43-4981-80d1-baeba6afd456', 'test_254', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 254, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(255, '11f5bcd3-096b-4b0f-8f1b-fa9292e3f5f3', 'test_255', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 255, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(256, 'b937e637-c00b-48de-8dd4-fae260cd9fb9', 'test_256', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 256, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(257, '49886ca5-c9a8-4c1f-9ef0-4784495e943c', 'test_257', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 257, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(258, '5cf6bbba-f2bf-4704-b288-36edb49a3c7a', 'test_258', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 258, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(259, '0a246675-78f2-47d3-a716-f9b85de0e885', 'test_259', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 259, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(260, 'b1e2509b-e9e4-40f8-b5c3-4e230e675ca8', 'test_260', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 260, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(261, 'c423ca4a-54b4-40f3-859d-d39f7d4cf266', 'test_261', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 261, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(262, '1452d005-8038-4092-ba0d-bd690dfdb2e2', 'test_262', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 262, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(263, 'f39a1721-6aeb-4f1e-90be-f54684ece8f0', 'test_263', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 263, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(264, 'ec2b02db-6eb2-4b9e-aa3b-ef53b6daf005', 'test_264', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 264, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(265, 'a6809581-e7b7-4d70-bfdd-c1f302322ee3', 'test_265', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 265, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(266, '794e2ba9-518d-4494-8ef0-01669807e10a', 'test_266', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 266, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(267, 'c258f48e-7f30-4c16-bd2d-6eed81529157', 'test_267', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 267, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(268, 'b7501b84-3a14-44d7-97da-271c416cbd16', 'test_268', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 268, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(269, '88b529d5-7804-4c4d-9f35-aa7dd1df0a37', 'test_269', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 269, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(270, '0c1b65d3-dee3-4429-864f-115fbbc6a2f4', 'test_270', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 270, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(271, '01667b0f-b397-47c1-8cdb-adb3ea7cba06', 'test_271', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 271, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(272, 'c8909fda-0453-4f74-a683-bd613fdc70c5', 'test_272', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 272, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(273, '796b8703-6f42-433f-b9e6-b115b4df25b0', 'test_273', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 273, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(274, 'de8f11f6-7298-4633-ad38-cc94e03314fd', 'test_274', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 274, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(275, 'e097f4e6-9c2d-4f35-912e-bd37f5cdec00', 'test_275', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 275, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(276, '3e0dab1e-c41f-4c0d-b2e3-d056ba6a3c60', 'test_276', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 276, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(277, 'b24cb998-40b7-471c-b55a-48b58b98b2e5', 'test_277', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 277, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(278, 'ab2113f4-56a2-4d1d-83a6-a54a763e371e', 'test_278', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 278, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(279, '2a2beb83-ccbf-413f-ade2-2fd2f79e5f49', 'test_279', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 279, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(280, 'ac53405d-8813-4cf7-ac12-fad7629d5602', 'test_280', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 280, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(281, 'b6c7b0e1-38b5-4e00-a22d-45c03d5fdeac', 'test_281', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 281, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(282, '8e41ff90-42f5-4736-89a6-24246917555c', 'test_282', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 282, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(283, '2b46023a-316f-41ae-955e-01185d67d7a5', 'test_283', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 283, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(284, '74c72c06-391e-4c72-92e7-92a5b75ac2da', 'test_284', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 284, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(285, '3e1246c2-96f9-4937-be0c-eb187822c3c7', 'test_285', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 285, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(286, '7f0e0193-b743-4394-b3e5-86e01813c094', 'test_286', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 286, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(287, '886cd06c-c30a-48df-b793-be4bfa2c1eb9', 'test_287', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 287, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(288, 'cb7cf6cd-bd2e-4956-be86-5d5935417098', 'test_288', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 288, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(289, 'd2e92f17-c26b-44dd-9c60-ca69b0f55b6d', 'test_289', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 289, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(290, 'ea3a53a1-b451-4d7b-9b9f-2b6790de314d', 'test_290', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 290, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(291, '723f2b0d-3473-445c-a6f2-9c8bb12b6019', 'test_291', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 291, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(292, '8f04e723-bb30-4952-a8f5-214845e525dc', 'test_292', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 292, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(293, '56e1991e-47e1-4136-9bd0-cd94fa40b3c8', 'test_293', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 293, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(294, 'b5ef5b82-483e-4331-ba84-78ece1f72602', 'test_294', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 294, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(295, '8238ae4e-5f13-42a3-9d6c-ea60f0ee64a1', 'test_295', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 295, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(296, '800a6a1d-1f63-4052-a14a-fcb56ab7e98b', 'test_296', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 296, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(297, '2eb884c0-8953-434d-898f-a162ffd44102', 'test_297', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 297, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(298, '06363941-bac6-4cc1-b56f-82d9d64d7c12', 'test_298', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 298, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(299, 'd8468131-79a2-4003-bf0a-e034a3455af9', 'test_299', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 299, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(300, 'e8e5f9d3-4473-46d9-b893-a195d5ccc6b4', 'test_300', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 300, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(301, '57db1144-49b7-4930-a214-9bba56c0eab6', 'test_301', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 301, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(302, '668a6ec5-142f-467d-891a-57fe10faf4bb', 'test_302', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 302, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(303, '9bcd9772-6c90-4c14-8ff4-16fa54744c87', 'test_303', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 303, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(304, '6c37ac4e-5213-4d60-8070-fadf3fa3ca38', 'test_304', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 304, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(305, 'fb5d7ea0-249f-4a0e-97aa-caa015d148e4', 'test_305', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 305, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(306, '26035205-595c-433a-8aba-4e0d6ce103a3', 'test_306', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 306, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(307, '1e4a6346-9da9-417c-bfbf-1a3cded61e12', 'test_307', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 307, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(308, '3af98cba-0cd4-4ea1-bcdc-c4c91672f038', 'test_308', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 308, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(309, 'a073f7ce-dfdc-424c-b4d0-bec7acaae445', 'test_309', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 309, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(310, '6524988e-5916-4410-a740-58d1e57d3f93', 'test_310', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 310, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(311, '58a190c4-789e-4c97-9fbb-245d3a58c8fe', 'test_311', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 311, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(312, '3244773f-b74b-461d-bf9a-916a05980c99', 'test_312', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 312, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(313, 'aaed5fa8-6555-43d2-adf4-c672008f8c92', 'test_313', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 313, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(314, 'f32415ac-f0fb-4815-bbef-27ba6115a1cc', 'test_314', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 314, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(315, '2030b697-b729-40c4-91b1-592e19fd4e73', 'test_315', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 315, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(316, 'ee47b98e-ebd5-44ae-8c9a-cbec609415b0', 'test_316', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 316, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(317, 'a47459c2-a709-4601-9151-cb57ae13bc8c', 'test_317', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 317, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(318, '5e274495-2c02-4f75-9ce2-c730e2686be9', 'test_318', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 318, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(319, 'f5f04ca8-f693-4758-9aa6-9a3c55938937', 'test_319', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 319, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(320, '5f876faf-2ad7-41f3-906d-2edd9fd2907d', 'test_320', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 320, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(321, '3d0665c6-db74-4d48-91cc-ebe39bbae605', 'test_321', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 321, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(322, '86c19bce-cb25-47a4-8aba-29c8ad4fc87d', 'test_322', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 322, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(323, 'efa06619-2301-4cb4-b9fa-6e9bddef94d7', 'test_323', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 323, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(324, '3cfc5976-aa7f-4281-8b43-6ea6eee1ac80', 'test_324', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 324, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(325, '19a56d56-1f57-45e6-9c2e-466a17d8c7ba', 'test_325', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 325, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(326, '026a45cf-cbeb-4ea9-8d20-21efbe206bad', 'test_326', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 326, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(327, '48312cae-f61d-4f87-9b20-a957d1e919ce', 'test_327', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 327, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(328, 'e06abc58-f451-4e9e-ac4f-51d5e9d424a6', 'test_328', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 328, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(329, '10b58273-4b30-4caf-954c-a1873ca4d6b5', 'test_329', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 329, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(330, '008892b7-6479-4e68-adf2-39e7ac29e66e', 'test_330', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 330, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(331, '7f864422-153c-4681-8c9e-4e942dce9548', 'test_331', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 331, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(332, '67c5538e-0363-4650-a42e-ba25746b4239', 'test_332', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 332, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(333, '208210c1-1601-47ae-883f-cdb16e0f802b', 'test_333', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 333, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(334, 'bb08395a-a0f0-490d-9d23-6f2f76b41514', 'test_334', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 334, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(335, '050c1a8e-256d-41ab-bd3a-3abe54d01b32', 'test_335', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 335, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(336, 'cf016005-9207-4a2d-a8fe-91c278029a18', 'test_336', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 336, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(337, '950a5d40-e604-4f6c-82dd-2b60a578d9aa', 'test_337', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 337, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(338, '3e00662d-6917-4759-b9a9-be8eda02f63b', 'test_338', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 338, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(339, 'bb339af3-2038-4f17-b489-46d4b7542cb6', 'test_339', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 339, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(340, '3927f6d5-5d90-4192-b84c-cebda90c0b0a', 'test_340', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 340, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(341, 'e6b29f71-bb4a-420b-8442-1f7639109465', 'test_341', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 341, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(342, 'ff7909b6-a90c-43c7-96fc-c375d439e373', 'test_342', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 342, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(343, '6f9902ca-7674-4f2f-b2e1-aeb3701bae14', 'test_343', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 343, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(344, '36d75eda-7573-474a-8aeb-f8555464154f', 'test_344', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 344, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(345, 'd3c489ae-3f03-48fe-9248-927a8bb3297f', 'test_345', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 345, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(346, '18764a4e-8b01-478e-80b3-217cc37d49c7', 'test_346', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 346, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
+(347, '00075d1c-f486-41a0-98f8-06f0354b8416', 'test_347', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 347, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null);
 
 INSERT into iam_account_authority(account_id, authority_id) VALUES
 (100,2),
diff --git a/iam-persistence/src/main/resources/db/migration/test/V3_1___duplicate_email_user.sql b/iam-persistence/src/main/resources/db/migration/test/V3_1___duplicate_email_user.sql
index 21bd1a023..b7535d982 100644
--- a/iam-persistence/src/main/resources/db/migration/test/V3_1___duplicate_email_user.sql
+++ b/iam-persistence/src/main/resources/db/migration/test/V3_1___duplicate_email_user.sql
@@ -1,20 +1,20 @@
 INSERT INTO iam_user_info(ID,GIVENNAME,FAMILYNAME, EMAIL, EMAILVERIFIED, BIRTHDATE, GENDER) VALUES
 (3, 'Duplicate', 'Email 0', 'admin@iam.test', true, '1950-01-01', 'M');
 
-INSERT INTO iam_account(id, uuid, username, password, user_info_id, creationtime, lastupdatetime, active, mfa_enabled, totp_mfa_id) VALUES
+INSERT INTO iam_account(id, uuid, username, password, user_info_id, creationtime, lastupdatetime, active, totp_mfa_id) VALUES
 (3, 'bffc67b7-47fe-410c-a6a0-cf00173a8fbb', 'dup_email_0', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 
-3, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null);
+3, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null);
 
 INSERT INTO iam_user_info(ID,GIVENNAME,FAMILYNAME, EMAIL, EMAILVERIFIED, BIRTHDATE, GENDER) VALUES
 (4, 'Duplicate ', 'Email 1', 'duplicate@iam.test', true, '1950-01-01', 'M');
 
-INSERT INTO iam_account(id, uuid, username, password, user_info_id, creationtime, lastupdatetime, active, mfa_enabled, totp_mfa_id) VALUES
+INSERT INTO iam_account(id, uuid, username, password, user_info_id, creationtime, lastupdatetime, active, totp_mfa_id) VALUES
 (4, '0a6fa72a-fb75-4a6c-9734-bfe673df70b3', 'dup_email_1', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 
-4, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null);
+4, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null);
 
 INSERT INTO iam_user_info(ID,GIVENNAME,FAMILYNAME, EMAIL, EMAILVERIFIED, BIRTHDATE, GENDER) VALUES
 (5, 'Duplicate ', 'Email 2', 'duplicate@iam.test', true, '1950-01-01', 'M');
 
-INSERT INTO iam_account(id, uuid, username, password, user_info_id, creationtime, lastupdatetime, active, mfa_enabled, totp_mfa_id) VALUES
+INSERT INTO iam_account(id, uuid, username, password, user_info_id, creationtime, lastupdatetime, active, totp_mfa_id) VALUES
 (5, 'd836e5ec-246c-456c-8476-923ee2f831c8', 'dup_email_2', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 
-5, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null);
\ No newline at end of file
+5, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null);
\ No newline at end of file
diff --git a/iam-persistence/src/main/resources/db/migration/test/V3__basic_configuration.sql b/iam-persistence/src/main/resources/db/migration/test/V3__basic_configuration.sql
index ac7d9650b..b06d0ff05 100644
--- a/iam-persistence/src/main/resources/db/migration/test/V3__basic_configuration.sql
+++ b/iam-persistence/src/main/resources/db/migration/test/V3__basic_configuration.sql
@@ -7,8 +7,8 @@ INSERT INTO iam_authority(ID, AUTH) VALUES
 INSERT INTO iam_user_info(ID,GIVENNAME,FAMILYNAME, EMAIL, EMAILVERIFIED, BIRTHDATE, PICTURE, GENDER) VALUES
 (1, 'Admin', 'User', 'admin@iam.test', true, '1950-01-01', null, 'M');
 
-INSERT INTO iam_account(id, uuid, username, password, user_info_id, creationtime, lastupdatetime, active, mfa_enabled, totp_mfa_id) VALUES
-(1, '73f16d93-2441-4a50-88ff-85360d78c6b5', 'admin', 'password', 1, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, false, null);
+INSERT INTO iam_account(id, uuid, username, password, user_info_id, creationtime, lastupdatetime, active, totp_mfa_id) VALUES
+(1, '73f16d93-2441-4a50-88ff-85360d78c6b5', 'admin', 'password', 1, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null);
 
 INSERT INTO iam_oidc_id(issuer, subject, account_id) VALUES
 ('https://accounts.google.com', '114132403455520317223', 1);
diff --git a/pom.xml b/pom.xml
index c25bab862..a5d276baa 100644
--- a/pom.xml
+++ b/pom.xml
@@ -210,13 +210,6 @@
         ${jaxb-runtime.version}
       
 
-      
-      
-        dev.samstevens.totp
-        totp
-        1.7.1
-		  
-
     
 
   

From ae8b88779e7d8de1d0da3d664bda938eb667c9fe Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Thu, 25 Nov 2021 12:34:26 +0000
Subject: [PATCH 23/76] Removing non-existent files

These were old event classes that are no longer used/have been replaced
---
 .../AuthenticatorAppDisabledEvent.java           | 16 ----------------
 .../AuthenticatorAppEnabledEvent.java            | 16 ----------------
 2 files changed, 32 deletions(-)
 delete mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/authenticator_app/AuthenticatorAppDisabledEvent.java
 delete mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/authenticator_app/AuthenticatorAppEnabledEvent.java

diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/authenticator_app/AuthenticatorAppDisabledEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/authenticator_app/AuthenticatorAppDisabledEvent.java
deleted file mode 100644
index 6ac77340c..000000000
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/authenticator_app/AuthenticatorAppDisabledEvent.java
+++ /dev/null
@@ -1,16 +0,0 @@
-package it.infn.mw.iam.audit.events.account.multi_factor_authentication.authenticator_app;
-
-import it.infn.mw.iam.audit.events.account.AccountEvent;
-import it.infn.mw.iam.persistence.model.IamAccount;
-
-public class AuthenticatorAppDisabledEvent extends AccountEvent {
-
-  public static final String TEMPLATE = "Account '%s' has disabled MFA through authenticator app";
-
-  // TODO add this in
-  // private static final long serialVersionUID = 3213253939764135733L;
-
-  public AuthenticatorAppDisabledEvent(Object source, IamAccount account) {
-    super(source, account, String.format(TEMPLATE, account.getUsername()));
-  }
-}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/authenticator_app/AuthenticatorAppEnabledEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/authenticator_app/AuthenticatorAppEnabledEvent.java
deleted file mode 100644
index 83841ff19..000000000
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/authenticator_app/AuthenticatorAppEnabledEvent.java
+++ /dev/null
@@ -1,16 +0,0 @@
-package it.infn.mw.iam.audit.events.account.multi_factor_authentication.authenticator_app;
-
-import it.infn.mw.iam.audit.events.account.AccountEvent;
-import it.infn.mw.iam.persistence.model.IamAccount;
-
-public class AuthenticatorAppEnabledEvent extends AccountEvent {
-
-  public static final String TEMPLATE = "Account '%s' has enabled MFA through authenticator app";
-
-  // TODO add this in
-  // private static final long serialVersionUID = 3213253939764135733L;
-
-  public AuthenticatorAppEnabledEvent(Object source, IamAccount account) {
-    super(source, account, String.format(TEMPLATE, account.getUsername()));
-  }
-}

From 1be4737d4b4d46aeb1256384965dfaed41aa57ae Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Thu, 25 Nov 2021 17:43:44 +0000
Subject: [PATCH 24/76] MFA secret and QR code now display on authenticator app
 enabling modal

Still work to be done on autowiring QR generator instead of creating a new object each time
---
 .gitignore                                    |  1 +
 .../AuthenticatorAppController.java           | 81 +++++++++++++++++--
 .../SecretAndDataUriDTO.java                  | 46 +++++++++++
 ...ava => AuthenticatorAppDisabledEvent.java} |  6 +-
 ...java => AuthenticatorAppEnabledEvent.java} |  6 +-
 .../core/user/DefaultIamAccountService.java   | 41 +++++++---
 .../mw/iam/core/user/IamAccountService.java   | 12 ++-
 .../authenticator-app.controller.js           | 55 +++++++++++--
 .../controllers/user-mfa.controller.js        |  4 +-
 .../services/authenticator-app.service.js     |  5 ++
 .../home/enable-authenticator-app.html        |  4 +-
 .../mw/iam/persistence/model/IamAccount.java  |  2 +-
 12 files changed, 226 insertions(+), 37 deletions(-)
 create mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/SecretAndDataUriDTO.java
 rename iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/{MultiFactorSecretRemovedEvent.java => AuthenticatorAppDisabledEvent.java} (59%)
 rename iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/{MultiFactorSecretAddedEvent.java => AuthenticatorAppEnabledEvent.java} (56%)

diff --git a/.gitignore b/.gitignore
index fb603052d..48dd7b0fe 100644
--- a/.gitignore
+++ b/.gitignore
@@ -30,3 +30,4 @@ travis/travis-mitre-build.out
 *.iml
 .idea
 iam-test-client/.factorypath
+iam-voms-aa/.factorypath
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppController.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppController.java
index 6d9f43667..ce28aae00 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppController.java
@@ -1,26 +1,37 @@
 package it.infn.mw.iam.api.account.multi_factor_authentication.authenticator_app;
 
+import it.infn.mw.iam.core.user.exception.MfaSecretAlreadyBoundException;
 import javax.validation.Valid;
 
 import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
 import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.security.oauth2.provider.OAuth2Authentication;
 import org.springframework.transaction.annotation.Transactional;
+import org.springframework.web.bind.annotation.ExceptionHandler;
 import org.springframework.web.bind.annotation.ModelAttribute;
-import org.springframework.web.bind.annotation.PostMapping;
 import org.springframework.web.bind.annotation.RequestBody;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RequestMethod;
 import org.springframework.web.bind.annotation.ResponseBody;
-
+import org.springframework.web.bind.annotation.ResponseStatus;
+
+import dev.samstevens.totp.code.HashingAlgorithm;
+import dev.samstevens.totp.exceptions.QrGenerationException;
+import dev.samstevens.totp.qr.QrData;
+import dev.samstevens.totp.qr.QrGenerator;
+import dev.samstevens.totp.qr.ZxingPngQrGenerator;
+import it.infn.mw.iam.api.common.ErrorDTO;
 import it.infn.mw.iam.api.common.NoSuchAccountError;
 import it.infn.mw.iam.core.user.IamAccountService;
 import it.infn.mw.iam.persistence.model.IamAccount;
 import it.infn.mw.iam.persistence.repository.IamAccountRepository;
 
+import static dev.samstevens.totp.util.Utils.getDataUriForImage;
+
 import org.springframework.stereotype.Controller;
 
 @SuppressWarnings("deprecation")
@@ -38,6 +49,28 @@ public AuthenticatorAppController(IamAccountService service,
     this.accountRepository = accountRepository;
   }
 
+  @PreAuthorize("hasRole('USER')")
+  @RequestMapping(value = "/add-secret", method = RequestMethod.GET,
+      produces = MediaType.APPLICATION_JSON_VALUE)
+  @ResponseBody
+  public SecretAndDataUriDTO addSecret() {
+    final String username = getUsernameFromSecurityContext();
+    IamAccount account = accountRepository.findByUsername(username)
+      .orElseThrow(() -> NoSuchAccountError.forUsername(username));
+
+    account = service.addTotpMfaSecret(account);
+
+    SecretAndDataUriDTO dto = new SecretAndDataUriDTO(account.getTotpMfa().getSecret());
+    try {
+      String dataUri =
+          generateQRCodeFromSecret(account.getTotpMfa().getSecret(), account.getUsername());
+      dto.setDataUri(dataUri);
+    } catch (QrGenerationException e) {
+      // TODO Auto-generated catch block
+    }
+    return dto;
+  }
+
   // TODO switch to this post method from get request, post method not currently working
   @PreAuthorize("hasRole('USER')")
   @RequestMapping(value = "/enable", method = RequestMethod.POST,
@@ -48,9 +81,9 @@ public void enableAuthenticatorApp(@Valid CodeDTO code) {
     IamAccount account = accountRepository.findByUsername(username)
       .orElseThrow(() -> NoSuchAccountError.forUsername(username));
 
-    service.addTotpMfaSecret(account);
-
     // TODO checks to see if provided code valid
+
+    service.enableTotpMfa(account);
   }
 
   @PreAuthorize("hasRole('USER')")
@@ -62,9 +95,9 @@ public void getenableAuthenticatorApp() {
     IamAccount account = accountRepository.findByUsername(username)
       .orElseThrow(() -> NoSuchAccountError.forUsername(username));
 
-    service.addTotpMfaSecret(account);
-
     // TODO checks to see if provided code valid
+
+    service.enableTotpMfa(account);
   }
 
   @PreAuthorize("hasRole('USER')")
@@ -78,7 +111,7 @@ public void disableAuthenticatorApp(@ModelAttribute @Valid CodeDTO code) {
 
     // TODO checks to see if provided code valid
 
-    service.removeTotpMfaSecret(account);
+    service.disableTotpMfa(account);
   }
 
   private String getUsernameFromSecurityContext() {
@@ -90,4 +123,38 @@ private String getUsernameFromSecurityContext() {
     }
     return auth.getName();
   }
+
+  private String generateQRCodeFromSecret(String secret, String username)
+      throws QrGenerationException {
+
+    // TODO add in admin configuration through properties file
+    QrData data = new QrData.Builder().label(username)
+      .secret(secret)
+      .issuer("IAM Test")
+      .algorithm(HashingAlgorithm.SHA1)
+      .digits(6)
+      .period(30)
+      .build();
+
+    byte[] imageData;
+
+    // TODO autowire this
+    QrGenerator qrGenerator = new ZxingPngQrGenerator();
+
+    try {
+      imageData = qrGenerator.generate(data);
+    } catch (QrGenerationException e) {
+      throw e;
+    }
+
+    String mimeType = qrGenerator.getImageMimeType();
+    return getDataUriForImage(imageData, mimeType);
+  }
+
+  @ResponseStatus(code = HttpStatus.CONFLICT)
+  @ExceptionHandler(MfaSecretAlreadyBoundException.class)
+  @ResponseBody
+  public ErrorDTO handlemfaSecretAlreadyBoundException(MfaSecretAlreadyBoundException e) {
+    return ErrorDTO.fromString(e.getMessage());
+  }
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/SecretAndDataUriDTO.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/SecretAndDataUriDTO.java
new file mode 100644
index 000000000..e33b963a6
--- /dev/null
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/SecretAndDataUriDTO.java
@@ -0,0 +1,46 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.infn.mw.iam.api.account.multi_factor_authentication.authenticator_app;
+
+import javax.validation.constraints.NotEmpty;
+
+public class SecretAndDataUriDTO {
+
+  @NotEmpty(message = "Secret cannot be empty")
+  private String secret;
+
+  private String dataUri;
+
+  public SecretAndDataUriDTO(final String secret) {
+    this.secret = secret;
+  }
+
+  public String getSecret() {
+    return secret;
+  }
+
+  public void setSecret(final String secret) {
+    this.secret = secret;
+  }
+
+  public String getDataUri() {
+    return dataUri;
+  }
+
+  public void setDataUri(final String dataUri) {
+    this.dataUri = dataUri;
+  }
+}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/MultiFactorSecretRemovedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/AuthenticatorAppDisabledEvent.java
similarity index 59%
rename from iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/MultiFactorSecretRemovedEvent.java
rename to iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/AuthenticatorAppDisabledEvent.java
index fc8b29fdb..afdeb9296 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/MultiFactorSecretRemovedEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/AuthenticatorAppDisabledEvent.java
@@ -2,14 +2,14 @@
 
 import it.infn.mw.iam.persistence.model.IamAccount;
 
-public class MultiFactorSecretRemovedEvent extends MultiFactorEvent {
+public class AuthenticatorAppDisabledEvent extends MultiFactorEvent {
 
-  public static final String TEMPLATE = "Multi-factor secret removed from account '%s'";
+  public static final String TEMPLATE = "Authenticator app MFA disabled on  account '%s'";
 
   // TODO add this in
   // private static final long serialVersionUID = 3213253939764135733L;
 
-  public MultiFactorSecretRemovedEvent(Object source, IamAccount account) {
+  public AuthenticatorAppDisabledEvent(Object source, IamAccount account) {
     super(source, account, String.format(TEMPLATE, account.getUsername()));
   }
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/MultiFactorSecretAddedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/AuthenticatorAppEnabledEvent.java
similarity index 56%
rename from iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/MultiFactorSecretAddedEvent.java
rename to iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/AuthenticatorAppEnabledEvent.java
index 7c355d17d..a843d4aad 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/MultiFactorSecretAddedEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/AuthenticatorAppEnabledEvent.java
@@ -2,14 +2,14 @@
 
 import it.infn.mw.iam.persistence.model.IamAccount;
 
-public class MultiFactorSecretAddedEvent extends MultiFactorEvent {
+public class AuthenticatorAppEnabledEvent extends MultiFactorEvent {
 
-  public static final String TEMPLATE = "Multi-factor secret added to account '%s'";
+  public static final String TEMPLATE = "Authenticator app MFA enabled on account '%s'";
 
   // TODO add this in
   // private static final long serialVersionUID = 3213253939764135733L;
 
-  public MultiFactorSecretAddedEvent(Object source, IamAccount account) {
+  public AuthenticatorAppEnabledEvent(Object source, IamAccount account) {
     super(source, account, String.format(TEMPLATE, account.getUsername()));
   }
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/DefaultIamAccountService.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/DefaultIamAccountService.java
index 69f57aa04..eeecde545 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/DefaultIamAccountService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/DefaultIamAccountService.java
@@ -18,8 +18,8 @@
 import static com.google.common.base.Preconditions.checkArgument;
 import static com.google.common.base.Preconditions.checkNotNull;
 import static com.google.common.base.Strings.isNullOrEmpty;
-import it.infn.mw.iam.audit.events.account.multi_factor_authentication.MultiFactorSecretAddedEvent;
-import it.infn.mw.iam.audit.events.account.multi_factor_authentication.MultiFactorSecretRemovedEvent;
+import it.infn.mw.iam.audit.events.account.multi_factor_authentication.AuthenticatorAppEnabledEvent;
+import it.infn.mw.iam.audit.events.account.multi_factor_authentication.AuthenticatorAppDisabledEvent;
 import static it.infn.mw.iam.core.lifecycle.ExpiredAccountsHandler.LIFECYCLE_STATUS_LABEL;
 import it.infn.mw.iam.core.user.exception.MfaSecretAlreadyBoundException;
 import it.infn.mw.iam.core.user.exception.MfaSecretNotFoundException;
@@ -135,12 +135,12 @@ private void attributeRemovedEvent(IamAccount account, IamAttribute attribute) {
     eventPublisher.publishEvent(new AccountAttributeRemovedEvent(this, account, attribute));
   }
 
-  private void multiFactorSecretAddedEvent(IamAccount account) {
-    eventPublisher.publishEvent(new MultiFactorSecretAddedEvent(this, account));
+  private void authenticatorAppEnabledEvent(IamAccount account) {
+    eventPublisher.publishEvent(new AuthenticatorAppEnabledEvent(this, account));
   }
 
-  private void multiFactorSecretRemovedEvent(IamAccount account) {
-    eventPublisher.publishEvent(new MultiFactorSecretRemovedEvent(this, account));
+  private void authenticatorAppDisabledEvent(IamAccount account) {
+    eventPublisher.publishEvent(new AuthenticatorAppDisabledEvent(this, account));
   }
 
   @Override
@@ -586,7 +586,7 @@ public void setApplicationEventPublisher(ApplicationEventPublisher applicationEv
   // TODO move this secret generation to its own class
   @Override
   public IamAccount addTotpMfaSecret(IamAccount account) {
-    if (!isNull(account.getTotpMfa())) {
+    if (!isNull(account.getTotpMfa()) && account.getTotpMfa().isActive()) {
       throw new MfaSecretAlreadyBoundException(
           "A multi-factor secret is already assigned to this account");
     }
@@ -605,24 +605,41 @@ public IamAccount addTotpMfaSecret(IamAccount account) {
     totpMfa.setRecoveryCodes(recoveryCodes);
     account.setTotpMfa(totpMfa);
     totpMfa.setAccount(account);
-    account.touch();
 
     accountRepo.save(account);
-    multiFactorSecretAddedEvent(account);
     return account;
   }
 
   @Override
-  public IamAccount removeTotpMfaSecret(IamAccount account) {
+  public IamAccount enableTotpMfa(IamAccount account) {
     if (isNull(account.getTotpMfa())) {
       throw new MfaSecretNotFoundException("No multi-factor secret is attached to this account");
     }
 
-    account.setTotpMfa(null);
+    IamTotpMfa totpMfa = account.getTotpMfa();
+    totpMfa.setActive(true);
+    account.setTotpMfa(totpMfa);
+    account.touch();
+
+    accountRepo.save(account);
+    authenticatorAppEnabledEvent(account);
+    return account;
+  }
+
+  @Override
+  public IamAccount disableTotpMfa(IamAccount account) {
+    if (!isNull(account.getTotpMfa())) {
+      throw new MfaSecretAlreadyBoundException(
+          "A multi-factor secret is already assigned to this account");
+    }
+
+    IamTotpMfa totpMfa = account.getTotpMfa();
+    totpMfa.setActive(false);
+    account.setTotpMfa(totpMfa);
     account.touch();
 
     accountRepo.save(account);
-    multiFactorSecretRemovedEvent(account);
+    authenticatorAppDisabledEvent(account);
     return account;
   }
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/IamAccountService.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/IamAccountService.java
index 8bc4e1c7b..c2f99685e 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/IamAccountService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/IamAccountService.java
@@ -194,11 +194,19 @@ public interface IamAccountService {
   IamAccount addTotpMfaSecret(IamAccount account);
 
   /**
-   * Removes a multi-factor secret from an account
+   * Enable multi-factor on account with TOTP secret
    * 
    * @param account
    * @return the updated account
    */
-  IamAccount removeTotpMfaSecret(IamAccount account);
+  IamAccount enableTotpMfa(IamAccount account);
+
+  /**
+   * Disable multi-factor on account with TOTP secret
+   * 
+   * @param account
+   * @return the updated account
+   */
+  IamAccount disableTotpMfa(IamAccount account);
 
 }
diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/authenticator-app.controller.js b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/authenticator-app.controller.js
index cc12cefc5..151d24cc6 100644
--- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/authenticator-app.controller.js
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/authenticator-app.controller.js
@@ -17,16 +17,30 @@
   'use strict';
 
   angular.module('dashboardApp')
-      .controller('AuthenticatorAppController', AuthenticatorAppController);
+      .controller('EnableAuthenticatorAppController', EnableAuthenticatorAppController);
 
-  AuthenticatorAppController.$inject = [
-    '$scope', '$state', '$uibModalInstance', 'Utils', 'AuthenticatorAppService', 'user'
+  angular.module('dashboardApp')
+      .controller('DisableAuthenticatorAppController', DisableAuthenticatorAppController);
+
+  EnableAuthenticatorAppController.$inject = [
+    '$http', '$scope', '$state', '$uibModalInstance', 'Utils', 'AuthenticatorAppService', 'user'
   ];
 
-  function AuthenticatorAppController(
-      $scope, $state, $uibModalInstance, Utils, AuthenticatorAppService, user) {
+  DisableAuthenticatorAppController.$inject = [
+    '$http', '$scope', '$state', '$uibModalInstance', 'Utils', 'AuthenticatorAppService', 'user'
+  ];
+
+  function EnableAuthenticatorAppController(
+      $http, $scope, $state, $uibModalInstance, Utils, AuthenticatorAppService, user) {
     var authAppCtrl = this;
 
+    authAppCtrl.$onInit = function() {
+      AuthenticatorAppService.addMfaSecretToUser().then(function(response) {
+        authAppCtrl.secret = response.data.secret;
+        authAppCtrl.dataUri = response.data.dataUri;
+      });
+    }
+
     authAppCtrl.userToEdit = user;
     authAppCtrl.codeMinlength = 6;
 
@@ -63,6 +77,37 @@
             $scope.operationResult = Utils.buildErrorResult(error.data);
           });
     };
+  }
+
+  function DisableAuthenticatorAppController(
+      $http, $scope, $state, $uibModalInstance, Utils, AuthenticatorAppService, user) {
+    var authAppCtrl = this;
+
+    authAppCtrl.userToEdit = user;
+    authAppCtrl.codeMinlength = 6;
+
+    authAppCtrl.dismiss = dismiss;
+    authAppCtrl.reset = reset;
+
+    function reset() {
+      console.log('reset form');
+
+      authAppCtrl.enabled = true;
+
+      authAppCtrl.user = {
+        code: ''
+      };
+
+      if ($scope.authenticatorAppForm) {
+        $scope.authenticatorAppForm.$setPristine();
+      }
+    }
+
+    authAppCtrl.reset();
+
+    function dismiss() { return $uibModalInstance.dismiss('Cancel'); }
+
+    authAppCtrl.message = '';
 
     authAppCtrl.submitDisable = function() {
       AuthenticatorAppService
diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/user-mfa.controller.js b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/user-mfa.controller.js
index 13c52a8da..e93b5da1b 100644
--- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/user-mfa.controller.js
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/user-mfa.controller.js
@@ -43,7 +43,7 @@
     function enableAuthenticatorApp() {
       var modalInstance = $uibModal.open({
         templateUrl: '/resources/iam/apps/dashboard-app/templates/home/enable-authenticator-app.html',
-        controller: 'AuthenticatorAppController',
+        controller: 'EnableAuthenticatorAppController',
         controllerAs: 'authAppCtrl',
         resolve: {user: function() { return self.user; }}
       });
@@ -56,7 +56,7 @@
     function disableAuthenticatorApp() {
       var modalInstance = $uibModal.open({
         templateUrl: '/resources/iam/apps/dashboard-app/templates/home/disable-authenticator-app.html',
-        controller: 'AuthenticatorAppController',
+        controller: 'DisableAuthenticatorAppController',
         controllerAs: 'authAppCtrl',
         resolve: {user: function() { return self.user; }}
       });
diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/services/authenticator-app.service.js b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/services/authenticator-app.service.js
index 0144a8622..a1b19550e 100644
--- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/services/authenticator-app.service.js
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/services/authenticator-app.service.js
@@ -22,11 +22,16 @@ AuthenticatorAppService.$inject = ['$http', '$httpParamSerializerJQLike'];
 function AuthenticatorAppService($http, $httpParamSerializerJQLike){
 	
 	var service = {
+		addMfaSecretToUser : addMfaSecretToUser,
 		enableAuthenticatorApp : enableAuthenticatorApp,
 		disableAuthenticatorApp : disableAuthenticatorApp
 	};
 	
 	return service;
+
+	function addMfaSecretToUser() {
+		return $http.get('/iam/authenticator-app/add-secret');
+	}
 	
 	// TODO two functions are broadly similar. This could be simplified into the foundations for step-up authentication
 	function enableAuthenticatorApp(code){
diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/enable-authenticator-app.html b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/enable-authenticator-app.html
index b113b705a..5f275d82c 100644
--- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/enable-authenticator-app.html
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/enable-authenticator-app.html
@@ -26,9 +26,9 @@ 
Enable authenticator app

     
 
     
Scan the QR code through your authenticator app and input a TOTP to validate configuration.

-    
+    
     
Alternatively, enter this secret manually into the app.

-    
...

+    
{{authAppCtrl.secret}}

 
     

       

diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAccount.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAccount.java
index 67374ed67..eb3aa7e3f 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAccount.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAccount.java
@@ -92,7 +92,7 @@ public class IamAccount implements Serializable {
   @JoinColumn(name = "user_info_id")
   private IamUserInfo userInfo;
 
-  @OneToOne(cascade = CascadeType.ALL)
+  @OneToOne(cascade = CascadeType.ALL, orphanRemoval = true)
   @JoinColumn(name = "totp_mfa_id", nullable = true)
   private IamTotpMfa totpMfa;
 

From 06f4ace4056f20cc49d6774ab90b72677e1f9d8a Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Fri, 26 Nov 2021 16:56:43 +0000
Subject: [PATCH 25/76] Dynamic mfa settings menu, toaster notifications on
 successful operation

Mfa settings menu now updates to show status of user's multi-factor settings that are enabled (i.e. button will be green or red).

Toaster notification also displays upon successful operation

Authenticator app disabling now possible through GET request. Still working on POST request and code validation
---
 .../MultiFactorSettingsController.java        |  56 ++++++
 .../MultiFactorSettingsDTO.java               |  40 ++++
 .../AuthenticatorAppController.java           |  14 ++
 .../core/user/DefaultIamAccountService.java   |  14 +-
 .../authenticator-app.controller.js           |  25 +--
 .../controllers/user-mfa.controller.js        | 181 ++++++++----------
 .../services/authenticator-app.service.js     |  34 ++--
 .../home/disable-authenticator-app.html       |   3 +-
 .../templates/home/editmfasettings.html       |  16 --
 9 files changed, 224 insertions(+), 159 deletions(-)
 create mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/MultiFactorSettingsController.java
 create mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/MultiFactorSettingsDTO.java

diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/MultiFactorSettingsController.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/MultiFactorSettingsController.java
new file mode 100644
index 000000000..636e60cfd
--- /dev/null
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/MultiFactorSettingsController.java
@@ -0,0 +1,56 @@
+package it.infn.mw.iam.api.account.multi_factor_authentication;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.http.MediaType;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.security.oauth2.provider.OAuth2Authentication;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
+import org.springframework.web.bind.annotation.ResponseBody;
+
+import it.infn.mw.iam.api.common.NoSuchAccountError;
+import it.infn.mw.iam.persistence.model.IamAccount;
+import it.infn.mw.iam.persistence.repository.IamAccountRepository;
+
+@SuppressWarnings("deprecation")
+@Controller
+@RequestMapping("iam/multi-factor-settings")
+public class MultiFactorSettingsController {
+
+  final IamAccountRepository accountRepository;
+
+  @Autowired
+  public MultiFactorSettingsController(IamAccountRepository accountRepository) {
+    this.accountRepository = accountRepository;
+  }
+
+  @PreAuthorize("hasRole('USER')")
+  @RequestMapping(value = "/get-settings", method = RequestMethod.GET,
+      produces = MediaType.APPLICATION_JSON_VALUE)
+  @ResponseBody
+  public MultiFactorSettingsDTO getMultiFactorSettings() {
+
+    final String username = getUsernameFromSecurityContext();
+    IamAccount account = accountRepository.findByUsername(username)
+      .orElseThrow(() -> NoSuchAccountError.forUsername(username));
+
+    MultiFactorSettingsDTO dto = new MultiFactorSettingsDTO();
+    dto.setAuthenticatorAppActive(account.getTotpMfa() != null && account.getTotpMfa().isActive());
+    // add further factors if/when implemented
+
+    return dto;
+  }
+
+  private String getUsernameFromSecurityContext() {
+
+    Authentication auth = SecurityContextHolder.getContext().getAuthentication();
+    if (auth instanceof OAuth2Authentication) {
+      OAuth2Authentication oauth = (OAuth2Authentication) auth;
+      auth = oauth.getUserAuthentication();
+    }
+    return auth.getName();
+  }
+}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/MultiFactorSettingsDTO.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/MultiFactorSettingsDTO.java
new file mode 100644
index 000000000..2bfd69de4
--- /dev/null
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/MultiFactorSettingsDTO.java
@@ -0,0 +1,40 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.infn.mw.iam.api.account.multi_factor_authentication;
+
+import javax.validation.constraints.NotEmpty;
+
+public class MultiFactorSettingsDTO {
+
+  @NotEmpty
+  private boolean authenticatorAppActive;
+
+  // add further factors if/when implemented
+
+  public MultiFactorSettingsDTO() {}
+
+  public MultiFactorSettingsDTO(final boolean authenticatorAppActive) {
+    this.authenticatorAppActive = authenticatorAppActive;
+  }
+
+  public boolean getAuthenticatorAppActive() {
+    return authenticatorAppActive;
+  }
+
+  public void setAuthenticatorAppActive(final boolean authenticatorAppActive) {
+    this.authenticatorAppActive = authenticatorAppActive;
+  }
+}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppController.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppController.java
index ce28aae00..08528b6b7 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppController.java
@@ -114,6 +114,20 @@ public void disableAuthenticatorApp(@ModelAttribute @Valid CodeDTO code) {
     service.disableTotpMfa(account);
   }
 
+  @PreAuthorize("hasRole('USER')")
+  @RequestMapping(value = "/disabled", method = RequestMethod.GET,
+      produces = MediaType.TEXT_PLAIN_VALUE)
+  @ResponseBody
+  public void getdisableAuthenticatorApp() {
+    final String username = getUsernameFromSecurityContext();
+    IamAccount account = accountRepository.findByUsername(username)
+      .orElseThrow(() -> NoSuchAccountError.forUsername(username));
+
+    // TODO checks to see if provided code valid
+
+    service.disableTotpMfa(account);
+  }
+
   private String getUsernameFromSecurityContext() {
 
     Authentication auth = SecurityContextHolder.getContext().getAuthentication();
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/DefaultIamAccountService.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/DefaultIamAccountService.java
index eeecde545..b01bc61fe 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/DefaultIamAccountService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/DefaultIamAccountService.java
@@ -612,8 +612,9 @@ public IamAccount addTotpMfaSecret(IamAccount account) {
 
   @Override
   public IamAccount enableTotpMfa(IamAccount account) {
-    if (isNull(account.getTotpMfa())) {
-      throw new MfaSecretNotFoundException("No multi-factor secret is attached to this account");
+    if (!isNull(account.getTotpMfa()) && account.getTotpMfa().isActive()) {
+      throw new MfaSecretAlreadyBoundException(
+          "A multi-factor secret is already assigned to this account");
     }
 
     IamTotpMfa totpMfa = account.getTotpMfa();
@@ -628,14 +629,11 @@ public IamAccount enableTotpMfa(IamAccount account) {
 
   @Override
   public IamAccount disableTotpMfa(IamAccount account) {
-    if (!isNull(account.getTotpMfa())) {
-      throw new MfaSecretAlreadyBoundException(
-          "A multi-factor secret is already assigned to this account");
+    if (isNull(account.getTotpMfa())) {
+      throw new MfaSecretNotFoundException("No multi-factor secret is attached to this account");
     }
 
-    IamTotpMfa totpMfa = account.getTotpMfa();
-    totpMfa.setActive(false);
-    account.setTotpMfa(totpMfa);
+    account.setTotpMfa(null);
     account.touch();
 
     accountRepo.save(account);
diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/authenticator-app.controller.js b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/authenticator-app.controller.js
index 151d24cc6..fc71b26ab 100644
--- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/authenticator-app.controller.js
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/authenticator-app.controller.js
@@ -23,15 +23,15 @@
       .controller('DisableAuthenticatorAppController', DisableAuthenticatorAppController);
 
   EnableAuthenticatorAppController.$inject = [
-    '$http', '$scope', '$state', '$uibModalInstance', 'Utils', 'AuthenticatorAppService', 'user'
+    '$scope', '$state', '$uibModalInstance', 'Utils', 'AuthenticatorAppService', 'user'
   ];
 
   DisableAuthenticatorAppController.$inject = [
-    '$http', '$scope', '$state', '$uibModalInstance', 'Utils', 'AuthenticatorAppService', 'user'
+    '$scope', '$state', '$uibModalInstance', 'Utils', 'AuthenticatorAppService', 'user'
   ];
 
   function EnableAuthenticatorAppController(
-      $http, $scope, $state, $uibModalInstance, Utils, AuthenticatorAppService, user) {
+      $scope, $state, $uibModalInstance, Utils, AuthenticatorAppService, user) {
     var authAppCtrl = this;
 
     authAppCtrl.$onInit = function() {
@@ -80,7 +80,7 @@
   }
 
   function DisableAuthenticatorAppController(
-      $http, $scope, $state, $uibModalInstance, Utils, AuthenticatorAppService, user) {
+      $scope, $state, $uibModalInstance, Utils, AuthenticatorAppService, user) {
     var authAppCtrl = this;
 
     authAppCtrl.userToEdit = user;
@@ -120,21 +120,4 @@
           });
     };
   }
-
-  var compareTo = function() {
-    return {
-      require: 'ngModel',
-      scope: {otherModelValue: '=compareTo'},
-      link: function(scope, element, attributes, ngModel) {
-
-        ngModel.$validators.compareTo = function(modelValue) {
-          return modelValue == scope.otherModelValue;
-        };
-
-        scope.$watch('otherModelValue', function() { ngModel.$validate(); });
-      }
-    };
-  };
-
-  angular.module('dashboardApp').directive('compareTo', compareTo);
 })();
\ No newline at end of file
diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/user-mfa.controller.js b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/user-mfa.controller.js
index e93b5da1b..d27355eaa 100644
--- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/user-mfa.controller.js
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/user-mfa.controller.js
@@ -13,114 +13,101 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-  'use strict';
-
-  angular.module('dashboardApp')
-      .controller('UserMfaController', UserMfaController);
-
-  UserMfaController.$inject = [
-    '$scope', '$state', '$uibModalInstance', 'Utils', 'user', '$uibModal'
-  ];
-
-  function UserMfaController(
-      $scope, $state, $uibModalInstance, Utils, user, $uibModal) {
-    var userMfaCtrl = this;
-
-    userMfaCtrl.$onInit = function() {
-      console.log('UserMfaController onInit');
-    };
-
-    userMfaCtrl.userToEdit = user;
-    
-    userMfaCtrl.authenticatorAppActive = false;
-    userMfaCtrl.yubiKeyActive = false;
-    userMfaCtrl.authenticatorApp2Active = true;
-    userMfaCtrl.enableAuthenticatorApp = enableAuthenticatorApp;
-    userMfaCtrl.disableAuthenticatorApp = disableAuthenticatorApp;
-    userMfaCtrl.enableYubiKey = enableYubiKey;
-    userMfaCtrl.disableYubiKey = disableYubiKey;
-
-    function enableAuthenticatorApp() {
-      var modalInstance = $uibModal.open({
-        templateUrl: '/resources/iam/apps/dashboard-app/templates/home/enable-authenticator-app.html',
-        controller: 'EnableAuthenticatorAppController',
-        controllerAs: 'authAppCtrl',
-        resolve: {user: function() { return self.user; }}
-      });
-
-      modalInstance.result.then(function(msg) {
-        toaster.pop({type: 'success', body: msg});
-      });
-    }
+'use strict';
 
-    function disableAuthenticatorApp() {
-      var modalInstance = $uibModal.open({
-        templateUrl: '/resources/iam/apps/dashboard-app/templates/home/disable-authenticator-app.html',
-        controller: 'DisableAuthenticatorAppController',
-        controllerAs: 'authAppCtrl',
-        resolve: {user: function() { return self.user; }}
-      });
-
-      modalInstance.result.then(function(msg) {
-        toaster.pop({type: 'success', body: msg});
-      });
-    }
+angular.module('dashboardApp')
+    .controller('UserMfaController', UserMfaController);
 
-    function enableYubiKey() {
-      return true;
-    }
+UserMfaController.$inject = [
+  '$http', '$scope', '$state', '$uibModalInstance', 'Utils', 'user', '$uibModal', 'toaster'
+];
 
-    function disableYubiKey() {
-      return true;
-    }
+function UserMfaController(
+    $http, $scope, $state, $uibModalInstance, Utils, user, $uibModal, toaster) {
+  var userMfaCtrl = this;
 
-    userMfaCtrl.dismiss = dismiss;
-    userMfaCtrl.reset = reset;
+  userMfaCtrl.$onInit = function() {
+    console.log('UserMfaController onInit');
+    getMfaSettings();
+  };
 
-    function reset() {
-      console.log('reset form');
-
-      userMfaCtrl.enabled = true;
-
-      if ($scope.userMfaForm) {
-        $scope.userMfaForm.$setPristine();
-      }
-    }
+  function getMfaSettings() {
+    $http.get('/iam/multi-factor-settings/get-settings').then(function(response) {
+      userMfaCtrl.authenticatorAppActive = response.data.authenticatorAppActive;
+    });
+  }
 
-    userMfaCtrl.reset();
+  userMfaCtrl.userToEdit = user;
+  
+  userMfaCtrl.yubiKeyActive = false;
+  userMfaCtrl.enableAuthenticatorApp = enableAuthenticatorApp;
+  userMfaCtrl.disableAuthenticatorApp = disableAuthenticatorApp;
+  userMfaCtrl.enableYubiKey = enableYubiKey;
+  userMfaCtrl.disableYubiKey = disableYubiKey;
+
+  function enableAuthenticatorApp() {
+    var modalInstance = $uibModal.open({
+      templateUrl: '/resources/iam/apps/dashboard-app/templates/home/enable-authenticator-app.html',
+      controller: 'EnableAuthenticatorAppController',
+      controllerAs: 'authAppCtrl',
+      resolve: {user: function() { return self.user; }}
+    });
+
+    modalInstance.result.then(function(msg) {
+      return $uibModalInstance.close(msg);
+    });
+  }
 
-    function dismiss() { return $uibModalInstance.dismiss('Cancel'); }
+  function disableAuthenticatorApp() {
+    var modalInstance = $uibModal.open({
+      templateUrl: '/resources/iam/apps/dashboard-app/templates/home/disable-authenticator-app.html',
+      controller: 'DisableAuthenticatorAppController',
+      controllerAs: 'authAppCtrl',
+      resolve: {user: function() { return self.user; }}
+    });
+
+    modalInstance.result.then(function(msg) {
+      return $uibModalInstance.close(msg);
+    });
+  }
 
-    userMfaCtrl.message = '';
+  function enableYubiKey() {
+    return true;
+  }
 
-    userMfaCtrl.submit = function() {
-      return $uibModalInstance.close('Updated settings');
-      // ResetPasswordService
-      //     .updatePassword(
-      //         userMfaCtrl.user.currentPassword,
-      //         userMfaCtrl.user.password)
-      //     .then(function() { return $uibModalInstance.close('Password updated'); })
-      //     .catch(function(error) {
-      //       console.error(error);
-      //       $scope.operationResult = Utils.buildErrorResult(error.data);
-      //     });
-    };
+  function disableYubiKey() {
+    return true;
   }
 
-//   var compareTo = function() {
-//     return {
-//       require: 'ngModel',
-//       scope: {otherModelValue: '=compareTo'},
-//       link: function(scope, element, attributes, ngModel) {
+  userMfaCtrl.dismiss = dismiss;
+  userMfaCtrl.reset = reset;
 
-//         ngModel.$validators.compareTo = function(modelValue) {
-//           return modelValue == scope.otherModelValue;
-//         };
+  function reset() {
+    console.log('reset form');
 
-//         scope.$watch('otherModelValue', function() { ngModel.$validate(); });
-//       }
-//     };
-//   };
+    userMfaCtrl.enabled = true;
+
+    if ($scope.userMfaForm) {
+      $scope.userMfaForm.$setPristine();
+    }
+  }
 
-//   angular.module('dashboardApp').directive('compareTo', compareTo);
-// })();
\ No newline at end of file
+  userMfaCtrl.reset();
+
+  function dismiss() { return $uibModalInstance.dismiss('Cancel'); }
+
+  userMfaCtrl.message = '';
+
+  userMfaCtrl.submit = function() {
+    return $uibModalInstance.close('Updated settings');
+    // ResetPasswordService
+    //     .updatePassword(
+    //         userMfaCtrl.user.currentPassword,
+    //         userMfaCtrl.user.password)
+    //     .then(function() { return $uibModalInstance.close('Password updated'); })
+    //     .catch(function(error) {
+    //       console.error(error);
+    //       $scope.operationResult = Utils.buildErrorResult(error.data);
+    //     });
+  };
+}
\ No newline at end of file
diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/services/authenticator-app.service.js b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/services/authenticator-app.service.js
index a1b19550e..f90b90fee 100644
--- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/services/authenticator-app.service.js
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/services/authenticator-app.service.js
@@ -60,23 +60,25 @@ function AuthenticatorAppService($http, $httpParamSerializerJQLike){
 	
 	function disableAuthenticatorApp(code){
 		
-		var data = $httpParamSerializerJQLike({
-				code: code
-		});
+		return $http.get('/iam/authenticator-app/disabled');
+
+		// var data = $httpParamSerializerJQLike({
+		// 		code: code
+		// });
 		
-		var config = {
-			headers : {
-				'Accept' : 'text/plain',
-				'Content-Type': 'application/x-www-form-urlencoded'
-			},
-			transformRequest: function(obj) {
-		        var str = [];
-		        for(var p in obj)
-		        str.push(encodeURIComponent(p) + "=" + encodeURIComponent(obj[p]));
-		        return str.join("&");
-		    }
-		};
+		// var config = {
+		// 	headers : {
+		// 		'Accept' : 'text/plain',
+		// 		'Content-Type': 'application/x-www-form-urlencoded'
+		// 	},
+		// 	transformRequest: function(obj) {
+		//         var str = [];
+		//         for(var p in obj)
+		//         str.push(encodeURIComponent(p) + "=" + encodeURIComponent(obj[p]));
+		//         return str.join("&");
+		//     }
+		// };
 		
-		return $http.post('/iam/authenticator-app/disable', data, config);	
+		// return $http.post('/iam/authenticator-app/disable', data, config);	
 	};
 }
\ No newline at end of file
diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/disable-authenticator-app.html b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/disable-authenticator-app.html
index 460372dec..420838076 100644
--- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/disable-authenticator-app.html
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/disable-authenticator-app.html
@@ -42,7 +42,8 @@ 
Disable MFA through authenticator app

     

 
   

-    
+    
+    
     
     
   

diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/editmfasettings.html b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/editmfasettings.html
index 3ef7d8901..e0824e4bb 100644
--- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/editmfasettings.html
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/editmfasettings.html
@@ -40,22 +40,6 @@ 
Edit multi-factor authentication settings for {{userMfaC
           
         

 
-        

-          
-          
-          
-            
-            
-               Enabled
-            
-            
-            
-               Disabled
-            
-            
-          
-        

-
         

           
           

From 3fb7e5583b6c0dec386146374dd0dfd40ff97334 Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Fri, 26 Nov 2021 17:39:10 +0000
Subject: [PATCH 26/76] Adding license to files, adding basic input detection
 for MFA modals

Means submit button cannot be clicked until a code of 6 or more characters is entered
---
 .../MultiFactorSettingsController.java            | 15 +++++++++++++++
 .../AuthenticatorAppController.java               | 15 +++++++++++++++
 .../AuthenticatorAppDisabledEvent.java            | 15 +++++++++++++++
 .../AuthenticatorAppEnabledEvent.java             | 15 +++++++++++++++
 .../MultiFactorEvent.java                         | 15 +++++++++++++++
 .../it/infn/mw/iam/config/IamTotpMfaConfig.java   | 15 +++++++++++++++
 .../exception/MfaSecretAlreadyBoundException.java | 15 +++++++++++++++
 .../exception/MfaSecretNotFoundException.java     | 15 +++++++++++++++
 .../components/user/mfa/user.mfa.component.html   |  2 +-
 .../components/user/mfa/user.mfa.component.js     |  2 +-
 .../controllers/authenticator-app.controller.js   |  2 +-
 .../controllers/user-mfa.controller.js            |  3 ++-
 .../services/authenticator-app.service.js         |  2 +-
 .../templates/home/disable-authenticator-app.html |  6 ++----
 .../templates/home/editmfasettings.html           |  2 +-
 .../templates/home/enable-authenticator-app.html  |  6 ++----
 .../infn/mw/iam/persistence/model/IamTotpMfa.java |  2 +-
 .../persistence/model/IamTotpRecoveryCode.java    |  2 +-
 18 files changed, 133 insertions(+), 16 deletions(-)

diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/MultiFactorSettingsController.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/MultiFactorSettingsController.java
index 636e60cfd..eaa17bf4f 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/MultiFactorSettingsController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/MultiFactorSettingsController.java
@@ -1,3 +1,18 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 package it.infn.mw.iam.api.account.multi_factor_authentication;
 
 import org.springframework.beans.factory.annotation.Autowired;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppController.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppController.java
index 08528b6b7..3005ddfe0 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppController.java
@@ -1,3 +1,18 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 package it.infn.mw.iam.api.account.multi_factor_authentication.authenticator_app;
 
 import it.infn.mw.iam.core.user.exception.MfaSecretAlreadyBoundException;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/AuthenticatorAppDisabledEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/AuthenticatorAppDisabledEvent.java
index afdeb9296..efb0835af 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/AuthenticatorAppDisabledEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/AuthenticatorAppDisabledEvent.java
@@ -1,3 +1,18 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 package it.infn.mw.iam.audit.events.account.multi_factor_authentication;
 
 import it.infn.mw.iam.persistence.model.IamAccount;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/AuthenticatorAppEnabledEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/AuthenticatorAppEnabledEvent.java
index a843d4aad..4a291cfa5 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/AuthenticatorAppEnabledEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/AuthenticatorAppEnabledEvent.java
@@ -1,3 +1,18 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 package it.infn.mw.iam.audit.events.account.multi_factor_authentication;
 
 import it.infn.mw.iam.persistence.model.IamAccount;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/MultiFactorEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/MultiFactorEvent.java
index 2359af311..a09a957de 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/MultiFactorEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/MultiFactorEvent.java
@@ -1,3 +1,18 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 package it.infn.mw.iam.audit.events.account.multi_factor_authentication;
 
 import it.infn.mw.iam.audit.events.account.AccountEvent;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/IamTotpMfaConfig.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/IamTotpMfaConfig.java
index b0edafdc9..8317fe482 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/IamTotpMfaConfig.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/IamTotpMfaConfig.java
@@ -1,3 +1,18 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 package it.infn.mw.iam.config;
 
 import dev.samstevens.totp.code.CodeVerifier;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/MfaSecretAlreadyBoundException.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/MfaSecretAlreadyBoundException.java
index e5a8bc840..9bd0fedcb 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/MfaSecretAlreadyBoundException.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/MfaSecretAlreadyBoundException.java
@@ -1,3 +1,18 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 package it.infn.mw.iam.core.user.exception;
 
 public class MfaSecretAlreadyBoundException extends IamAccountException {
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/MfaSecretNotFoundException.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/MfaSecretNotFoundException.java
index 966545821..9d1581ca3 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/MfaSecretNotFoundException.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/MfaSecretNotFoundException.java
@@ -1,3 +1,18 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 package it.infn.mw.iam.core.user.exception;
 
 public class MfaSecretNotFoundException extends IamAccountException {
diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/components/user/mfa/user.mfa.component.html b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/components/user/mfa/user.mfa.component.html
index eb0d27b57..740e9d16e 100644
--- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/components/user/mfa/user.mfa.component.html
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/components/user/mfa/user.mfa.component.html
@@ -1,6 +1,6 @@
 
-
 

 
   

@@ -42,8 +41,7 @@ 
Disable MFA through authenticator app

     

 
   

-    
-    
+    
     
     
   

diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/editmfasettings.html b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/editmfasettings.html
index e0824e4bb..871c3b8b3 100644
--- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/editmfasettings.html
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/editmfasettings.html
@@ -1,6 +1,6 @@
 
-
 
 
   

@@ -43,8 +42,7 @@ 
Enable authenticator app

     

 
   

-    
-    
+    
     
     
   

diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpMfa.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpMfa.java
index edb91a3fb..fb51ac6c9 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpMfa.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpMfa.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpRecoveryCode.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpRecoveryCode.java
index 6ba4df9b2..c683e3023 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpRecoveryCode.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpRecoveryCode.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2019
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

From ea1a536ac44cb28849060e1bbfd602d168a32554 Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Mon, 29 Nov 2021 12:18:35 +0000
Subject: [PATCH 27/76] Verification code now sends through post successfully

---
 .../AuthenticatorAppController.java           | 43 +++++----------
 .../authenticator_app/error/BadCodeError.java | 29 ++++++++++
 .../services/authenticator-app.service.js     | 54 +++++++------------
 3 files changed, 61 insertions(+), 65 deletions(-)
 create mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/error/BadCodeError.java

diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppController.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppController.java
index 3005ddfe0..c572699ee 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppController.java
@@ -26,6 +26,7 @@
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.security.oauth2.provider.OAuth2Authentication;
 import org.springframework.transaction.annotation.Transactional;
+import org.springframework.validation.BindingResult;
 import org.springframework.web.bind.annotation.ExceptionHandler;
 import org.springframework.web.bind.annotation.ModelAttribute;
 import org.springframework.web.bind.annotation.RequestBody;
@@ -39,8 +40,10 @@
 import dev.samstevens.totp.qr.QrData;
 import dev.samstevens.totp.qr.QrGenerator;
 import dev.samstevens.totp.qr.ZxingPngQrGenerator;
+import it.infn.mw.iam.api.account.multi_factor_authentication.authenticator_app.error.BadCodeError;
 import it.infn.mw.iam.api.common.ErrorDTO;
 import it.infn.mw.iam.api.common.NoSuchAccountError;
+import it.infn.mw.iam.api.scim.controller.utils.ValidationErrorMessageHelper;
 import it.infn.mw.iam.core.user.IamAccountService;
 import it.infn.mw.iam.persistence.model.IamAccount;
 import it.infn.mw.iam.persistence.repository.IamAccountRepository;
@@ -91,21 +94,12 @@ public SecretAndDataUriDTO addSecret() {
   @RequestMapping(value = "/enable", method = RequestMethod.POST,
       produces = MediaType.TEXT_PLAIN_VALUE)
   @ResponseBody
-  public void enableAuthenticatorApp(@Valid CodeDTO code) {
-    final String username = getUsernameFromSecurityContext();
-    IamAccount account = accountRepository.findByUsername(username)
-      .orElseThrow(() -> NoSuchAccountError.forUsername(username));
-
-    // TODO checks to see if provided code valid
-
-    service.enableTotpMfa(account);
-  }
+  public void enableAuthenticatorApp(@Valid CodeDTO code, BindingResult validationResult) {
+    if (validationResult.hasErrors()) {
+      throw new BadCodeError(
+          ValidationErrorMessageHelper.buildValidationErrorMessage("Bad code", validationResult));
+    }
 
-  @PreAuthorize("hasRole('USER')")
-  @RequestMapping(value = "/enabled", method = RequestMethod.GET,
-      produces = MediaType.TEXT_PLAIN_VALUE)
-  @ResponseBody
-  public void getenableAuthenticatorApp() {
     final String username = getUsernameFromSecurityContext();
     IamAccount account = accountRepository.findByUsername(username)
       .orElseThrow(() -> NoSuchAccountError.forUsername(username));
@@ -116,24 +110,15 @@ public void getenableAuthenticatorApp() {
   }
 
   @PreAuthorize("hasRole('USER')")
-  @RequestMapping(method = RequestMethod.POST, value = "/disable",
+  @RequestMapping(value = "/disable", method = RequestMethod.POST,
       produces = MediaType.TEXT_PLAIN_VALUE)
   @ResponseBody
-  public void disableAuthenticatorApp(@ModelAttribute @Valid CodeDTO code) {
-    final String username = getUsernameFromSecurityContext();
-    IamAccount account = accountRepository.findByUsername(username)
-      .orElseThrow(() -> NoSuchAccountError.forUsername(username));
-
-    // TODO checks to see if provided code valid
-
-    service.disableTotpMfa(account);
-  }
+  public void disableAuthenticatorApp(@Valid CodeDTO code, BindingResult validationResult) {
+    if (validationResult.hasErrors()) {
+      throw new BadCodeError(
+          ValidationErrorMessageHelper.buildValidationErrorMessage("Bad code", validationResult));
+    }
 
-  @PreAuthorize("hasRole('USER')")
-  @RequestMapping(value = "/disabled", method = RequestMethod.GET,
-      produces = MediaType.TEXT_PLAIN_VALUE)
-  @ResponseBody
-  public void getdisableAuthenticatorApp() {
     final String username = getUsernameFromSecurityContext();
     IamAccount account = accountRepository.findByUsername(username)
       .orElseThrow(() -> NoSuchAccountError.forUsername(username));
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/error/BadCodeError.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/error/BadCodeError.java
new file mode 100644
index 000000000..e100c45c7
--- /dev/null
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/error/BadCodeError.java
@@ -0,0 +1,29 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.infn.mw.iam.api.account.multi_factor_authentication.authenticator_app.error;
+
+public class BadCodeError extends RuntimeException {
+
+  /**
+   * 
+   */
+  private static final long serialVersionUID = 1L;
+
+  public BadCodeError(String message) {
+    super(message);
+  }
+
+}
diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/services/authenticator-app.service.js b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/services/authenticator-app.service.js
index 5cac4cad5..670855af8 100644
--- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/services/authenticator-app.service.js
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/services/authenticator-app.service.js
@@ -35,50 +35,32 @@ function AuthenticatorAppService($http, $httpParamSerializerJQLike){
 	
 	// TODO two functions are broadly similar. This could be simplified into the foundations for step-up authentication
 	function enableAuthenticatorApp(code){
-
-		return $http.get('/iam/authenticator-app/enabled');
 		
-		// var data = $httpParamSerializerJQLike({
-		// 		code: code
-		// });
+		var data = $httpParamSerializerJQLike({
+				code: code
+		});
 		
-		// var config = {
-		// 	headers : {
-		// 		'Accept' : 'text/plain',
-		// 		'Content-Type': 'application/x-www-form-urlencoded'
-		// 	},
-		// 	transformRequest: function(obj) {
-		//         var str = [];
-		//         for(var p in obj)
-		//         str.push(encodeURIComponent(p) + "=" + encodeURIComponent(obj[p]));
-		//         return str.join("&");
-		//     }
-		// }; 
+		var config = {
+			headers : {
+				'Content-Type': 'application/x-www-form-urlencoded'
+			}
+		}; 
 		
-		// return $http.post('/iam/authenticator-app/enable', data, config);
+		return $http.post('/iam/authenticator-app/enable', data, config);
 	};
 	
 	function disableAuthenticatorApp(code){
-		
-		return $http.get('/iam/authenticator-app/disabled');
 
-		// var data = $httpParamSerializerJQLike({
-		// 		code: code
-		// });
+		var data = $httpParamSerializerJQLike({
+				code: code
+		});
 		
-		// var config = {
-		// 	headers : {
-		// 		'Accept' : 'text/plain',
-		// 		'Content-Type': 'application/x-www-form-urlencoded'
-		// 	},
-		// 	transformRequest: function(obj) {
-		//         var str = [];
-		//         for(var p in obj)
-		//         str.push(encodeURIComponent(p) + "=" + encodeURIComponent(obj[p]));
-		//         return str.join("&");
-		//     }
-		// };
+		var config = {
+			headers : {
+				'Content-Type': 'application/x-www-form-urlencoded'
+			}
+		};
 		
-		// return $http.post('/iam/authenticator-app/disable', data, config);	
+		return $http.post('/iam/authenticator-app/disable', data, config);	
 	};
 }
\ No newline at end of file

From 5b23238a768d20956a6d2a8a3bbf8721cda8163f Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Mon, 29 Nov 2021 14:58:41 +0000
Subject: [PATCH 28/76] Adding TOTP validation for enabling and disabling
 authenticator app MFA

Also reports errors to the user in the same modal view, e.g. invalid code format, incorrect code
---
 .../AuthenticatorAppController.java           | 59 +++++++++++++------
 .../authenticator_app/CodeDTO.java            |  2 +
 .../error/IncorrectCodeError.java             | 29 +++++++++
 ...adCodeError.java => InvalidCodeError.java} |  4 +-
 .../authenticator-app.controller.js           |  4 +-
 5 files changed, 77 insertions(+), 21 deletions(-)
 create mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/error/IncorrectCodeError.java
 rename iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/error/{BadCodeError.java => InvalidCodeError.java} (89%)

diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppController.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppController.java
index c572699ee..4fdad3737 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppController.java
@@ -15,7 +15,8 @@
  */
 package it.infn.mw.iam.api.account.multi_factor_authentication.authenticator_app;
 
-import it.infn.mw.iam.core.user.exception.MfaSecretAlreadyBoundException;
+import static dev.samstevens.totp.util.Utils.getDataUriForImage;
+
 import javax.validation.Valid;
 
 import org.springframework.beans.factory.annotation.Autowired;
@@ -25,33 +26,33 @@
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.security.oauth2.provider.OAuth2Authentication;
-import org.springframework.transaction.annotation.Transactional;
+import org.springframework.stereotype.Controller;
 import org.springframework.validation.BindingResult;
 import org.springframework.web.bind.annotation.ExceptionHandler;
-import org.springframework.web.bind.annotation.ModelAttribute;
-import org.springframework.web.bind.annotation.RequestBody;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RequestMethod;
 import org.springframework.web.bind.annotation.ResponseBody;
 import org.springframework.web.bind.annotation.ResponseStatus;
 
+import dev.samstevens.totp.code.CodeVerifier;
+import dev.samstevens.totp.code.DefaultCodeGenerator;
+import dev.samstevens.totp.code.DefaultCodeVerifier;
 import dev.samstevens.totp.code.HashingAlgorithm;
 import dev.samstevens.totp.exceptions.QrGenerationException;
 import dev.samstevens.totp.qr.QrData;
 import dev.samstevens.totp.qr.QrGenerator;
 import dev.samstevens.totp.qr.ZxingPngQrGenerator;
-import it.infn.mw.iam.api.account.multi_factor_authentication.authenticator_app.error.BadCodeError;
+import dev.samstevens.totp.time.SystemTimeProvider;
+import it.infn.mw.iam.api.account.multi_factor_authentication.authenticator_app.error.IncorrectCodeError;
+import it.infn.mw.iam.api.account.multi_factor_authentication.authenticator_app.error.InvalidCodeError;
 import it.infn.mw.iam.api.common.ErrorDTO;
 import it.infn.mw.iam.api.common.NoSuchAccountError;
 import it.infn.mw.iam.api.scim.controller.utils.ValidationErrorMessageHelper;
 import it.infn.mw.iam.core.user.IamAccountService;
+import it.infn.mw.iam.core.user.exception.MfaSecretAlreadyBoundException;
 import it.infn.mw.iam.persistence.model.IamAccount;
 import it.infn.mw.iam.persistence.repository.IamAccountRepository;
 
-import static dev.samstevens.totp.util.Utils.getDataUriForImage;
-
-import org.springframework.stereotype.Controller;
-
 @SuppressWarnings("deprecation")
 @Controller
 @RequestMapping("/iam/authenticator-app")
@@ -84,7 +85,7 @@ public SecretAndDataUriDTO addSecret() {
           generateQRCodeFromSecret(account.getTotpMfa().getSecret(), account.getUsername());
       dto.setDataUri(dataUri);
     } catch (QrGenerationException e) {
-      // TODO Auto-generated catch block
+      // TODO QR code couldn't be generated. What should be done here?
     }
     return dto;
   }
@@ -96,15 +97,16 @@ public SecretAndDataUriDTO addSecret() {
   @ResponseBody
   public void enableAuthenticatorApp(@Valid CodeDTO code, BindingResult validationResult) {
     if (validationResult.hasErrors()) {
-      throw new BadCodeError(
-          ValidationErrorMessageHelper.buildValidationErrorMessage("Bad code", validationResult));
+      throw new InvalidCodeError("Invalid code format. Code must be six numeric characters");
     }
 
     final String username = getUsernameFromSecurityContext();
     IamAccount account = accountRepository.findByUsername(username)
       .orElseThrow(() -> NoSuchAccountError.forUsername(username));
 
-    // TODO checks to see if provided code valid
+    if (!isValidCode(account.getTotpMfa().getSecret(), code.getCode())) {
+      throw new IncorrectCodeError("Incorrect code");
+    }
 
     service.enableTotpMfa(account);
   }
@@ -115,15 +117,16 @@ public void enableAuthenticatorApp(@Valid CodeDTO code, BindingResult validation
   @ResponseBody
   public void disableAuthenticatorApp(@Valid CodeDTO code, BindingResult validationResult) {
     if (validationResult.hasErrors()) {
-      throw new BadCodeError(
-          ValidationErrorMessageHelper.buildValidationErrorMessage("Bad code", validationResult));
+      throw new InvalidCodeError("Bad code");
     }
 
     final String username = getUsernameFromSecurityContext();
     IamAccount account = accountRepository.findByUsername(username)
       .orElseThrow(() -> NoSuchAccountError.forUsername(username));
 
-    // TODO checks to see if provided code valid
+    if (!isValidCode(account.getTotpMfa().getSecret(), code.getCode())) {
+      throw new IncorrectCodeError("Incorrect code");
+    }
 
     service.disableTotpMfa(account);
   }
@@ -165,10 +168,32 @@ private String generateQRCodeFromSecret(String secret, String username)
     return getDataUriForImage(imageData, mimeType);
   }
 
+  private boolean isValidCode(String secret, String codeToCheck) {
+    // TODO autowire this
+    CodeVerifier codeVerifier =
+        new DefaultCodeVerifier(new DefaultCodeGenerator(), new SystemTimeProvider());
+
+    return codeVerifier.isValidCode(secret, codeToCheck);
+  }
+
   @ResponseStatus(code = HttpStatus.CONFLICT)
   @ExceptionHandler(MfaSecretAlreadyBoundException.class)
   @ResponseBody
-  public ErrorDTO handlemfaSecretAlreadyBoundException(MfaSecretAlreadyBoundException e) {
+  public ErrorDTO handleMfaSecretAlreadyBoundException(MfaSecretAlreadyBoundException e) {
+    return ErrorDTO.fromString(e.getMessage());
+  }
+
+  @ResponseStatus(code = HttpStatus.BAD_REQUEST)
+  @ExceptionHandler(InvalidCodeError.class)
+  @ResponseBody
+  public ErrorDTO handleInvalidCodeError(InvalidCodeError e) {
+    return ErrorDTO.fromString(e.getMessage());
+  }
+
+  @ResponseStatus(code = HttpStatus.BAD_REQUEST)
+  @ExceptionHandler(IncorrectCodeError.class)
+  @ResponseBody
+  public ErrorDTO handleIncorrectCodeError(IncorrectCodeError e) {
     return ErrorDTO.fromString(e.getMessage());
   }
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/CodeDTO.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/CodeDTO.java
index 8a3ab71f9..31e73507d 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/CodeDTO.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/CodeDTO.java
@@ -15,6 +15,7 @@
  */
 package it.infn.mw.iam.api.account.multi_factor_authentication.authenticator_app;
 
+import javax.validation.constraints.Min;
 import javax.validation.constraints.NotEmpty;
 
 import org.hibernate.validator.constraints.Length;
@@ -23,6 +24,7 @@ public class CodeDTO {
 
   @NotEmpty(message = "Code cannot be empty")
   @Length(min = 6, max = 6, message = "Code must be six characters in length")
+  @Min(value = 0L, message = "Code must be a numerical value")
   private String code;
 
   public String getCode() {
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/error/IncorrectCodeError.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/error/IncorrectCodeError.java
new file mode 100644
index 000000000..fb7b41222
--- /dev/null
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/error/IncorrectCodeError.java
@@ -0,0 +1,29 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.infn.mw.iam.api.account.multi_factor_authentication.authenticator_app.error;
+
+public class IncorrectCodeError extends RuntimeException {
+
+  /**
+   * 
+   */
+  private static final long serialVersionUID = 1L;
+
+  public IncorrectCodeError(String message) {
+    super(message);
+  }
+
+}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/error/BadCodeError.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/error/InvalidCodeError.java
similarity index 89%
rename from iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/error/BadCodeError.java
rename to iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/error/InvalidCodeError.java
index e100c45c7..9b17216b9 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/error/BadCodeError.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/error/InvalidCodeError.java
@@ -15,14 +15,14 @@
  */
 package it.infn.mw.iam.api.account.multi_factor_authentication.authenticator_app.error;
 
-public class BadCodeError extends RuntimeException {
+public class InvalidCodeError extends RuntimeException {
 
   /**
    * 
    */
   private static final long serialVersionUID = 1L;
 
-  public BadCodeError(String message) {
+  public InvalidCodeError(String message) {
     super(message);
   }
 
diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/authenticator-app.controller.js b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/authenticator-app.controller.js
index e15781527..fc272a35a 100644
--- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/authenticator-app.controller.js
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/authenticator-app.controller.js
@@ -74,7 +74,7 @@
           .then(function() { return $uibModalInstance.close('Authenticator app enabled'); })
           .catch(function(error) {
             console.error(error);
-            $scope.operationResult = Utils.buildErrorResult(error.data);
+            $scope.operationResult = Utils.buildErrorResult(error.data.error);
           });
     };
   }
@@ -116,7 +116,7 @@
           .then(function() { return $uibModalInstance.close('Authenticator app disabled'); })
           .catch(function(error) {
             console.error(error);
-            $scope.operationResult = Utils.buildErrorResult(error.data);
+            $scope.operationResult = Utils.buildErrorResult(error.data.error);
           });
     };
   }

From e89f821aa10d8d4c6c3f67e5bc84e0e4e09db462 Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Mon, 29 Nov 2021 18:16:17 +0000
Subject: [PATCH 29/76] Autowiring QR generator and code verifier into
 AuthenticatorAppController

---
 .../AuthenticatorAppController.java           | 26 +++++--------------
 1 file changed, 7 insertions(+), 19 deletions(-)

diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppController.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppController.java
index 4fdad3737..485c584e4 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppController.java
@@ -35,19 +35,14 @@
 import org.springframework.web.bind.annotation.ResponseStatus;
 
 import dev.samstevens.totp.code.CodeVerifier;
-import dev.samstevens.totp.code.DefaultCodeGenerator;
-import dev.samstevens.totp.code.DefaultCodeVerifier;
 import dev.samstevens.totp.code.HashingAlgorithm;
 import dev.samstevens.totp.exceptions.QrGenerationException;
 import dev.samstevens.totp.qr.QrData;
 import dev.samstevens.totp.qr.QrGenerator;
-import dev.samstevens.totp.qr.ZxingPngQrGenerator;
-import dev.samstevens.totp.time.SystemTimeProvider;
 import it.infn.mw.iam.api.account.multi_factor_authentication.authenticator_app.error.IncorrectCodeError;
 import it.infn.mw.iam.api.account.multi_factor_authentication.authenticator_app.error.InvalidCodeError;
 import it.infn.mw.iam.api.common.ErrorDTO;
 import it.infn.mw.iam.api.common.NoSuchAccountError;
-import it.infn.mw.iam.api.scim.controller.utils.ValidationErrorMessageHelper;
 import it.infn.mw.iam.core.user.IamAccountService;
 import it.infn.mw.iam.core.user.exception.MfaSecretAlreadyBoundException;
 import it.infn.mw.iam.persistence.model.IamAccount;
@@ -60,12 +55,16 @@ public class AuthenticatorAppController {
 
   final IamAccountService service;
   final IamAccountRepository accountRepository;
+  private QrGenerator qrGenerator;
+  private CodeVerifier codeVerifier;
 
   @Autowired
   public AuthenticatorAppController(IamAccountService service,
-      IamAccountRepository accountRepository) {
+      IamAccountRepository accountRepository, QrGenerator qrGenerator, CodeVerifier codeVerifier) {
     this.service = service;
     this.accountRepository = accountRepository;
+    this.qrGenerator = qrGenerator;
+    this.codeVerifier = codeVerifier;
   }
 
   @PreAuthorize("hasRole('USER')")
@@ -104,7 +103,7 @@ public void enableAuthenticatorApp(@Valid CodeDTO code, BindingResult validation
     IamAccount account = accountRepository.findByUsername(username)
       .orElseThrow(() -> NoSuchAccountError.forUsername(username));
 
-    if (!isValidCode(account.getTotpMfa().getSecret(), code.getCode())) {
+    if (!codeVerifier.isValidCode(account.getTotpMfa().getSecret(), code.getCode())) {
       throw new IncorrectCodeError("Incorrect code");
     }
 
@@ -124,7 +123,7 @@ public void disableAuthenticatorApp(@Valid CodeDTO code, BindingResult validatio
     IamAccount account = accountRepository.findByUsername(username)
       .orElseThrow(() -> NoSuchAccountError.forUsername(username));
 
-    if (!isValidCode(account.getTotpMfa().getSecret(), code.getCode())) {
+    if (!codeVerifier.isValidCode(account.getTotpMfa().getSecret(), code.getCode())) {
       throw new IncorrectCodeError("Incorrect code");
     }
 
@@ -155,9 +154,6 @@ private String generateQRCodeFromSecret(String secret, String username)
 
     byte[] imageData;
 
-    // TODO autowire this
-    QrGenerator qrGenerator = new ZxingPngQrGenerator();
-
     try {
       imageData = qrGenerator.generate(data);
     } catch (QrGenerationException e) {
@@ -168,14 +164,6 @@ private String generateQRCodeFromSecret(String secret, String username)
     return getDataUriForImage(imageData, mimeType);
   }
 
-  private boolean isValidCode(String secret, String codeToCheck) {
-    // TODO autowire this
-    CodeVerifier codeVerifier =
-        new DefaultCodeVerifier(new DefaultCodeGenerator(), new SystemTimeProvider());
-
-    return codeVerifier.isValidCode(secret, codeToCheck);
-  }
-
   @ResponseStatus(code = HttpStatus.CONFLICT)
   @ExceptionHandler(MfaSecretAlreadyBoundException.class)
   @ResponseBody

From c4be542d655d7800ffa53b648461d861dabaa795 Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Tue, 30 Nov 2021 10:09:35 +0000
Subject: [PATCH 30/76] Database migrations for totp_mfa now in separate file

Previously, the changes to the persistence layer were weaved into the original iam_account migration file. They now have a separate file that instantiates them.
---
 .gitignore                                    |   3 +-
 .../AuthenticatorAppController.java           |   6 +-
 .../db/migration/h2/V2___iam_tables.sql       |   7 +-
 .../db/migration/h2/V70___totp_mfa.sql        |  15 +
 .../db/migration/mysql/V2___iam_tables.sql    |   7 +-
 .../db/migration/mysql/V70___totp_mfa.sql     |  15 +
 .../prod/V3___basic_configuration.sql         |   4 +-
 .../db/migration/test/V100000___test_data.sql | 502 +++++++++---------
 .../test/V3_1___duplicate_email_user.sql      |  12 +-
 .../test/V3__basic_configuration.sql          |   4 +-
 iam-test-protected-resource/.factorypath      |  66 ---
 11 files changed, 297 insertions(+), 344 deletions(-)
 create mode 100644 iam-persistence/src/main/resources/db/migration/h2/V70___totp_mfa.sql
 create mode 100644 iam-persistence/src/main/resources/db/migration/mysql/V70___totp_mfa.sql
 delete mode 100644 iam-test-protected-resource/.factorypath

diff --git a/.gitignore b/.gitignore
index 48dd7b0fe..dc1c1d9b5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -29,5 +29,4 @@ travis/travis-mitre-build.out
 
 *.iml
 .idea
-iam-test-client/.factorypath
-iam-voms-aa/.factorypath
+**/.factorypath
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppController.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppController.java
index 485c584e4..3673335a2 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppController.java
@@ -104,7 +104,7 @@ public void enableAuthenticatorApp(@Valid CodeDTO code, BindingResult validation
       .orElseThrow(() -> NoSuchAccountError.forUsername(username));
 
     if (!codeVerifier.isValidCode(account.getTotpMfa().getSecret(), code.getCode())) {
-      throw new IncorrectCodeError("Incorrect code");
+      throw new IncorrectCodeError("Incorrect code. Try again");
     }
 
     service.enableTotpMfa(account);
@@ -116,7 +116,7 @@ public void enableAuthenticatorApp(@Valid CodeDTO code, BindingResult validation
   @ResponseBody
   public void disableAuthenticatorApp(@Valid CodeDTO code, BindingResult validationResult) {
     if (validationResult.hasErrors()) {
-      throw new InvalidCodeError("Bad code");
+      throw new InvalidCodeError("Invalid code format. Code must be six numeric characters");
     }
 
     final String username = getUsernameFromSecurityContext();
@@ -124,7 +124,7 @@ public void disableAuthenticatorApp(@Valid CodeDTO code, BindingResult validatio
       .orElseThrow(() -> NoSuchAccountError.forUsername(username));
 
     if (!codeVerifier.isValidCode(account.getTotpMfa().getSecret(), code.getCode())) {
-      throw new IncorrectCodeError("Incorrect code");
+      throw new IncorrectCodeError("Incorrect code. Try again");
     }
 
     service.disableTotpMfa(account);
diff --git a/iam-persistence/src/main/resources/db/migration/h2/V2___iam_tables.sql b/iam-persistence/src/main/resources/db/migration/h2/V2___iam_tables.sql
index 821396514..ef0c76318 100644
--- a/iam-persistence/src/main/resources/db/migration/h2/V2___iam_tables.sql
+++ b/iam-persistence/src/main/resources/db/migration/h2/V2___iam_tables.sql
@@ -1,4 +1,4 @@
-CREATE TABLE iam_account (ID BIGINT IDENTITY NOT NULL, active BOOLEAN NOT NULL, CREATIONTIME TIMESTAMP NOT NULL, LASTUPDATETIME TIMESTAMP NOT NULL, PASSWORD VARCHAR(128), USERNAME VARCHAR(128) NOT NULL UNIQUE, UUID VARCHAR(36) NOT NULL UNIQUE, user_info_id BIGINT, totp_mfa_id BIGINT, PRIMARY KEY (ID));
+CREATE TABLE iam_account (ID BIGINT IDENTITY NOT NULL, active BOOLEAN NOT NULL, CREATIONTIME TIMESTAMP NOT NULL, LASTUPDATETIME TIMESTAMP NOT NULL, PASSWORD VARCHAR(128), USERNAME VARCHAR(128) NOT NULL UNIQUE, UUID VARCHAR(36) NOT NULL UNIQUE, user_info_id BIGINT, PRIMARY KEY (ID));
 CREATE TABLE iam_authority (ID BIGINT IDENTITY NOT NULL, auth VARCHAR(128) NOT NULL UNIQUE, PRIMARY KEY (ID));
 CREATE TABLE iam_group (ID BIGINT IDENTITY NOT NULL, CREATIONTIME TIMESTAMP NOT NULL, DESCRIPTION VARCHAR(512), LASTUPDATETIME TIMESTAMP NOT NULL, NAME VARCHAR(255) NOT NULL UNIQUE, UUID VARCHAR(36) NOT NULL UNIQUE, PRIMARY KEY (ID));
 CREATE TABLE iam_oidc_id (ID BIGINT IDENTITY NOT NULL, ISSUER VARCHAR(256) NOT NULL, SUBJECT VARCHAR(256) NOT NULL, account_id BIGINT, PRIMARY KEY (ID));
@@ -8,12 +8,7 @@ CREATE TABLE iam_user_info (ID BIGINT IDENTITY NOT NULL, BIRTHDATE VARCHAR, EMAI
 CREATE TABLE iam_x509_cert (ID BIGINT IDENTITY NOT NULL, CERTIFICATESUBJECT VARCHAR(128) NOT NULL UNIQUE, LABEL VARCHAR(36) NOT NULL UNIQUE, is_primary BOOLEAN, ACCOUNT_ID BIGINT, PRIMARY KEY (ID));
 CREATE TABLE iam_account_authority (account_id BIGINT NOT NULL, authority_id BIGINT NOT NULL, PRIMARY KEY (account_id, authority_id));
 CREATE TABLE iam_account_group (account_id BIGINT NOT NULL, group_id BIGINT NOT NULL, PRIMARY KEY (account_id, group_id));
-CREATE TABLE iam_totp_mfa (ID BIGINT IDENTITY NOT NULL, active BOOLEAN NOT NULL, secret VARCHAR(256), ACCOUNT_ID BIGINT, PRIMARY KEY (ID));
-CREATE TABLE iam_totp_recovery_code (ID BIGINT IDENTITY NOT NULL, code VARCHAR(255) NOT NULL, totp_mfa_id BIGINT NOT NULL, PRIMARY KEY (ID));
 ALTER TABLE iam_account ADD CONSTRAINT FK_iam_account_user_info_id FOREIGN KEY (user_info_id) REFERENCES iam_user_info (ID);
-ALTER TABLE iam_account ADD CONSTRAINT FK_iam_account_totp_mfa_id FOREIGN KEY (totp_mfa_id) REFERENCES iam_totp_mfa (ID);
-ALTER TABLE iam_totp_mfa ADD CONSTRAINT FK_iam_totp_mfa_account_id FOREIGN KEY (ACCOUNT_ID) REFERENCES iam_account (ID);
-ALTER TABLE iam_totp_recovery_code ADD CONSTRAINT FK_iam_totp_recovery_code_totp_mfa_id FOREIGN KEY (totp_mfa_id) REFERENCES iam_totp_mfa (ID);
 ALTER TABLE iam_oidc_id ADD CONSTRAINT FK_iam_oidc_id_account_id FOREIGN KEY (account_id) REFERENCES iam_account (ID);
 ALTER TABLE iam_saml_id ADD CONSTRAINT FK_iam_saml_id_account_id FOREIGN KEY (account_id) REFERENCES iam_account (ID);
 ALTER TABLE iam_ssh_key ADD CONSTRAINT FK_iam_ssh_key_ACCOUNT_ID FOREIGN KEY (ACCOUNT_ID) REFERENCES iam_account (ID);
diff --git a/iam-persistence/src/main/resources/db/migration/h2/V70___totp_mfa.sql b/iam-persistence/src/main/resources/db/migration/h2/V70___totp_mfa.sql
new file mode 100644
index 000000000..8c2486cef
--- /dev/null
+++ b/iam-persistence/src/main/resources/db/migration/h2/V70___totp_mfa.sql
@@ -0,0 +1,15 @@
+-- TOTP MFA secrets
+
+CREATE TABLE iam_totp_mfa (ID BIGINT IDENTITY NOT NULL, active BOOLEAN NOT NULL, secret VARCHAR(256), ACCOUNT_ID BIGINT, PRIMARY KEY (ID));
+
+CREATE TABLE iam_totp_recovery_code (ID BIGINT IDENTITY NOT NULL, code VARCHAR(255) NOT NULL, totp_mfa_id BIGINT NOT NULL, PRIMARY KEY (ID));
+
+ALTER TABLE iam_account ADD COLUMN totp_mfa_id BIGINT;
+
+ALTER TABLE iam_account ADD CONSTRAINT FK_iam_account_totp_mfa_id FOREIGN KEY (totp_mfa_id) REFERENCES iam_totp_mfa (ID);
+
+ALTER TABLE iam_totp_mfa ADD CONSTRAINT FK_iam_totp_mfa_account_id FOREIGN KEY (ACCOUNT_ID) REFERENCES iam_account (ID);
+
+ALTER TABLE iam_totp_recovery_code ADD CONSTRAINT FK_iam_totp_recovery_code_totp_mfa_id FOREIGN KEY (totp_mfa_id) REFERENCES iam_totp_mfa (ID);
+
+CREATE INDEX idx_iam_totp_mfa_id ON iam_account (totp_mfa_id);
\ No newline at end of file
diff --git a/iam-persistence/src/main/resources/db/migration/mysql/V2___iam_tables.sql b/iam-persistence/src/main/resources/db/migration/mysql/V2___iam_tables.sql
index b6a301533..7e7f25180 100644
--- a/iam-persistence/src/main/resources/db/migration/mysql/V2___iam_tables.sql
+++ b/iam-persistence/src/main/resources/db/migration/mysql/V2___iam_tables.sql
@@ -1,4 +1,4 @@
-CREATE TABLE iam_account (ID BIGINT AUTO_INCREMENT NOT NULL, active TINYINT(1) default 0 NOT NULL, CREATIONTIME DATETIME NOT NULL, LASTUPDATETIME DATETIME NOT NULL, PASSWORD VARCHAR(128), USERNAME VARCHAR(128) NOT NULL UNIQUE, UUID VARCHAR(36) NOT NULL UNIQUE, user_info_id BIGINT, totp_mfa_id BIGINT, PRIMARY KEY (ID));
+CREATE TABLE iam_account (ID BIGINT AUTO_INCREMENT NOT NULL, active TINYINT(1) default 0 NOT NULL, CREATIONTIME DATETIME NOT NULL, LASTUPDATETIME DATETIME NOT NULL, PASSWORD VARCHAR(128), USERNAME VARCHAR(128) NOT NULL UNIQUE, UUID VARCHAR(36) NOT NULL UNIQUE, user_info_id BIGINT, PRIMARY KEY (ID));
 CREATE TABLE iam_authority (ID BIGINT AUTO_INCREMENT NOT NULL, auth VARCHAR(128) NOT NULL UNIQUE, PRIMARY KEY (ID));
 CREATE TABLE iam_group (ID BIGINT AUTO_INCREMENT NOT NULL, CREATIONTIME DATETIME NOT NULL, DESCRIPTION VARCHAR(512), LASTUPDATETIME DATETIME NOT NULL, NAME VARCHAR(255) NOT NULL UNIQUE, UUID VARCHAR(36) NOT NULL UNIQUE, PRIMARY KEY (ID));
 CREATE TABLE iam_oidc_id (ID BIGINT AUTO_INCREMENT NOT NULL, ISSUER VARCHAR(256) NOT NULL, SUBJECT VARCHAR(256) NOT NULL, account_id BIGINT, PRIMARY KEY (ID));
@@ -8,12 +8,7 @@ CREATE TABLE iam_user_info (ID BIGINT AUTO_INCREMENT NOT NULL, BIRTHDATE VARCHAR
 CREATE TABLE iam_x509_cert (ID BIGINT AUTO_INCREMENT NOT NULL, CERTIFICATESUBJECT VARCHAR(128) NOT NULL UNIQUE, LABEL VARCHAR(36) NOT NULL UNIQUE, is_primary TINYINT(1) default 0, ACCOUNT_ID BIGINT, PRIMARY KEY (ID));
 CREATE TABLE iam_account_authority (account_id BIGINT NOT NULL, authority_id BIGINT NOT NULL, PRIMARY KEY (account_id, authority_id));
 CREATE TABLE iam_account_group (account_id BIGINT NOT NULL, group_id BIGINT NOT NULL, PRIMARY KEY (account_id, group_id));
-CREATE TABLE iam_totp_mfa (ID BIGINT AUTO_INCREMENT NOT NULL, active TINYINT(1) default 0 NOT NULL, secret VARCHAR(256), ACCOUNT_ID BIGINT, PRIMARY KEY (ID));
-CREATE TABLE iam_totp_recovery_code (ID BIGINT AUTO_INCREMENT NOT NULL, code VARCHAR(255) NOT NULL, totp_mfa_id BIGINT NOT NULL, PRIMARY KEY (ID));
 ALTER TABLE iam_account ADD CONSTRAINT FK_iam_account_user_info_id FOREIGN KEY (user_info_id) REFERENCES iam_user_info (ID);
-ALTER TABLE iam_account ADD CONSTRAINT FK_iam_account_totp_mfa_id FOREIGN KEY (totp_mfa_id) REFERENCES iam_totp_mfa (ID);
-ALTER TABLE iam_totp_mfa ADD CONSTRAINT FK_iam_totp_mfa_account_id FOREIGN KEY (ACCOUNT_ID) REFERENCES iam_account (ID);
-ALTER TABLE iam_totp_recovery_code ADD CONSTRAINT FK_iam_totp_recovery_code_totp_mfa_id FOREIGN KEY (totp_mfa_id) REFERENCES iam_totp_mfa (ID);
 ALTER TABLE iam_oidc_id ADD CONSTRAINT FK_iam_oidc_id_account_id FOREIGN KEY (account_id) REFERENCES iam_account (ID);
 ALTER TABLE iam_saml_id ADD CONSTRAINT FK_iam_saml_id_account_id FOREIGN KEY (account_id) REFERENCES iam_account (ID);
 ALTER TABLE iam_ssh_key ADD CONSTRAINT FK_iam_ssh_key_ACCOUNT_ID FOREIGN KEY (ACCOUNT_ID) REFERENCES iam_account (ID);
diff --git a/iam-persistence/src/main/resources/db/migration/mysql/V70___totp_mfa.sql b/iam-persistence/src/main/resources/db/migration/mysql/V70___totp_mfa.sql
new file mode 100644
index 000000000..de17081f8
--- /dev/null
+++ b/iam-persistence/src/main/resources/db/migration/mysql/V70___totp_mfa.sql
@@ -0,0 +1,15 @@
+-- TOTP MFA secrets
+
+CREATE TABLE iam_totp_mfa (ID BIGINT AUTO_INCREMENT NOT NULL, active TINYINT(1) default 0 NOT NULL, secret VARCHAR(256), ACCOUNT_ID BIGINT, PRIMARY KEY (ID));
+
+CREATE TABLE iam_totp_recovery_code (ID BIGINT AUTO_INCREMENT NOT NULL, code VARCHAR(255) NOT NULL, totp_mfa_id BIGINT NOT NULL, PRIMARY KEY (ID));
+
+ALTER TABLE iam_account ADD totp_mfa_id BIGINT;
+
+ALTER TABLE iam_account ADD CONSTRAINT FK_iam_account_totp_mfa_id FOREIGN KEY (totp_mfa_id) REFERENCES iam_totp_mfa (ID);
+
+ALTER TABLE iam_totp_mfa ADD CONSTRAINT FK_iam_totp_mfa_account_id FOREIGN KEY (ACCOUNT_ID) REFERENCES iam_account (ID);
+
+ALTER TABLE iam_totp_recovery_code ADD CONSTRAINT FK_iam_totp_recovery_code_totp_mfa_id FOREIGN KEY (totp_mfa_id) REFERENCES iam_totp_mfa (ID);
+
+CREATE INDEX idx_iam_totp_mfa_id ON iam_account (totp_mfa_id);
\ No newline at end of file
diff --git a/iam-persistence/src/main/resources/db/migration/prod/V3___basic_configuration.sql b/iam-persistence/src/main/resources/db/migration/prod/V3___basic_configuration.sql
index 5a046892a..7b13ae001 100644
--- a/iam-persistence/src/main/resources/db/migration/prod/V3___basic_configuration.sql
+++ b/iam-persistence/src/main/resources/db/migration/prod/V3___basic_configuration.sql
@@ -15,8 +15,8 @@ INSERT INTO iam_authority(ID, AUTH) VALUES
 INSERT INTO iam_user_info(ID,GIVENNAME,FAMILYNAME, EMAIL, EMAILVERIFIED) VALUES
 (1, 'Admin', 'User', 'admin@iam.test', true);
 
-INSERT INTO iam_account(id, uuid, username, password, user_info_id, creationtime, lastupdatetime, active, totp_mfa_id) VALUES
-(1, '73f16d93-2441-4a50-88ff-85360d78c6b5', 'admin', 'password', 1, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null);
+INSERT INTO iam_account(id, uuid, username, password, user_info_id, creationtime, lastupdatetime, active) VALUES
+(1, '73f16d93-2441-4a50-88ff-85360d78c6b5', 'admin', 'password', 1, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true);
 
 INSERT INTO iam_account_authority(account_id, authority_id) VALUES
 (1,1),
diff --git a/iam-persistence/src/main/resources/db/migration/test/V100000___test_data.sql b/iam-persistence/src/main/resources/db/migration/test/V100000___test_data.sql
index f52daa784..9380476d8 100644
--- a/iam-persistence/src/main/resources/db/migration/test/V100000___test_data.sql
+++ b/iam-persistence/src/main/resources/db/migration/test/V100000___test_data.sql
@@ -180,8 +180,8 @@ INSERT INTO iam_user_info(ID,GIVENNAME,FAMILYNAME, EMAIL, EMAILVERIFIED, BIRTHDA
 (2, 'Test', 'User', 'test@iam.test', true, '1950-01-01','M');
 
 
-INSERT INTO iam_account(id, uuid, username, password, user_info_id, creationtime, lastupdatetime, active, totp_mfa_id) VALUES
-(2, '80e5fb8d-b7c8-451a-89ba-346ae278a66f', 'test', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 2, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null);
+INSERT INTO iam_account(id, uuid, username, password, user_info_id, creationtime, lastupdatetime, active) VALUES
+(2, '80e5fb8d-b7c8-451a-89ba-346ae278a66f', 'test', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 2, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true);
 
 
 INSERT INTO iam_oidc_id(issuer, subject, account_id) VALUES
@@ -503,255 +503,255 @@ INSERT INTO iam_user_info(ID,GIVENNAME,FAMILYNAME, EMAIL, EMAILVERIFIED) VALUES
 (346, 'Test-346','User', 'test-346@test.org', true),
 (347, 'Test-347','User', 'test-347@test.org', true);
 
-INSERT INTO iam_account(id, uuid, username, password, user_info_id, creationtime, lastupdatetime, active, totp_mfa_id) VALUES
-(100, 'f2ce8cb2-a1db-4884-9ef0-d8842cc02b4a', 'test_100', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 100, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(101, '1a78b3b8-22d2-4746-9269-df55aceb036f', 'test_101', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 101, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(102, 'a07d60c6-7ffa-475f-98e4-f9f648aa278b', 'test_102', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 102, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(103, '56e1b885-ea25-4ffc-ba17-fcde2b097d02', 'test_103', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 103, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(104, '67d2794d-c7fb-406e-9bc1-b66f43cbe60f', 'test_104', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 104, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(105, 'd11e04f7-f369-4de6-9375-394f7d886ac7', 'test_105', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 105, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(106, 'bbc76b76-9f9e-443b-8c63-cd775c50c6f3', 'test_106', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 106, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(107, 'b15c850c-e6e0-4afb-a02d-374653bb102e', 'test_107', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 107, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(108, 'afada6e8-d50d-47f6-912e-d6261605c771', 'test_108', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 108, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(109, 'fa3b4c97-4787-4b49-a32c-5b4c74d5a7c8', 'test_109', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 109, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(110, '33165df6-4d49-4728-883c-3fd42720d46b', 'test_110', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 110, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(111, '15fb8d3a-003d-4ef9-8349-867d81d4ae9c', 'test_111', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 111, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(112, '7a4dda33-c2e5-4304-998a-3fa4df481123', 'test_112', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 112, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(113, '7013f989-0a95-43b5-8637-2e2360a73bb3', 'test_113', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 113, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(114, '12caabc8-4766-4028-98ff-f4d7f288a5f0', 'test_114', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 114, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(115, 'f463ad2b-5814-4877-bb62-f954c67a8044', 'test_115', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 115, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(116, '28c656c4-5489-4654-a257-0806c6bab905', 'test_116', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 116, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(117, '11be5a72-9416-45fc-a0a7-f3e23c54bfda', 'test_117', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 117, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(118, '3cea2c01-786e-41a3-8fdf-4229cc4e3742', 'test_118', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 118, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(119, 'e0247677-4542-4df3-8d75-8efa11e70911', 'test_119', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 119, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(120, 'd905a115-d726-4e11-ba1f-b8482177bb05', 'test_120', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 120, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(121, '3479afd1-584c-4479-b6e2-25f6cef2f842', 'test_121', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 121, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(122, '8d4f467d-cb68-4feb-b898-71e4487e6820', 'test_122', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 122, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(123, '0ddee1c2-1426-4b83-b520-e20bdd8ef9b3', 'test_123', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 123, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(124, 'b8b638be-6e09-4dbe-bcc0-776c2403e8c7', 'test_124', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 124, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(125, '1dc3108a-b5c0-4e5b-accd-925054075bc4', 'test_125', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 125, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(126, '5eed3374-c131-4513-84b7-dd0ff965da35', 'test_126', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 126, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(127, '2d0b4c36-0301-49f6-a20b-23b6ca48cee2', 'test_127', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 127, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(128, 'db46065a-ba62-423d-9397-7bc6fab371a5', 'test_128', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 128, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(129, 'd9dbaabf-c51a-45e5-aee1-25134ba283ac', 'test_129', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 129, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(130, '5678f40a-f361-464c-aa71-ffb48d163aaa', 'test_130', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 130, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(131, '209ae3b9-e266-4e57-a639-db29f61a7594', 'test_131', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 131, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(132, 'f3fac505-d5c9-4d9c-83af-3976f357f19c', 'test_132', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 132, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(133, '13bfd34b-1dda-452e-bd9a-284aabccf07d', 'test_133', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 133, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(134, '15ccd152-1537-48d4-a55a-fd6565e5d86f', 'test_134', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 134, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(135, '6b2f4fc1-3e98-4f64-8fb4-517d2d4b3fa3', 'test_135', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 135, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(136, '398081ee-9c3c-4e5d-802c-90a4579030d4', 'test_136', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 136, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(137, '89a32317-dd45-481d-91a4-080e30c1f29e', 'test_137', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 137, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(138, '6dc0aa56-011d-45b8-bf26-cb03e8b40ccf', 'test_138', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 138, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(139, 'cd62277e-5acf-41af-acea-b4d208cba29e', 'test_139', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 139, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(140, '0ae29eac-64ee-45b4-a2e7-e58b34c7ff0e', 'test_140', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 140, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(141, '0f7fe907-fa84-429e-8057-02d809375ba3', 'test_141', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 141, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(142, '7aa4a733-d318-4392-b3d3-6618263f667d', 'test_142', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 142, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(143, 'b1d9b1ac-e77c-4d55-a895-cf0788ed2174', 'test_143', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 143, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(144, 'f975f1f7-ad05-4d66-9905-d44c13cbd08b', 'test_144', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 144, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(145, '857f6e6d-e415-4850-a82b-59d557864910', 'test_145', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 145, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(146, '4e1c059c-1d06-4997-8bfa-5bd09fdb4571', 'test_146', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 146, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(147, 'f4a0bc7f-b279-4caf-b8d1-c86a3c106f62', 'test_147', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 147, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(148, '007bbb9d-55b1-4f5e-80a5-bbcb22073db4', 'test_148', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 148, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(149, 'a1d22bbf-9afe-49da-b75d-b58f825db351', 'test_149', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 149, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(150, '8c2351d5-5460-4b2d-b1bb-7b086130090e', 'test_150', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 150, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(151, 'e6651896-66f8-4f63-b44f-71710fdb947c', 'test_151', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 151, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(152, 'caf04a3c-8f35-40a3-99b6-48ba6a05d8b8', 'test_152', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 152, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(153, 'd501e485-a306-4c9d-9baf-cc75f2321cfd', 'test_153', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 153, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(154, '57466d38-cae8-48bf-ac67-2cfc0266b5b0', 'test_154', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 154, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(155, '4bd5f059-f014-4356-8083-9c1a77adb6fd', 'test_155', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 155, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(156, '69130f52-f251-46fd-99ee-d646938e5f3f', 'test_156', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 156, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(157, 'dedfb4f0-a545-44b3-abba-dd77103db894', 'test_157', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 157, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(158, 'b5d98a8b-3780-4ace-ace1-ac12829dc469', 'test_158', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 158, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(159, '17de2f08-37fe-469d-b7b1-0e9ea9c6d2d8', 'test_159', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 159, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(160, '313abc40-4c88-45df-89e7-bd7bbf97b0fd', 'test_160', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 160, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(161, 'c5d7fc06-16fc-4711-be37-27bbf2c2c07c', 'test_161', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 161, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(162, 'ca31bf4d-f5da-4fc4-ae36-fd3cc0d35d7f', 'test_162', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 162, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(163, 'dc98bb8e-4b91-4915-86fb-476c9503a936', 'test_163', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 163, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(164, '79dd006c-0e4c-4a79-8600-ef8a0ae5bc04', 'test_164', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 164, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(165, '05cdc1f7-7787-43d6-80c6-588277fefb9b', 'test_165', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 165, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(166, 'dcdeb139-71ab-44f5-a709-ab33fec49882', 'test_166', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 166, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(167, '35a98804-b05e-47b0-917b-d72a4d4a5240', 'test_167', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 167, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(168, '5e4d4351-82c7-438d-8f83-ee2b7ebe1fe3', 'test_168', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 168, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(169, 'e1a205e2-f202-402d-8542-4cfc529ef514', 'test_169', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 169, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(170, 'a2e6271e-5b30-42d1-a211-494b98832676', 'test_170', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 170, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(171, '68515954-75ea-4022-9581-4cb4d28c6d6d', 'test_171', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 171, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(172, '41663b84-06b5-4787-a49e-1f745ca1eab3', 'test_172', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 172, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(173, 'b257f456-bdae-4c58-8519-756abbda462a', 'test_173', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 173, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(174, 'd848b9cb-05e4-4dcf-b9b7-431d83c41810', 'test_174', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 174, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(175, 'b6859250-dcca-47ef-b013-f609468d2389', 'test_175', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 175, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(176, 'e18bc682-897b-4696-a5ef-eee37a52a3de', 'test_176', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 176, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(177, '6b00471d-f496-4335-8209-5a9e13d18b9e', 'test_177', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 177, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(178, '35664644-7b32-4503-86f4-76adbb57762c', 'test_178', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 178, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(179, '7890415f-6563-4f25-bdf3-a5f45159a1b1', 'test_179', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 179, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(180, 'a1edf880-e270-4dac-b69f-73e61c517397', 'test_180', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 180, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(181, '73520029-5901-4022-b9da-38ccd73fe799', 'test_181', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 181, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(182, 'de5825a3-c585-45b3-88a1-7e5e80686826', 'test_182', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 182, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(183, 'bb50b80a-f471-4f64-85fb-4e5051708a4a', 'test_183', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 183, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(184, 'b7aa98b9-30da-468c-8566-06a5b804c4b9', 'test_184', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 184, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(185, 'c230e253-f874-4365-8b0e-7ba5ebc1cc26', 'test_185', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 185, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(186, '7593dbbf-9286-460b-a234-32b560817f60', 'test_186', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 186, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(187, 'ee1e2ce5-da23-4576-84e3-ad7cf4e0ce26', 'test_187', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 187, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(188, 'bf1cc1be-f405-4282-b7be-9a4578670046', 'test_188', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 188, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(189, 'e5ed670a-f944-40f0-8c10-d41c3350ead5', 'test_189', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 189, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(190, '8370db5c-e196-451a-9f5f-9b99c570cf46', 'test_190', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 190, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(191, '81498342-d247-4a60-80de-2c4cb4b1a84d', 'test_191', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 191, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(192, '213f1b3c-516e-4a6f-9785-d8c85d32f83e', 'test_192', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 192, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(193, '08ba27e6-b1b5-4d9e-a64a-6b5bc538bf43', 'test_193', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 193, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(194, 'cf0cfa8e-377c-44a0-a6d1-a74ce1de08fb', 'test_194', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 194, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(195, '2ea66412-8dc2-4081-8d48-e3637ca82604', 'test_195', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 195, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(196, '4ed466eb-ee51-4433-9d0f-3a56216698a2', 'test_196', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 196, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(197, 'cc03fc51-097d-43d6-bb6c-a0df72ec4838', 'test_197', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 197, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(198, '11844e66-8146-4263-aaa6-1fde7e5cfc58', 'test_198', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 198, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(199, 'b5a954c6-69a9-473c-a4c4-83c4f7a88c1c', 'test_199', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 199, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(200, '167e359e-7833-4ce2-9f8b-f035cee39505', 'test_200', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 200, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(201, '5afb5430-a023-4a50-aa92-b134a0fb68b3', 'test_201', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 201, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(202, 'de17b155-307c-4f9b-81f3-7f8b73d2526a', 'test_202', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 202, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(203, 'c966145b-ac05-4a2c-874d-f7b585d1d03b', 'test_203', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 203, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(204, '1d88ea5a-ab5f-40b1-bd48-f18f86eef5d9', 'test_204', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 204, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(205, '6cb0be93-7829-4bfc-ba4a-4d2cdff45447', 'test_205', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 205, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(206, 'e31a2ca7-fcaa-4b98-aac9-7e78f8605851', 'test_206', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 206, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(207, 'f26899b7-64e0-4c16-9134-cef3774f1614', 'test_207', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 207, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(208, '606cf6ab-6b5e-45d1-83b8-e535b197d2f0', 'test_208', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 208, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(209, '617bfc4e-17b1-4ca7-b736-58a74c267747', 'test_209', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 209, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(210, 'e5c26b7a-17bd-47ce-aac8-1430c57b8152', 'test_210', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 210, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(211, '7747bff5-b1e5-49b9-9a87-f93a5b790df0', 'test_211', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 211, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(212, 'c6e5b631-1e91-4ecd-8358-214eec07a91d', 'test_212', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 212, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(213, 'a874c7bd-97ac-4f48-bda5-7d3305d9067d', 'test_213', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 213, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(214, 'c7938cc2-8032-424b-8f49-85558f95364b', 'test_214', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 214, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(215, '46017ce9-d4dd-4ddc-8b73-d596e23d25ad', 'test_215', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 215, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(216, 'd5e66fd2-232e-476d-8de0-2bc1eb59630d', 'test_216', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 216, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(217, '097dc614-bc56-4f5f-a190-3ca1716a6400', 'test_217', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 217, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(218, 'a3b97132-067f-4839-9b99-830a7fb659d4', 'test_218', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 218, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(219, '8d35557f-7451-4c54-bb17-9c3d204c48d3', 'test_219', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 219, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(220, 'a6fba1ff-a5d7-4907-8cd4-1caa27cad85d', 'test_220', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 220, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(221, '427feb36-4401-4971-83de-f93672c028aa', 'test_221', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 221, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(222, '66541083-b1ab-4966-9f8b-8a1109fce0e0', 'test_222', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 222, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(223, '9939c37c-a9b9-43b7-9a4b-aacc470d47c4', 'test_223', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 223, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(224, '754379a0-bdc2-4a2d-9828-9480926b30ad', 'test_224', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 224, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(225, '18c870a1-9e2c-48fb-8a52-259e55e2052e', 'test_225', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 225, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(226, '02df9a97-b44c-4c46-ab3a-c11010d45e18', 'test_226', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 226, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(227, '20f609f7-c128-46b5-abeb-d16d46aab9ad', 'test_227', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 227, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(228, '75067ca5-872c-4149-85ad-f6685f14efc0', 'test_228', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 228, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(229, 'b8639303-d15f-4c81-b9d2-2863f53737c3', 'test_229', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 229, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(230, 'a0c4d9ea-7659-4009-ac7c-a3f089def76d', 'test_230', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 230, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(231, 'd3605113-fb9a-4640-b6fe-9931594eba6c', 'test_231', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 231, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(232, 'bf59d2cc-dd79-4ad6-9637-b04098768600', 'test_232', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 232, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(233, '304d5f24-274e-4fd6-aca4-97b761d1bd0c', 'test_233', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 233, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(234, '0d9491c3-c28b-4c11-8e28-14d93e612e35', 'test_234', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 234, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(235, 'f73a809f-78a6-4214-8060-d6037fe391aa', 'test_235', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 235, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(236, '11cc494a-86a4-44d2-b5fd-06438f95d6a4', 'test_236', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 236, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(237, '55b2e8cc-aaa4-4a8b-8a83-f732188cfab2', 'test_237', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 237, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(238, 'ebe14f0a-7bf7-4614-83c8-1e2da963139a', 'test_238', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 238, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(239, '3e83b092-95a1-4ee4-ac1f-e9df2f3954ad', 'test_239', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 239, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(240, '7304efcc-7974-453e-b2db-fdcc848f8a24', 'test_240', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 240, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(241, '6b0b51e8-f058-42a6-a9ed-3b6ebde935d8', 'test_241', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 241, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(242, 'c10f6de1-a64d-4f8f-bd0a-47bcd72ab8f7', 'test_242', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 242, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(243, '5537408c-41c6-4ee5-8f59-ca70fcdbd0ae', 'test_243', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 243, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(244, '0a920520-e271-42a6-8dc1-89f090023c89', 'test_244', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 244, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(245, 'a5120b27-cdd5-4209-b3da-bdf4b53db140', 'test_245', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 245, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(246, 'cd0f900a-dab8-4a49-805d-97e57cb5ad4c', 'test_246', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 246, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(247, '53b8b68c-0a11-411a-9b4d-01d58c9c0ff0', 'test_247', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 247, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(248, '57114ddf-7bb8-4e68-952a-faa83bf276bf', 'test_248', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 248, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(249, 'fa04c6fe-1bf0-489e-b0df-9fa4756bb90b', 'test_249', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 249, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(250, '5bf5b365-962e-4f6d-9576-94d5ac66cc3c', 'test_250', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 250, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(251, 'eca96575-798c-4919-ba93-4f0eca487490', 'test_251', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 251, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(252, 'd4e52ad1-ac1c-4f68-8d97-6858c8534f84', 'test_252', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 252, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(253, '74f88528-b57b-4482-a417-e7e8cf5ccd87', 'test_253', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 253, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(254, 'f1b969bd-2e43-4981-80d1-baeba6afd456', 'test_254', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 254, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(255, '11f5bcd3-096b-4b0f-8f1b-fa9292e3f5f3', 'test_255', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 255, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(256, 'b937e637-c00b-48de-8dd4-fae260cd9fb9', 'test_256', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 256, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(257, '49886ca5-c9a8-4c1f-9ef0-4784495e943c', 'test_257', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 257, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(258, '5cf6bbba-f2bf-4704-b288-36edb49a3c7a', 'test_258', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 258, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(259, '0a246675-78f2-47d3-a716-f9b85de0e885', 'test_259', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 259, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(260, 'b1e2509b-e9e4-40f8-b5c3-4e230e675ca8', 'test_260', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 260, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(261, 'c423ca4a-54b4-40f3-859d-d39f7d4cf266', 'test_261', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 261, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(262, '1452d005-8038-4092-ba0d-bd690dfdb2e2', 'test_262', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 262, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(263, 'f39a1721-6aeb-4f1e-90be-f54684ece8f0', 'test_263', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 263, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(264, 'ec2b02db-6eb2-4b9e-aa3b-ef53b6daf005', 'test_264', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 264, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(265, 'a6809581-e7b7-4d70-bfdd-c1f302322ee3', 'test_265', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 265, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(266, '794e2ba9-518d-4494-8ef0-01669807e10a', 'test_266', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 266, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(267, 'c258f48e-7f30-4c16-bd2d-6eed81529157', 'test_267', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 267, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(268, 'b7501b84-3a14-44d7-97da-271c416cbd16', 'test_268', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 268, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(269, '88b529d5-7804-4c4d-9f35-aa7dd1df0a37', 'test_269', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 269, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(270, '0c1b65d3-dee3-4429-864f-115fbbc6a2f4', 'test_270', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 270, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(271, '01667b0f-b397-47c1-8cdb-adb3ea7cba06', 'test_271', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 271, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(272, 'c8909fda-0453-4f74-a683-bd613fdc70c5', 'test_272', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 272, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(273, '796b8703-6f42-433f-b9e6-b115b4df25b0', 'test_273', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 273, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(274, 'de8f11f6-7298-4633-ad38-cc94e03314fd', 'test_274', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 274, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(275, 'e097f4e6-9c2d-4f35-912e-bd37f5cdec00', 'test_275', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 275, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(276, '3e0dab1e-c41f-4c0d-b2e3-d056ba6a3c60', 'test_276', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 276, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(277, 'b24cb998-40b7-471c-b55a-48b58b98b2e5', 'test_277', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 277, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(278, 'ab2113f4-56a2-4d1d-83a6-a54a763e371e', 'test_278', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 278, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(279, '2a2beb83-ccbf-413f-ade2-2fd2f79e5f49', 'test_279', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 279, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(280, 'ac53405d-8813-4cf7-ac12-fad7629d5602', 'test_280', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 280, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(281, 'b6c7b0e1-38b5-4e00-a22d-45c03d5fdeac', 'test_281', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 281, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(282, '8e41ff90-42f5-4736-89a6-24246917555c', 'test_282', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 282, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(283, '2b46023a-316f-41ae-955e-01185d67d7a5', 'test_283', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 283, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(284, '74c72c06-391e-4c72-92e7-92a5b75ac2da', 'test_284', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 284, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(285, '3e1246c2-96f9-4937-be0c-eb187822c3c7', 'test_285', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 285, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(286, '7f0e0193-b743-4394-b3e5-86e01813c094', 'test_286', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 286, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(287, '886cd06c-c30a-48df-b793-be4bfa2c1eb9', 'test_287', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 287, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(288, 'cb7cf6cd-bd2e-4956-be86-5d5935417098', 'test_288', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 288, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(289, 'd2e92f17-c26b-44dd-9c60-ca69b0f55b6d', 'test_289', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 289, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(290, 'ea3a53a1-b451-4d7b-9b9f-2b6790de314d', 'test_290', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 290, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(291, '723f2b0d-3473-445c-a6f2-9c8bb12b6019', 'test_291', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 291, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(292, '8f04e723-bb30-4952-a8f5-214845e525dc', 'test_292', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 292, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(293, '56e1991e-47e1-4136-9bd0-cd94fa40b3c8', 'test_293', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 293, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(294, 'b5ef5b82-483e-4331-ba84-78ece1f72602', 'test_294', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 294, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(295, '8238ae4e-5f13-42a3-9d6c-ea60f0ee64a1', 'test_295', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 295, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(296, '800a6a1d-1f63-4052-a14a-fcb56ab7e98b', 'test_296', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 296, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(297, '2eb884c0-8953-434d-898f-a162ffd44102', 'test_297', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 297, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(298, '06363941-bac6-4cc1-b56f-82d9d64d7c12', 'test_298', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 298, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(299, 'd8468131-79a2-4003-bf0a-e034a3455af9', 'test_299', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 299, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(300, 'e8e5f9d3-4473-46d9-b893-a195d5ccc6b4', 'test_300', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 300, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(301, '57db1144-49b7-4930-a214-9bba56c0eab6', 'test_301', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 301, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(302, '668a6ec5-142f-467d-891a-57fe10faf4bb', 'test_302', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 302, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(303, '9bcd9772-6c90-4c14-8ff4-16fa54744c87', 'test_303', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 303, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(304, '6c37ac4e-5213-4d60-8070-fadf3fa3ca38', 'test_304', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 304, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(305, 'fb5d7ea0-249f-4a0e-97aa-caa015d148e4', 'test_305', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 305, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(306, '26035205-595c-433a-8aba-4e0d6ce103a3', 'test_306', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 306, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(307, '1e4a6346-9da9-417c-bfbf-1a3cded61e12', 'test_307', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 307, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(308, '3af98cba-0cd4-4ea1-bcdc-c4c91672f038', 'test_308', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 308, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(309, 'a073f7ce-dfdc-424c-b4d0-bec7acaae445', 'test_309', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 309, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(310, '6524988e-5916-4410-a740-58d1e57d3f93', 'test_310', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 310, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(311, '58a190c4-789e-4c97-9fbb-245d3a58c8fe', 'test_311', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 311, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(312, '3244773f-b74b-461d-bf9a-916a05980c99', 'test_312', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 312, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(313, 'aaed5fa8-6555-43d2-adf4-c672008f8c92', 'test_313', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 313, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(314, 'f32415ac-f0fb-4815-bbef-27ba6115a1cc', 'test_314', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 314, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(315, '2030b697-b729-40c4-91b1-592e19fd4e73', 'test_315', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 315, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(316, 'ee47b98e-ebd5-44ae-8c9a-cbec609415b0', 'test_316', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 316, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(317, 'a47459c2-a709-4601-9151-cb57ae13bc8c', 'test_317', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 317, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(318, '5e274495-2c02-4f75-9ce2-c730e2686be9', 'test_318', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 318, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(319, 'f5f04ca8-f693-4758-9aa6-9a3c55938937', 'test_319', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 319, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(320, '5f876faf-2ad7-41f3-906d-2edd9fd2907d', 'test_320', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 320, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(321, '3d0665c6-db74-4d48-91cc-ebe39bbae605', 'test_321', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 321, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(322, '86c19bce-cb25-47a4-8aba-29c8ad4fc87d', 'test_322', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 322, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(323, 'efa06619-2301-4cb4-b9fa-6e9bddef94d7', 'test_323', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 323, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(324, '3cfc5976-aa7f-4281-8b43-6ea6eee1ac80', 'test_324', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 324, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(325, '19a56d56-1f57-45e6-9c2e-466a17d8c7ba', 'test_325', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 325, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(326, '026a45cf-cbeb-4ea9-8d20-21efbe206bad', 'test_326', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 326, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(327, '48312cae-f61d-4f87-9b20-a957d1e919ce', 'test_327', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 327, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(328, 'e06abc58-f451-4e9e-ac4f-51d5e9d424a6', 'test_328', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 328, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(329, '10b58273-4b30-4caf-954c-a1873ca4d6b5', 'test_329', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 329, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(330, '008892b7-6479-4e68-adf2-39e7ac29e66e', 'test_330', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 330, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(331, '7f864422-153c-4681-8c9e-4e942dce9548', 'test_331', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 331, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(332, '67c5538e-0363-4650-a42e-ba25746b4239', 'test_332', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 332, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(333, '208210c1-1601-47ae-883f-cdb16e0f802b', 'test_333', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 333, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(334, 'bb08395a-a0f0-490d-9d23-6f2f76b41514', 'test_334', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 334, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(335, '050c1a8e-256d-41ab-bd3a-3abe54d01b32', 'test_335', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 335, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(336, 'cf016005-9207-4a2d-a8fe-91c278029a18', 'test_336', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 336, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(337, '950a5d40-e604-4f6c-82dd-2b60a578d9aa', 'test_337', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 337, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(338, '3e00662d-6917-4759-b9a9-be8eda02f63b', 'test_338', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 338, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(339, 'bb339af3-2038-4f17-b489-46d4b7542cb6', 'test_339', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 339, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(340, '3927f6d5-5d90-4192-b84c-cebda90c0b0a', 'test_340', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 340, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(341, 'e6b29f71-bb4a-420b-8442-1f7639109465', 'test_341', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 341, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(342, 'ff7909b6-a90c-43c7-96fc-c375d439e373', 'test_342', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 342, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(343, '6f9902ca-7674-4f2f-b2e1-aeb3701bae14', 'test_343', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 343, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(344, '36d75eda-7573-474a-8aeb-f8555464154f', 'test_344', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 344, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(345, 'd3c489ae-3f03-48fe-9248-927a8bb3297f', 'test_345', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 345, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(346, '18764a4e-8b01-478e-80b3-217cc37d49c7', 'test_346', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 346, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null),
-(347, '00075d1c-f486-41a0-98f8-06f0354b8416', 'test_347', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 347, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null);
+INSERT INTO iam_account(id, uuid, username, password, user_info_id, creationtime, lastupdatetime, active) VALUES
+(100, 'f2ce8cb2-a1db-4884-9ef0-d8842cc02b4a', 'test_100', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 100, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(101, '1a78b3b8-22d2-4746-9269-df55aceb036f', 'test_101', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 101, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(102, 'a07d60c6-7ffa-475f-98e4-f9f648aa278b', 'test_102', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 102, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(103, '56e1b885-ea25-4ffc-ba17-fcde2b097d02', 'test_103', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 103, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(104, '67d2794d-c7fb-406e-9bc1-b66f43cbe60f', 'test_104', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 104, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(105, 'd11e04f7-f369-4de6-9375-394f7d886ac7', 'test_105', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 105, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(106, 'bbc76b76-9f9e-443b-8c63-cd775c50c6f3', 'test_106', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 106, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(107, 'b15c850c-e6e0-4afb-a02d-374653bb102e', 'test_107', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 107, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(108, 'afada6e8-d50d-47f6-912e-d6261605c771', 'test_108', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 108, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(109, 'fa3b4c97-4787-4b49-a32c-5b4c74d5a7c8', 'test_109', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 109, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(110, '33165df6-4d49-4728-883c-3fd42720d46b', 'test_110', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 110, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(111, '15fb8d3a-003d-4ef9-8349-867d81d4ae9c', 'test_111', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 111, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(112, '7a4dda33-c2e5-4304-998a-3fa4df481123', 'test_112', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 112, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(113, '7013f989-0a95-43b5-8637-2e2360a73bb3', 'test_113', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 113, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(114, '12caabc8-4766-4028-98ff-f4d7f288a5f0', 'test_114', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 114, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(115, 'f463ad2b-5814-4877-bb62-f954c67a8044', 'test_115', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 115, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(116, '28c656c4-5489-4654-a257-0806c6bab905', 'test_116', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 116, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(117, '11be5a72-9416-45fc-a0a7-f3e23c54bfda', 'test_117', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 117, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(118, '3cea2c01-786e-41a3-8fdf-4229cc4e3742', 'test_118', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 118, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(119, 'e0247677-4542-4df3-8d75-8efa11e70911', 'test_119', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 119, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(120, 'd905a115-d726-4e11-ba1f-b8482177bb05', 'test_120', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 120, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(121, '3479afd1-584c-4479-b6e2-25f6cef2f842', 'test_121', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 121, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(122, '8d4f467d-cb68-4feb-b898-71e4487e6820', 'test_122', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 122, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(123, '0ddee1c2-1426-4b83-b520-e20bdd8ef9b3', 'test_123', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 123, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(124, 'b8b638be-6e09-4dbe-bcc0-776c2403e8c7', 'test_124', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 124, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(125, '1dc3108a-b5c0-4e5b-accd-925054075bc4', 'test_125', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 125, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(126, '5eed3374-c131-4513-84b7-dd0ff965da35', 'test_126', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 126, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(127, '2d0b4c36-0301-49f6-a20b-23b6ca48cee2', 'test_127', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 127, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(128, 'db46065a-ba62-423d-9397-7bc6fab371a5', 'test_128', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 128, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(129, 'd9dbaabf-c51a-45e5-aee1-25134ba283ac', 'test_129', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 129, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(130, '5678f40a-f361-464c-aa71-ffb48d163aaa', 'test_130', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 130, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(131, '209ae3b9-e266-4e57-a639-db29f61a7594', 'test_131', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 131, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(132, 'f3fac505-d5c9-4d9c-83af-3976f357f19c', 'test_132', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 132, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(133, '13bfd34b-1dda-452e-bd9a-284aabccf07d', 'test_133', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 133, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(134, '15ccd152-1537-48d4-a55a-fd6565e5d86f', 'test_134', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 134, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(135, '6b2f4fc1-3e98-4f64-8fb4-517d2d4b3fa3', 'test_135', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 135, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(136, '398081ee-9c3c-4e5d-802c-90a4579030d4', 'test_136', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 136, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(137, '89a32317-dd45-481d-91a4-080e30c1f29e', 'test_137', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 137, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(138, '6dc0aa56-011d-45b8-bf26-cb03e8b40ccf', 'test_138', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 138, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(139, 'cd62277e-5acf-41af-acea-b4d208cba29e', 'test_139', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 139, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(140, '0ae29eac-64ee-45b4-a2e7-e58b34c7ff0e', 'test_140', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 140, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(141, '0f7fe907-fa84-429e-8057-02d809375ba3', 'test_141', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 141, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(142, '7aa4a733-d318-4392-b3d3-6618263f667d', 'test_142', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 142, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(143, 'b1d9b1ac-e77c-4d55-a895-cf0788ed2174', 'test_143', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 143, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(144, 'f975f1f7-ad05-4d66-9905-d44c13cbd08b', 'test_144', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 144, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(145, '857f6e6d-e415-4850-a82b-59d557864910', 'test_145', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 145, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(146, '4e1c059c-1d06-4997-8bfa-5bd09fdb4571', 'test_146', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 146, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(147, 'f4a0bc7f-b279-4caf-b8d1-c86a3c106f62', 'test_147', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 147, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(148, '007bbb9d-55b1-4f5e-80a5-bbcb22073db4', 'test_148', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 148, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(149, 'a1d22bbf-9afe-49da-b75d-b58f825db351', 'test_149', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 149, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(150, '8c2351d5-5460-4b2d-b1bb-7b086130090e', 'test_150', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 150, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(151, 'e6651896-66f8-4f63-b44f-71710fdb947c', 'test_151', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 151, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(152, 'caf04a3c-8f35-40a3-99b6-48ba6a05d8b8', 'test_152', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 152, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(153, 'd501e485-a306-4c9d-9baf-cc75f2321cfd', 'test_153', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 153, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(154, '57466d38-cae8-48bf-ac67-2cfc0266b5b0', 'test_154', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 154, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(155, '4bd5f059-f014-4356-8083-9c1a77adb6fd', 'test_155', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 155, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(156, '69130f52-f251-46fd-99ee-d646938e5f3f', 'test_156', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 156, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(157, 'dedfb4f0-a545-44b3-abba-dd77103db894', 'test_157', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 157, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(158, 'b5d98a8b-3780-4ace-ace1-ac12829dc469', 'test_158', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 158, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(159, '17de2f08-37fe-469d-b7b1-0e9ea9c6d2d8', 'test_159', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 159, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(160, '313abc40-4c88-45df-89e7-bd7bbf97b0fd', 'test_160', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 160, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(161, 'c5d7fc06-16fc-4711-be37-27bbf2c2c07c', 'test_161', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 161, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(162, 'ca31bf4d-f5da-4fc4-ae36-fd3cc0d35d7f', 'test_162', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 162, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(163, 'dc98bb8e-4b91-4915-86fb-476c9503a936', 'test_163', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 163, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(164, '79dd006c-0e4c-4a79-8600-ef8a0ae5bc04', 'test_164', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 164, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(165, '05cdc1f7-7787-43d6-80c6-588277fefb9b', 'test_165', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 165, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(166, 'dcdeb139-71ab-44f5-a709-ab33fec49882', 'test_166', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 166, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(167, '35a98804-b05e-47b0-917b-d72a4d4a5240', 'test_167', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 167, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(168, '5e4d4351-82c7-438d-8f83-ee2b7ebe1fe3', 'test_168', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 168, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(169, 'e1a205e2-f202-402d-8542-4cfc529ef514', 'test_169', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 169, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(170, 'a2e6271e-5b30-42d1-a211-494b98832676', 'test_170', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 170, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(171, '68515954-75ea-4022-9581-4cb4d28c6d6d', 'test_171', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 171, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(172, '41663b84-06b5-4787-a49e-1f745ca1eab3', 'test_172', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 172, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(173, 'b257f456-bdae-4c58-8519-756abbda462a', 'test_173', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 173, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(174, 'd848b9cb-05e4-4dcf-b9b7-431d83c41810', 'test_174', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 174, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(175, 'b6859250-dcca-47ef-b013-f609468d2389', 'test_175', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 175, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(176, 'e18bc682-897b-4696-a5ef-eee37a52a3de', 'test_176', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 176, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(177, '6b00471d-f496-4335-8209-5a9e13d18b9e', 'test_177', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 177, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(178, '35664644-7b32-4503-86f4-76adbb57762c', 'test_178', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 178, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(179, '7890415f-6563-4f25-bdf3-a5f45159a1b1', 'test_179', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 179, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(180, 'a1edf880-e270-4dac-b69f-73e61c517397', 'test_180', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 180, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(181, '73520029-5901-4022-b9da-38ccd73fe799', 'test_181', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 181, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(182, 'de5825a3-c585-45b3-88a1-7e5e80686826', 'test_182', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 182, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(183, 'bb50b80a-f471-4f64-85fb-4e5051708a4a', 'test_183', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 183, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(184, 'b7aa98b9-30da-468c-8566-06a5b804c4b9', 'test_184', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 184, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(185, 'c230e253-f874-4365-8b0e-7ba5ebc1cc26', 'test_185', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 185, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(186, '7593dbbf-9286-460b-a234-32b560817f60', 'test_186', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 186, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(187, 'ee1e2ce5-da23-4576-84e3-ad7cf4e0ce26', 'test_187', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 187, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(188, 'bf1cc1be-f405-4282-b7be-9a4578670046', 'test_188', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 188, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(189, 'e5ed670a-f944-40f0-8c10-d41c3350ead5', 'test_189', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 189, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(190, '8370db5c-e196-451a-9f5f-9b99c570cf46', 'test_190', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 190, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(191, '81498342-d247-4a60-80de-2c4cb4b1a84d', 'test_191', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 191, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(192, '213f1b3c-516e-4a6f-9785-d8c85d32f83e', 'test_192', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 192, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(193, '08ba27e6-b1b5-4d9e-a64a-6b5bc538bf43', 'test_193', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 193, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(194, 'cf0cfa8e-377c-44a0-a6d1-a74ce1de08fb', 'test_194', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 194, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(195, '2ea66412-8dc2-4081-8d48-e3637ca82604', 'test_195', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 195, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(196, '4ed466eb-ee51-4433-9d0f-3a56216698a2', 'test_196', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 196, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(197, 'cc03fc51-097d-43d6-bb6c-a0df72ec4838', 'test_197', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 197, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(198, '11844e66-8146-4263-aaa6-1fde7e5cfc58', 'test_198', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 198, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(199, 'b5a954c6-69a9-473c-a4c4-83c4f7a88c1c', 'test_199', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 199, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(200, '167e359e-7833-4ce2-9f8b-f035cee39505', 'test_200', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 200, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(201, '5afb5430-a023-4a50-aa92-b134a0fb68b3', 'test_201', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 201, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(202, 'de17b155-307c-4f9b-81f3-7f8b73d2526a', 'test_202', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 202, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(203, 'c966145b-ac05-4a2c-874d-f7b585d1d03b', 'test_203', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 203, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(204, '1d88ea5a-ab5f-40b1-bd48-f18f86eef5d9', 'test_204', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 204, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(205, '6cb0be93-7829-4bfc-ba4a-4d2cdff45447', 'test_205', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 205, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(206, 'e31a2ca7-fcaa-4b98-aac9-7e78f8605851', 'test_206', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 206, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(207, 'f26899b7-64e0-4c16-9134-cef3774f1614', 'test_207', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 207, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(208, '606cf6ab-6b5e-45d1-83b8-e535b197d2f0', 'test_208', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 208, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(209, '617bfc4e-17b1-4ca7-b736-58a74c267747', 'test_209', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 209, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(210, 'e5c26b7a-17bd-47ce-aac8-1430c57b8152', 'test_210', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 210, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(211, '7747bff5-b1e5-49b9-9a87-f93a5b790df0', 'test_211', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 211, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(212, 'c6e5b631-1e91-4ecd-8358-214eec07a91d', 'test_212', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 212, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(213, 'a874c7bd-97ac-4f48-bda5-7d3305d9067d', 'test_213', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 213, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(214, 'c7938cc2-8032-424b-8f49-85558f95364b', 'test_214', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 214, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(215, '46017ce9-d4dd-4ddc-8b73-d596e23d25ad', 'test_215', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 215, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(216, 'd5e66fd2-232e-476d-8de0-2bc1eb59630d', 'test_216', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 216, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(217, '097dc614-bc56-4f5f-a190-3ca1716a6400', 'test_217', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 217, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(218, 'a3b97132-067f-4839-9b99-830a7fb659d4', 'test_218', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 218, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(219, '8d35557f-7451-4c54-bb17-9c3d204c48d3', 'test_219', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 219, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(220, 'a6fba1ff-a5d7-4907-8cd4-1caa27cad85d', 'test_220', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 220, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(221, '427feb36-4401-4971-83de-f93672c028aa', 'test_221', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 221, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(222, '66541083-b1ab-4966-9f8b-8a1109fce0e0', 'test_222', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 222, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(223, '9939c37c-a9b9-43b7-9a4b-aacc470d47c4', 'test_223', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 223, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(224, '754379a0-bdc2-4a2d-9828-9480926b30ad', 'test_224', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 224, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(225, '18c870a1-9e2c-48fb-8a52-259e55e2052e', 'test_225', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 225, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(226, '02df9a97-b44c-4c46-ab3a-c11010d45e18', 'test_226', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 226, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(227, '20f609f7-c128-46b5-abeb-d16d46aab9ad', 'test_227', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 227, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(228, '75067ca5-872c-4149-85ad-f6685f14efc0', 'test_228', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 228, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(229, 'b8639303-d15f-4c81-b9d2-2863f53737c3', 'test_229', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 229, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(230, 'a0c4d9ea-7659-4009-ac7c-a3f089def76d', 'test_230', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 230, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(231, 'd3605113-fb9a-4640-b6fe-9931594eba6c', 'test_231', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 231, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(232, 'bf59d2cc-dd79-4ad6-9637-b04098768600', 'test_232', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 232, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(233, '304d5f24-274e-4fd6-aca4-97b761d1bd0c', 'test_233', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 233, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(234, '0d9491c3-c28b-4c11-8e28-14d93e612e35', 'test_234', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 234, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(235, 'f73a809f-78a6-4214-8060-d6037fe391aa', 'test_235', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 235, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(236, '11cc494a-86a4-44d2-b5fd-06438f95d6a4', 'test_236', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 236, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(237, '55b2e8cc-aaa4-4a8b-8a83-f732188cfab2', 'test_237', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 237, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(238, 'ebe14f0a-7bf7-4614-83c8-1e2da963139a', 'test_238', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 238, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(239, '3e83b092-95a1-4ee4-ac1f-e9df2f3954ad', 'test_239', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 239, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(240, '7304efcc-7974-453e-b2db-fdcc848f8a24', 'test_240', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 240, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(241, '6b0b51e8-f058-42a6-a9ed-3b6ebde935d8', 'test_241', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 241, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(242, 'c10f6de1-a64d-4f8f-bd0a-47bcd72ab8f7', 'test_242', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 242, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(243, '5537408c-41c6-4ee5-8f59-ca70fcdbd0ae', 'test_243', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 243, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(244, '0a920520-e271-42a6-8dc1-89f090023c89', 'test_244', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 244, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(245, 'a5120b27-cdd5-4209-b3da-bdf4b53db140', 'test_245', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 245, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(246, 'cd0f900a-dab8-4a49-805d-97e57cb5ad4c', 'test_246', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 246, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(247, '53b8b68c-0a11-411a-9b4d-01d58c9c0ff0', 'test_247', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 247, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(248, '57114ddf-7bb8-4e68-952a-faa83bf276bf', 'test_248', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 248, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(249, 'fa04c6fe-1bf0-489e-b0df-9fa4756bb90b', 'test_249', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 249, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(250, '5bf5b365-962e-4f6d-9576-94d5ac66cc3c', 'test_250', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 250, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(251, 'eca96575-798c-4919-ba93-4f0eca487490', 'test_251', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 251, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(252, 'd4e52ad1-ac1c-4f68-8d97-6858c8534f84', 'test_252', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 252, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(253, '74f88528-b57b-4482-a417-e7e8cf5ccd87', 'test_253', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 253, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(254, 'f1b969bd-2e43-4981-80d1-baeba6afd456', 'test_254', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 254, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(255, '11f5bcd3-096b-4b0f-8f1b-fa9292e3f5f3', 'test_255', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 255, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(256, 'b937e637-c00b-48de-8dd4-fae260cd9fb9', 'test_256', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 256, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(257, '49886ca5-c9a8-4c1f-9ef0-4784495e943c', 'test_257', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 257, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(258, '5cf6bbba-f2bf-4704-b288-36edb49a3c7a', 'test_258', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 258, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(259, '0a246675-78f2-47d3-a716-f9b85de0e885', 'test_259', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 259, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(260, 'b1e2509b-e9e4-40f8-b5c3-4e230e675ca8', 'test_260', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 260, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(261, 'c423ca4a-54b4-40f3-859d-d39f7d4cf266', 'test_261', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 261, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(262, '1452d005-8038-4092-ba0d-bd690dfdb2e2', 'test_262', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 262, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(263, 'f39a1721-6aeb-4f1e-90be-f54684ece8f0', 'test_263', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 263, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(264, 'ec2b02db-6eb2-4b9e-aa3b-ef53b6daf005', 'test_264', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 264, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(265, 'a6809581-e7b7-4d70-bfdd-c1f302322ee3', 'test_265', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 265, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(266, '794e2ba9-518d-4494-8ef0-01669807e10a', 'test_266', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 266, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(267, 'c258f48e-7f30-4c16-bd2d-6eed81529157', 'test_267', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 267, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(268, 'b7501b84-3a14-44d7-97da-271c416cbd16', 'test_268', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 268, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(269, '88b529d5-7804-4c4d-9f35-aa7dd1df0a37', 'test_269', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 269, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(270, '0c1b65d3-dee3-4429-864f-115fbbc6a2f4', 'test_270', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 270, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(271, '01667b0f-b397-47c1-8cdb-adb3ea7cba06', 'test_271', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 271, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(272, 'c8909fda-0453-4f74-a683-bd613fdc70c5', 'test_272', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 272, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(273, '796b8703-6f42-433f-b9e6-b115b4df25b0', 'test_273', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 273, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(274, 'de8f11f6-7298-4633-ad38-cc94e03314fd', 'test_274', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 274, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(275, 'e097f4e6-9c2d-4f35-912e-bd37f5cdec00', 'test_275', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 275, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(276, '3e0dab1e-c41f-4c0d-b2e3-d056ba6a3c60', 'test_276', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 276, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(277, 'b24cb998-40b7-471c-b55a-48b58b98b2e5', 'test_277', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 277, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(278, 'ab2113f4-56a2-4d1d-83a6-a54a763e371e', 'test_278', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 278, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(279, '2a2beb83-ccbf-413f-ade2-2fd2f79e5f49', 'test_279', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 279, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(280, 'ac53405d-8813-4cf7-ac12-fad7629d5602', 'test_280', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 280, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(281, 'b6c7b0e1-38b5-4e00-a22d-45c03d5fdeac', 'test_281', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 281, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(282, '8e41ff90-42f5-4736-89a6-24246917555c', 'test_282', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 282, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(283, '2b46023a-316f-41ae-955e-01185d67d7a5', 'test_283', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 283, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(284, '74c72c06-391e-4c72-92e7-92a5b75ac2da', 'test_284', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 284, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(285, '3e1246c2-96f9-4937-be0c-eb187822c3c7', 'test_285', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 285, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(286, '7f0e0193-b743-4394-b3e5-86e01813c094', 'test_286', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 286, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(287, '886cd06c-c30a-48df-b793-be4bfa2c1eb9', 'test_287', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 287, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(288, 'cb7cf6cd-bd2e-4956-be86-5d5935417098', 'test_288', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 288, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(289, 'd2e92f17-c26b-44dd-9c60-ca69b0f55b6d', 'test_289', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 289, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(290, 'ea3a53a1-b451-4d7b-9b9f-2b6790de314d', 'test_290', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 290, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(291, '723f2b0d-3473-445c-a6f2-9c8bb12b6019', 'test_291', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 291, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(292, '8f04e723-bb30-4952-a8f5-214845e525dc', 'test_292', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 292, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(293, '56e1991e-47e1-4136-9bd0-cd94fa40b3c8', 'test_293', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 293, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(294, 'b5ef5b82-483e-4331-ba84-78ece1f72602', 'test_294', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 294, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(295, '8238ae4e-5f13-42a3-9d6c-ea60f0ee64a1', 'test_295', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 295, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(296, '800a6a1d-1f63-4052-a14a-fcb56ab7e98b', 'test_296', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 296, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(297, '2eb884c0-8953-434d-898f-a162ffd44102', 'test_297', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 297, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(298, '06363941-bac6-4cc1-b56f-82d9d64d7c12', 'test_298', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 298, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(299, 'd8468131-79a2-4003-bf0a-e034a3455af9', 'test_299', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 299, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(300, 'e8e5f9d3-4473-46d9-b893-a195d5ccc6b4', 'test_300', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 300, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(301, '57db1144-49b7-4930-a214-9bba56c0eab6', 'test_301', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 301, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(302, '668a6ec5-142f-467d-891a-57fe10faf4bb', 'test_302', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 302, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(303, '9bcd9772-6c90-4c14-8ff4-16fa54744c87', 'test_303', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 303, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(304, '6c37ac4e-5213-4d60-8070-fadf3fa3ca38', 'test_304', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 304, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(305, 'fb5d7ea0-249f-4a0e-97aa-caa015d148e4', 'test_305', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 305, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(306, '26035205-595c-433a-8aba-4e0d6ce103a3', 'test_306', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 306, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(307, '1e4a6346-9da9-417c-bfbf-1a3cded61e12', 'test_307', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 307, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(308, '3af98cba-0cd4-4ea1-bcdc-c4c91672f038', 'test_308', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 308, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(309, 'a073f7ce-dfdc-424c-b4d0-bec7acaae445', 'test_309', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 309, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(310, '6524988e-5916-4410-a740-58d1e57d3f93', 'test_310', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 310, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(311, '58a190c4-789e-4c97-9fbb-245d3a58c8fe', 'test_311', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 311, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(312, '3244773f-b74b-461d-bf9a-916a05980c99', 'test_312', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 312, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(313, 'aaed5fa8-6555-43d2-adf4-c672008f8c92', 'test_313', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 313, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(314, 'f32415ac-f0fb-4815-bbef-27ba6115a1cc', 'test_314', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 314, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(315, '2030b697-b729-40c4-91b1-592e19fd4e73', 'test_315', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 315, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(316, 'ee47b98e-ebd5-44ae-8c9a-cbec609415b0', 'test_316', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 316, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(317, 'a47459c2-a709-4601-9151-cb57ae13bc8c', 'test_317', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 317, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(318, '5e274495-2c02-4f75-9ce2-c730e2686be9', 'test_318', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 318, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(319, 'f5f04ca8-f693-4758-9aa6-9a3c55938937', 'test_319', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 319, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(320, '5f876faf-2ad7-41f3-906d-2edd9fd2907d', 'test_320', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 320, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(321, '3d0665c6-db74-4d48-91cc-ebe39bbae605', 'test_321', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 321, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(322, '86c19bce-cb25-47a4-8aba-29c8ad4fc87d', 'test_322', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 322, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(323, 'efa06619-2301-4cb4-b9fa-6e9bddef94d7', 'test_323', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 323, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(324, '3cfc5976-aa7f-4281-8b43-6ea6eee1ac80', 'test_324', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 324, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(325, '19a56d56-1f57-45e6-9c2e-466a17d8c7ba', 'test_325', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 325, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(326, '026a45cf-cbeb-4ea9-8d20-21efbe206bad', 'test_326', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 326, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(327, '48312cae-f61d-4f87-9b20-a957d1e919ce', 'test_327', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 327, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(328, 'e06abc58-f451-4e9e-ac4f-51d5e9d424a6', 'test_328', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 328, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(329, '10b58273-4b30-4caf-954c-a1873ca4d6b5', 'test_329', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 329, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(330, '008892b7-6479-4e68-adf2-39e7ac29e66e', 'test_330', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 330, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(331, '7f864422-153c-4681-8c9e-4e942dce9548', 'test_331', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 331, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(332, '67c5538e-0363-4650-a42e-ba25746b4239', 'test_332', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 332, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(333, '208210c1-1601-47ae-883f-cdb16e0f802b', 'test_333', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 333, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(334, 'bb08395a-a0f0-490d-9d23-6f2f76b41514', 'test_334', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 334, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(335, '050c1a8e-256d-41ab-bd3a-3abe54d01b32', 'test_335', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 335, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(336, 'cf016005-9207-4a2d-a8fe-91c278029a18', 'test_336', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 336, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(337, '950a5d40-e604-4f6c-82dd-2b60a578d9aa', 'test_337', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 337, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(338, '3e00662d-6917-4759-b9a9-be8eda02f63b', 'test_338', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 338, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(339, 'bb339af3-2038-4f17-b489-46d4b7542cb6', 'test_339', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 339, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(340, '3927f6d5-5d90-4192-b84c-cebda90c0b0a', 'test_340', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 340, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(341, 'e6b29f71-bb4a-420b-8442-1f7639109465', 'test_341', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 341, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(342, 'ff7909b6-a90c-43c7-96fc-c375d439e373', 'test_342', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 342, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(343, '6f9902ca-7674-4f2f-b2e1-aeb3701bae14', 'test_343', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 343, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(344, '36d75eda-7573-474a-8aeb-f8555464154f', 'test_344', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 344, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(345, 'd3c489ae-3f03-48fe-9248-927a8bb3297f', 'test_345', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 345, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(346, '18764a4e-8b01-478e-80b3-217cc37d49c7', 'test_346', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 346, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+(347, '00075d1c-f486-41a0-98f8-06f0354b8416', 'test_347', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 347, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true);
 
 INSERT into iam_account_authority(account_id, authority_id) VALUES
 (100,2),
diff --git a/iam-persistence/src/main/resources/db/migration/test/V3_1___duplicate_email_user.sql b/iam-persistence/src/main/resources/db/migration/test/V3_1___duplicate_email_user.sql
index b7535d982..3649750bf 100644
--- a/iam-persistence/src/main/resources/db/migration/test/V3_1___duplicate_email_user.sql
+++ b/iam-persistence/src/main/resources/db/migration/test/V3_1___duplicate_email_user.sql
@@ -1,20 +1,20 @@
 INSERT INTO iam_user_info(ID,GIVENNAME,FAMILYNAME, EMAIL, EMAILVERIFIED, BIRTHDATE, GENDER) VALUES
 (3, 'Duplicate', 'Email 0', 'admin@iam.test', true, '1950-01-01', 'M');
 
-INSERT INTO iam_account(id, uuid, username, password, user_info_id, creationtime, lastupdatetime, active, totp_mfa_id) VALUES
+INSERT INTO iam_account(id, uuid, username, password, user_info_id, creationtime, lastupdatetime, active) VALUES
 (3, 'bffc67b7-47fe-410c-a6a0-cf00173a8fbb', 'dup_email_0', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 
-3, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null);
+3, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true);
 
 INSERT INTO iam_user_info(ID,GIVENNAME,FAMILYNAME, EMAIL, EMAILVERIFIED, BIRTHDATE, GENDER) VALUES
 (4, 'Duplicate ', 'Email 1', 'duplicate@iam.test', true, '1950-01-01', 'M');
 
-INSERT INTO iam_account(id, uuid, username, password, user_info_id, creationtime, lastupdatetime, active, totp_mfa_id) VALUES
+INSERT INTO iam_account(id, uuid, username, password, user_info_id, creationtime, lastupdatetime, active) VALUES
 (4, '0a6fa72a-fb75-4a6c-9734-bfe673df70b3', 'dup_email_1', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 
-4, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null);
+4, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true);
 
 INSERT INTO iam_user_info(ID,GIVENNAME,FAMILYNAME, EMAIL, EMAILVERIFIED, BIRTHDATE, GENDER) VALUES
 (5, 'Duplicate ', 'Email 2', 'duplicate@iam.test', true, '1950-01-01', 'M');
 
-INSERT INTO iam_account(id, uuid, username, password, user_info_id, creationtime, lastupdatetime, active, totp_mfa_id) VALUES
+INSERT INTO iam_account(id, uuid, username, password, user_info_id, creationtime, lastupdatetime, active) VALUES
 (5, 'd836e5ec-246c-456c-8476-923ee2f831c8', 'dup_email_2', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 
-5, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null);
\ No newline at end of file
+5, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true);
\ No newline at end of file
diff --git a/iam-persistence/src/main/resources/db/migration/test/V3__basic_configuration.sql b/iam-persistence/src/main/resources/db/migration/test/V3__basic_configuration.sql
index b06d0ff05..4592cc377 100644
--- a/iam-persistence/src/main/resources/db/migration/test/V3__basic_configuration.sql
+++ b/iam-persistence/src/main/resources/db/migration/test/V3__basic_configuration.sql
@@ -7,8 +7,8 @@ INSERT INTO iam_authority(ID, AUTH) VALUES
 INSERT INTO iam_user_info(ID,GIVENNAME,FAMILYNAME, EMAIL, EMAILVERIFIED, BIRTHDATE, PICTURE, GENDER) VALUES
 (1, 'Admin', 'User', 'admin@iam.test', true, '1950-01-01', null, 'M');
 
-INSERT INTO iam_account(id, uuid, username, password, user_info_id, creationtime, lastupdatetime, active, totp_mfa_id) VALUES
-(1, '73f16d93-2441-4a50-88ff-85360d78c6b5', 'admin', 'password', 1, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true, null);
+INSERT INTO iam_account(id, uuid, username, password, user_info_id, creationtime, lastupdatetime, active) VALUES
+(1, '73f16d93-2441-4a50-88ff-85360d78c6b5', 'admin', 'password', 1, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true);
 
 INSERT INTO iam_oidc_id(issuer, subject, account_id) VALUES
 ('https://accounts.google.com', '114132403455520317223', 1);
diff --git a/iam-test-protected-resource/.factorypath b/iam-test-protected-resource/.factorypath
deleted file mode 100644
index b7d292531..000000000
--- a/iam-test-protected-resource/.factorypath
+++ /dev/null
@@ -1,66 +0,0 @@
-
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-

From dea8ff5271d3132456370a39674648ab408f45f5 Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Tue, 30 Nov 2021 16:25:06 +0000
Subject: [PATCH 31/76] Adding tests for enabling and disabling TOTP MFA
 through IamAccountService

---
 .../core/user/DefaultIamAccountService.java   |   8 +-
 .../MfaSecretAlreadyBoundException.java       |   2 +-
 .../TotpMfaAlreadyEnabledException.java       |  28 +++++
 .../service/IamAccountServiceTestSupport.java | 109 +++++++++++++----
 .../test/service/IamAccountServiceTests.java  | 115 +++++++++++++++++-
 iam-test-client/.gitignore                    |   3 +-
 6 files changed, 232 insertions(+), 33 deletions(-)
 create mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/TotpMfaAlreadyEnabledException.java

diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/DefaultIamAccountService.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/DefaultIamAccountService.java
index b01bc61fe..71129c18c 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/DefaultIamAccountService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/DefaultIamAccountService.java
@@ -23,6 +23,7 @@
 import static it.infn.mw.iam.core.lifecycle.ExpiredAccountsHandler.LIFECYCLE_STATUS_LABEL;
 import it.infn.mw.iam.core.user.exception.MfaSecretAlreadyBoundException;
 import it.infn.mw.iam.core.user.exception.MfaSecretNotFoundException;
+import it.infn.mw.iam.core.user.exception.TotpMfaAlreadyEnabledException;
 import it.infn.mw.iam.persistence.model.IamTotpMfa;
 import it.infn.mw.iam.persistence.model.IamTotpRecoveryCode;
 
@@ -612,9 +613,10 @@ public IamAccount addTotpMfaSecret(IamAccount account) {
 
   @Override
   public IamAccount enableTotpMfa(IamAccount account) {
-    if (!isNull(account.getTotpMfa()) && account.getTotpMfa().isActive()) {
-      throw new MfaSecretAlreadyBoundException(
-          "A multi-factor secret is already assigned to this account");
+    if (isNull(account.getTotpMfa())) {
+      throw new MfaSecretNotFoundException("No multi-factor secret is attached to this account");
+    } else if (!isNull(account.getTotpMfa()) && account.getTotpMfa().isActive()) {
+      throw new TotpMfaAlreadyEnabledException("TOTP MFA is already enabled on this account");
     }
 
     IamTotpMfa totpMfa = account.getTotpMfa();
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/MfaSecretAlreadyBoundException.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/MfaSecretAlreadyBoundException.java
index 9bd0fedcb..5d6078358 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/MfaSecretAlreadyBoundException.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/MfaSecretAlreadyBoundException.java
@@ -16,7 +16,7 @@
 package it.infn.mw.iam.core.user.exception;
 
 public class MfaSecretAlreadyBoundException extends IamAccountException {
-  
+
   /**
    * TODO assign serialVersionUID
    */
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/TotpMfaAlreadyEnabledException.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/TotpMfaAlreadyEnabledException.java
new file mode 100644
index 000000000..a44a50938
--- /dev/null
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/TotpMfaAlreadyEnabledException.java
@@ -0,0 +1,28 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.infn.mw.iam.core.user.exception;
+
+public class TotpMfaAlreadyEnabledException extends IamAccountException {
+
+  /**
+   * TODO assign serialVersionUID
+   */
+  // private static final long serialVersionUID = 4103663720620113509L;
+
+  public TotpMfaAlreadyEnabledException(String message) {
+    super(message);
+  }
+}
diff --git a/iam-login-service/src/test/java/it/infn/mw/iam/test/service/IamAccountServiceTestSupport.java b/iam-login-service/src/test/java/it/infn/mw/iam/test/service/IamAccountServiceTestSupport.java
index b8221a4c4..d32ca771d 100644
--- a/iam-login-service/src/test/java/it/infn/mw/iam/test/service/IamAccountServiceTestSupport.java
+++ b/iam-login-service/src/test/java/it/infn/mw/iam/test/service/IamAccountServiceTestSupport.java
@@ -15,11 +15,16 @@
  */
 package it.infn.mw.iam.test.service;
 
+import java.util.Arrays;
+import java.util.HashSet;
+
 import it.infn.mw.iam.persistence.model.IamAccount;
 import it.infn.mw.iam.persistence.model.IamAuthority;
 import it.infn.mw.iam.persistence.model.IamOidcId;
 import it.infn.mw.iam.persistence.model.IamSamlId;
 import it.infn.mw.iam.persistence.model.IamSshKey;
+import it.infn.mw.iam.persistence.model.IamTotpMfa;
+import it.infn.mw.iam.persistence.model.IamTotpRecoveryCode;
 import it.infn.mw.iam.persistence.model.IamX509Certificate;
 
 public class IamAccountServiceTestSupport {
@@ -38,38 +43,63 @@ public class IamAccountServiceTestSupport {
   public static final String CICCIO_GIVEN_NAME = "Ciccio";
   public static final String CICCIO_FAMILY_NAME = "Paglia";
 
+  public static final String TOTP_MFA_UUID = "b3e7dd7f-a1ac-eda0-371d-b902a6c5cee2";
+  public static final String TOTP_MFA_USERNAME = "totp";
+  public static final String TOTP_MFA_EMAIL = "totp@example.org";
+  public static final String TOTP_MFA_GIVEN_NAME = "Totp";
+  public static final String TOTP_MFA_FAMILY_NAME = "Mfa";
+
   public static final String TEST_SAML_ID_IDP_ID = "idpId";
   public static final String TEST_SAML_ID_USER_ID = "userId";
   public static final String TEST_SAML_ID_ATTRIBUTE_ID = "attributeId";
 
   public static final String TEST_OIDC_ID_ISSUER = "oidcIssuer";
   public static final String TEST_OIDC_ID_SUBJECT = "oidcSubject";
-  
+
   public static final String TEST_SSH_KEY_VALUE_1 = "ssh-key-value-1";
   public static final String TEST_SSH_KEY_VALUE_2 = "ssh-key-value-2";
-  
+
   public static final String TEST_X509_CERTIFICATE_VALUE_1 = "x509-cert-value-1";
   public static final String TEST_X509_CERTIFICATE_SUBJECT_1 = "x509-cert-subject-1";
   public static final String TEST_X509_CERTIFICATE_ISSUER_1 = "x509-cert-issuer-1";
   public static final String TEST_X509_CERTIFICATE_LABEL_1 = "x509-cert-label-1";
-  
+
   public static final String TEST_X509_CERTIFICATE_VALUE_2 = "x509-cert-value-2";
   public static final String TEST_X509_CERTIFICATE_SUBJECT_2 = "x509-cert-subject-2";
   public static final String TEST_X509_CERTIFICATE_ISSUER_2 = "x509-cert-issuer-2";
   public static final String TEST_X509_CERTIFICATE_LABEL_2 = "x509-cert-label-2";
-  
-  
+
+  public static final String TOTP_MFA_SECRET = "secret";
+
+  public static final String TOTP_RECOVERY_CODE_STRING_1 = "code-1";
+  public static final String TOTP_RECOVERY_CODE_STRING_2 = "code-2";
+  public static final String TOTP_RECOVERY_CODE_STRING_3 = "code-3";
+  public static final String TOTP_RECOVERY_CODE_STRING_4 = "code-4";
+  public static final String TOTP_RECOVERY_CODE_STRING_5 = "code-5";
+  public static final String TOTP_RECOVERY_CODE_STRING_6 = "code-6";
+
+
   protected final IamAccount TEST_ACCOUNT;
   protected final IamAccount CICCIO_ACCOUNT;
+  protected final IamAccount TOTP_MFA_ACCOUNT;
   protected final IamAuthority ROLE_USER_AUTHORITY;
   protected final IamSamlId TEST_SAML_ID;
   protected final IamOidcId TEST_OIDC_ID;
-  
+
   protected final IamSshKey TEST_SSH_KEY_1;
   protected final IamSshKey TEST_SSH_KEY_2;
   protected final IamX509Certificate TEST_X509_CERTIFICATE_1;
   protected final IamX509Certificate TEST_X509_CERTIFICATE_2;
 
+  protected final IamTotpMfa TOTP_MFA;
+
+  protected final IamTotpRecoveryCode TOTP_RECOVERY_CODE_1;
+  protected final IamTotpRecoveryCode TOTP_RECOVERY_CODE_2;
+  protected final IamTotpRecoveryCode TOTP_RECOVERY_CODE_3;
+  protected final IamTotpRecoveryCode TOTP_RECOVERY_CODE_4;
+  protected final IamTotpRecoveryCode TOTP_RECOVERY_CODE_5;
+  protected final IamTotpRecoveryCode TOTP_RECOVERY_CODE_6;
+
   public IamAccountServiceTestSupport() {
     TEST_ACCOUNT = IamAccount.newAccount();
     TEST_ACCOUNT.setUuid(TEST_UUID);
@@ -77,7 +107,7 @@ public IamAccountServiceTestSupport() {
     TEST_ACCOUNT.getUserInfo().setEmail(TEST_EMAIL);
     TEST_ACCOUNT.getUserInfo().setGivenName(TEST_GIVEN_NAME);
     TEST_ACCOUNT.getUserInfo().setFamilyName(TEST_FAMILY_NAME);
-    
+
     ROLE_USER_AUTHORITY = new IamAuthority("ROLE_USER");
 
     CICCIO_ACCOUNT = IamAccount.newAccount();
@@ -89,31 +119,57 @@ public IamAccountServiceTestSupport() {
 
     TEST_SAML_ID =
         new IamSamlId(TEST_SAML_ID_IDP_ID, TEST_SAML_ID_ATTRIBUTE_ID, TEST_SAML_ID_USER_ID);
-    
-    TEST_OIDC_ID = 
-        new IamOidcId(TEST_OIDC_ID_ISSUER, TEST_OIDC_ID_SUBJECT);
-    
-    TEST_SSH_KEY_1 = 
-        new IamSshKey(TEST_SSH_KEY_VALUE_1);
-
-    TEST_SSH_KEY_2 = 
-        new IamSshKey(TEST_SSH_KEY_VALUE_2);
-    
-    TEST_X509_CERTIFICATE_1 =
-        new IamX509Certificate();
-    
+
+    TEST_OIDC_ID = new IamOidcId(TEST_OIDC_ID_ISSUER, TEST_OIDC_ID_SUBJECT);
+
+    TEST_SSH_KEY_1 = new IamSshKey(TEST_SSH_KEY_VALUE_1);
+
+    TEST_SSH_KEY_2 = new IamSshKey(TEST_SSH_KEY_VALUE_2);
+
+    TEST_X509_CERTIFICATE_1 = new IamX509Certificate();
+
     TEST_X509_CERTIFICATE_1.setLabel(TEST_X509_CERTIFICATE_LABEL_1);
     TEST_X509_CERTIFICATE_1.setSubjectDn(TEST_X509_CERTIFICATE_SUBJECT_1);
     TEST_X509_CERTIFICATE_1.setIssuerDn(TEST_X509_CERTIFICATE_ISSUER_1);
     TEST_X509_CERTIFICATE_1.setCertificate(TEST_X509_CERTIFICATE_VALUE_1);
-    
-    TEST_X509_CERTIFICATE_2 =
-        new IamX509Certificate();
-    
+
+    TEST_X509_CERTIFICATE_2 = new IamX509Certificate();
+
     TEST_X509_CERTIFICATE_2.setLabel(TEST_X509_CERTIFICATE_LABEL_2);
     TEST_X509_CERTIFICATE_2.setSubjectDn(TEST_X509_CERTIFICATE_SUBJECT_2);
     TEST_X509_CERTIFICATE_2.setIssuerDn(TEST_X509_CERTIFICATE_ISSUER_2);
     TEST_X509_CERTIFICATE_2.setCertificate(TEST_X509_CERTIFICATE_VALUE_2);
+
+    TOTP_MFA = new IamTotpMfa();
+
+    TOTP_MFA.setSecret(TOTP_MFA_SECRET);
+    TOTP_MFA.setActive(true);
+
+    TOTP_RECOVERY_CODE_1 = new IamTotpRecoveryCode(TOTP_MFA);
+    TOTP_RECOVERY_CODE_2 = new IamTotpRecoveryCode(TOTP_MFA);
+    TOTP_RECOVERY_CODE_3 = new IamTotpRecoveryCode(TOTP_MFA);
+    TOTP_RECOVERY_CODE_4 = new IamTotpRecoveryCode(TOTP_MFA);
+    TOTP_RECOVERY_CODE_5 = new IamTotpRecoveryCode(TOTP_MFA);
+    TOTP_RECOVERY_CODE_6 = new IamTotpRecoveryCode(TOTP_MFA);
+
+    TOTP_RECOVERY_CODE_1.setCode(TOTP_RECOVERY_CODE_STRING_1);
+    TOTP_RECOVERY_CODE_2.setCode(TOTP_RECOVERY_CODE_STRING_2);
+    TOTP_RECOVERY_CODE_3.setCode(TOTP_RECOVERY_CODE_STRING_3);
+    TOTP_RECOVERY_CODE_4.setCode(TOTP_RECOVERY_CODE_STRING_4);
+    TOTP_RECOVERY_CODE_5.setCode(TOTP_RECOVERY_CODE_STRING_5);
+    TOTP_RECOVERY_CODE_6.setCode(TOTP_RECOVERY_CODE_STRING_6);
+
+    TOTP_MFA
+      .setRecoveryCodes(new HashSet<>(Arrays.asList(TOTP_RECOVERY_CODE_1, TOTP_RECOVERY_CODE_2,
+          TOTP_RECOVERY_CODE_3, TOTP_RECOVERY_CODE_4, TOTP_RECOVERY_CODE_5, TOTP_RECOVERY_CODE_6)));
+
+    TOTP_MFA_ACCOUNT = IamAccount.newAccount();
+    TOTP_MFA_ACCOUNT.setUuid(TOTP_MFA_UUID);
+    TOTP_MFA_ACCOUNT.setUsername(TOTP_MFA_USERNAME);
+    TOTP_MFA_ACCOUNT.getUserInfo().setEmail(TOTP_MFA_EMAIL);
+    TOTP_MFA_ACCOUNT.getUserInfo().setGivenName(TOTP_MFA_GIVEN_NAME);
+    TOTP_MFA_ACCOUNT.getUserInfo().setFamilyName(TOTP_MFA_FAMILY_NAME);
+    TOTP_MFA_ACCOUNT.setTotpMfa(TOTP_MFA);
   }
 
   public IamAccount cloneAccount(IamAccount account) {
@@ -123,9 +179,10 @@ public IamAccount cloneAccount(IamAccount account) {
     newAccount.getUserInfo().setEmail(account.getUserInfo().getEmail());
     newAccount.getUserInfo().setGivenName(account.getUserInfo().getGivenName());
     newAccount.getUserInfo().setFamilyName(account.getUserInfo().getFamilyName());
+    newAccount.setTotpMfa(account.getTotpMfa());
 
     return newAccount;
   }
- 
-  
+
+
 }
diff --git a/iam-login-service/src/test/java/it/infn/mw/iam/test/service/IamAccountServiceTests.java b/iam-login-service/src/test/java/it/infn/mw/iam/test/service/IamAccountServiceTests.java
index dc3cdeec8..13124ba67 100644
--- a/iam-login-service/src/test/java/it/infn/mw/iam/test/service/IamAccountServiceTests.java
+++ b/iam-login-service/src/test/java/it/infn/mw/iam/test/service/IamAccountServiceTests.java
@@ -27,6 +27,7 @@
 import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.assertTrue;
 import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyInt;
 import static org.mockito.ArgumentMatchers.anyString;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.times;
@@ -56,18 +57,27 @@
 import org.springframework.context.ApplicationEventPublisher;
 import org.springframework.security.crypto.password.PasswordEncoder;
 
+import dev.samstevens.totp.recovery.RecoveryCodeGenerator;
+import dev.samstevens.totp.secret.SecretGenerator;
+
 import com.google.common.collect.Sets;
 
 import it.infn.mw.iam.audit.events.account.AccountEndTimeUpdatedEvent;
+import it.infn.mw.iam.audit.events.account.multi_factor_authentication.AuthenticatorAppDisabledEvent;
+import it.infn.mw.iam.audit.events.account.multi_factor_authentication.AuthenticatorAppEnabledEvent;
 import it.infn.mw.iam.core.time.TimeProvider;
 import it.infn.mw.iam.core.user.DefaultIamAccountService;
 import it.infn.mw.iam.core.user.exception.CredentialAlreadyBoundException;
 import it.infn.mw.iam.core.user.exception.InvalidCredentialException;
+import it.infn.mw.iam.core.user.exception.MfaSecretAlreadyBoundException;
+import it.infn.mw.iam.core.user.exception.MfaSecretNotFoundException;
+import it.infn.mw.iam.core.user.exception.TotpMfaAlreadyEnabledException;
 import it.infn.mw.iam.core.user.exception.UserAlreadyExistsException;
 import it.infn.mw.iam.persistence.model.IamAccount;
 import it.infn.mw.iam.persistence.model.IamOidcId;
 import it.infn.mw.iam.persistence.model.IamSamlId;
 import it.infn.mw.iam.persistence.model.IamSshKey;
+import it.infn.mw.iam.persistence.model.IamTotpMfa;
 import it.infn.mw.iam.persistence.model.IamX509Certificate;
 import it.infn.mw.iam.persistence.repository.IamAccountRepository;
 import it.infn.mw.iam.persistence.repository.IamAuthoritiesRepository;
@@ -99,6 +109,12 @@ public class IamAccountServiceTests extends IamAccountServiceTestSupport {
   @Mock
   private OAuth2TokenEntityService tokenService;
 
+  @Mock
+  private SecretGenerator secretGenerator;
+
+  @Mock
+  private RecoveryCodeGenerator recoveryCodeGenerator;
+
   private Clock clock = Clock.fixed(NOW, ZoneId.systemDefault());
 
   private DefaultIamAccountService accountService;
@@ -122,9 +138,13 @@ public void setup() {
     when(authoritiesRepo.findByAuthority(anyString())).thenReturn(Optional.empty());
     when(authoritiesRepo.findByAuthority("ROLE_USER")).thenReturn(Optional.of(ROLE_USER_AUTHORITY));
     when(passwordEncoder.encode(any())).thenReturn(PASSWORD);
+    when(secretGenerator.generate()).thenReturn("test_secret");
+
+    String[] testArray = {"test_code"};
+    when(recoveryCodeGenerator.generateCodes(anyInt())).thenReturn(testArray);
 
     accountService = new DefaultIamAccountService(clock, accountRepo, groupRepo, authoritiesRepo,
-        passwordEncoder, eventPublisher, tokenService);
+        passwordEncoder, eventPublisher, tokenService, secretGenerator, recoveryCodeGenerator);
   }
 
   @Test(expected = NullPointerException.class)
@@ -839,4 +859,97 @@ public void testSetEndTimeWorksForNonNullDate() {
     assertThat(e.getAccount().getEndTime(), is(newEndTime));
   }
 
+  @Test
+  public void testAssignsTotpMfaToAccount() {
+    IamAccount account = cloneAccount(TEST_ACCOUNT);
+    accountService.addTotpMfaSecret(account);
+    verify(accountRepo, times(1)).save(TEST_ACCOUNT);
+    verify(secretGenerator, times(1)).generate();
+    verify(recoveryCodeGenerator, times(1)).generateCodes(anyInt());
+
+    assertNotNull(account.getTotpMfa());
+  }
+
+  @Test(expected = MfaSecretAlreadyBoundException.class)
+  public void testAddMfaSecret_whenMfaSecretAssignedFails() {
+    IamAccount account = cloneAccount(TOTP_MFA_ACCOUNT);
+
+    try {
+      accountService.addTotpMfaSecret(account);
+    } catch (MfaSecretAlreadyBoundException e) {
+      assertThat(e.getMessage(),
+          equalTo("A multi-factor secret is already assigned to this account"));
+      throw e;
+    }
+  }
+
+  @Test
+  public void testEnablesTotpMfa() {
+    IamAccount account = cloneAccount(TEST_ACCOUNT);
+    IamTotpMfa totpMfa = new IamTotpMfa(account);
+    totpMfa.setSecret("secret");
+    totpMfa.setActive(false);
+    account.setTotpMfa(totpMfa);
+
+    accountService.enableTotpMfa(account);
+    verify(accountRepo, times(1)).save(TEST_ACCOUNT);
+    verify(eventPublisher, times(1)).publishEvent(eventCaptor.capture());
+
+    ApplicationEvent event = eventCaptor.getValue();
+    assertThat(event, instanceOf(AuthenticatorAppEnabledEvent.class));
+
+    AuthenticatorAppEnabledEvent e = (AuthenticatorAppEnabledEvent) event;
+    assertTrue(e.getAccount().getTotpMfa().isActive());
+  }
+
+  @Test(expected = TotpMfaAlreadyEnabledException.class)
+  public void testEnableTotpMfa_whenTotpMfaEnabledFails() {
+    IamAccount account = cloneAccount(TOTP_MFA_ACCOUNT);
+
+    try {
+      accountService.enableTotpMfa(account);
+    } catch (TotpMfaAlreadyEnabledException e) {
+      assertThat(e.getMessage(), equalTo("TOTP MFA is already enabled on this account"));
+      throw e;
+    }
+  }
+
+  @Test(expected = MfaSecretNotFoundException.class)
+  public void testEnablesTotpMfa_whenNoMfaSecretAssignedFails() {
+    IamAccount account = cloneAccount(TEST_ACCOUNT);
+
+    try {
+      accountService.enableTotpMfa(account);
+    } catch (MfaSecretNotFoundException e) {
+      assertThat(e.getMessage(), equalTo("No multi-factor secret is attached to this account"));
+      throw e;
+    }
+  }
+
+  @Test
+  public void testDisablesTotpMfa() {
+    IamAccount account = cloneAccount(TOTP_MFA_ACCOUNT);
+
+    accountService.disableTotpMfa(account);
+    verify(accountRepo, times(1)).save(TOTP_MFA_ACCOUNT);
+    verify(eventPublisher, times(1)).publishEvent(eventCaptor.capture());
+
+    ApplicationEvent event = eventCaptor.getValue();
+    assertThat(event, instanceOf(AuthenticatorAppDisabledEvent.class));
+
+    AuthenticatorAppDisabledEvent e = (AuthenticatorAppDisabledEvent) event;
+    assertThat(e.getAccount().getTotpMfa(), nullValue());
+  }
+
+  @Test(expected = MfaSecretNotFoundException.class)
+  public void testDisablesTotpMfa_whenNoMfaSecretAssignedFails() {
+    IamAccount account = cloneAccount(TEST_ACCOUNT);
+
+    try {
+      accountService.disableTotpMfa(account);
+    } catch (MfaSecretNotFoundException e) {
+      assertThat(e.getMessage(), equalTo("No multi-factor secret is attached to this account"));
+      throw e;
+    }
+  }
 }
diff --git a/iam-test-client/.gitignore b/iam-test-client/.gitignore
index a8c4c132a..c75fc1032 100644
--- a/iam-test-client/.gitignore
+++ b/iam-test-client/.gitignore
@@ -1,3 +1,2 @@
 /.apt_generated/
-/target/
-.factorypath
+/target/
\ No newline at end of file

From b7943272135b5ce4fcada476244bdf3eb6a56a63 Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Wed, 1 Dec 2021 14:48:52 +0000
Subject: [PATCH 32/76] Adding tests for MFA settings and auth app controllers

---
 .../MultiFactorSettingsController.java        |   4 +-
 .../AuthenticatorAppController.java           |  16 +-
 .../config/security/IamApiSecurityConfig.java |   1 -
 .../controllers/user-mfa.controller.js        |   2 +-
 .../services/authenticator-app.service.js     |  44 +-
 .../MultiFactorSettingsTests.java             | 128 ++++++
 .../AuthenticatorAppTests.java                | 426 ++++++++++++++++++
 7 files changed, 590 insertions(+), 31 deletions(-)
 create mode 100644 iam-login-service/src/test/java/it/infn/mw/iam/test/api/account/multi_factor_authentication/MultiFactorSettingsTests.java
 create mode 100644 iam-login-service/src/test/java/it/infn/mw/iam/test/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppTests.java

diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/MultiFactorSettingsController.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/MultiFactorSettingsController.java
index eaa17bf4f..39ab51a15 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/MultiFactorSettingsController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/MultiFactorSettingsController.java
@@ -32,9 +32,9 @@
 
 @SuppressWarnings("deprecation")
 @Controller
-@RequestMapping("iam/multi-factor-settings")
 public class MultiFactorSettingsController {
 
+  public static final String BASE_URL = "/iam/multi-factor-settings";
   final IamAccountRepository accountRepository;
 
   @Autowired
@@ -43,7 +43,7 @@ public MultiFactorSettingsController(IamAccountRepository accountRepository) {
   }
 
   @PreAuthorize("hasRole('USER')")
-  @RequestMapping(value = "/get-settings", method = RequestMethod.GET,
+  @RequestMapping(value = BASE_URL, method = RequestMethod.GET,
       produces = MediaType.APPLICATION_JSON_VALUE)
   @ResponseBody
   public MultiFactorSettingsDTO getMultiFactorSettings() {
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppController.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppController.java
index 3673335a2..2f651920b 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppController.java
@@ -29,6 +29,7 @@
 import org.springframework.stereotype.Controller;
 import org.springframework.validation.BindingResult;
 import org.springframework.web.bind.annotation.ExceptionHandler;
+import org.springframework.web.bind.annotation.ModelAttribute;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RequestMethod;
 import org.springframework.web.bind.annotation.ResponseBody;
@@ -50,9 +51,13 @@
 
 @SuppressWarnings("deprecation")
 @Controller
-@RequestMapping("/iam/authenticator-app")
 public class AuthenticatorAppController {
 
+  public static final String BASE_URL = "/iam/authenticator-app";
+  public static final String ADD_SECRET_URL = BASE_URL + "/add-secret";
+  public static final String ENABLE_URL = BASE_URL + "/enable";
+  public static final String DISABLE_URL = BASE_URL + "/disable";
+
   final IamAccountService service;
   final IamAccountRepository accountRepository;
   private QrGenerator qrGenerator;
@@ -68,7 +73,7 @@ public AuthenticatorAppController(IamAccountService service,
   }
 
   @PreAuthorize("hasRole('USER')")
-  @RequestMapping(value = "/add-secret", method = RequestMethod.GET,
+  @RequestMapping(value = ADD_SECRET_URL, method = RequestMethod.PUT,
       produces = MediaType.APPLICATION_JSON_VALUE)
   @ResponseBody
   public SecretAndDataUriDTO addSecret() {
@@ -91,10 +96,11 @@ public SecretAndDataUriDTO addSecret() {
 
   // TODO switch to this post method from get request, post method not currently working
   @PreAuthorize("hasRole('USER')")
-  @RequestMapping(value = "/enable", method = RequestMethod.POST,
+  @RequestMapping(value = ENABLE_URL, method = RequestMethod.POST,
       produces = MediaType.TEXT_PLAIN_VALUE)
   @ResponseBody
-  public void enableAuthenticatorApp(@Valid CodeDTO code, BindingResult validationResult) {
+  public void enableAuthenticatorApp(@ModelAttribute @Valid CodeDTO code,
+      BindingResult validationResult) {
     if (validationResult.hasErrors()) {
       throw new InvalidCodeError("Invalid code format. Code must be six numeric characters");
     }
@@ -111,7 +117,7 @@ public void enableAuthenticatorApp(@Valid CodeDTO code, BindingResult validation
   }
 
   @PreAuthorize("hasRole('USER')")
-  @RequestMapping(value = "/disable", method = RequestMethod.POST,
+  @RequestMapping(value = DISABLE_URL, method = RequestMethod.POST,
       produces = MediaType.TEXT_PLAIN_VALUE)
   @ResponseBody
   public void disableAuthenticatorApp(@Valid CodeDTO code, BindingResult validationResult) {
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamApiSecurityConfig.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamApiSecurityConfig.java
index 91b93acb1..4fa7c1c3b 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamApiSecurityConfig.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamApiSecurityConfig.java
@@ -129,7 +129,6 @@ protected void configure(final HttpSecurity http) throws Exception {
         .and()
           .authorizeRequests()
             .antMatchers("/iam/password-reset/**").permitAll()
-            .antMatchers(POST, "/iam/authenticator-app/**").permitAll()
             .antMatchers(POST, "/registration/create").permitAll()
             .antMatchers(GET, "/registration/insufficient-auth").permitAll()
             .antMatchers(GET, "/registration/username-available/**").permitAll()
diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/user-mfa.controller.js b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/user-mfa.controller.js
index c69fec474..a860d922b 100644
--- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/user-mfa.controller.js
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/user-mfa.controller.js
@@ -33,7 +33,7 @@ function UserMfaController(
 
   // TODO include this data in what is fetched from the /scim/me endpoint
   function getMfaSettings() {
-    $http.get('/iam/multi-factor-settings/get-settings').then(function(response) {
+    $http.get('/iam/multi-factor-settings').then(function(response) {
       userMfaCtrl.authenticatorAppActive = response.data.authenticatorAppActive;
     });
   }
diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/services/authenticator-app.service.js b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/services/authenticator-app.service.js
index 670855af8..ccfc5826c 100644
--- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/services/authenticator-app.service.js
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/services/authenticator-app.service.js
@@ -19,48 +19,48 @@ angular.module('dashboardApp').factory('AuthenticatorAppService', AuthenticatorA
 
 AuthenticatorAppService.$inject = ['$http', '$httpParamSerializerJQLike'];
 
-function AuthenticatorAppService($http, $httpParamSerializerJQLike){
-	
+function AuthenticatorAppService($http, $httpParamSerializerJQLike) {
+
 	var service = {
-		addMfaSecretToUser : addMfaSecretToUser,
-		enableAuthenticatorApp : enableAuthenticatorApp,
-		disableAuthenticatorApp : disableAuthenticatorApp
+		addMfaSecretToUser: addMfaSecretToUser,
+		enableAuthenticatorApp: enableAuthenticatorApp,
+		disableAuthenticatorApp: disableAuthenticatorApp
 	};
-	
+
 	return service;
 
 	function addMfaSecretToUser() {
-		return $http.get('/iam/authenticator-app/add-secret');
+		return $http.put('/iam/authenticator-app/add-secret');
 	}
-	
+
 	// TODO two functions are broadly similar. This could be simplified into the foundations for step-up authentication
-	function enableAuthenticatorApp(code){
-		
+	function enableAuthenticatorApp(code) {
+
 		var data = $httpParamSerializerJQLike({
-				code: code
+			code: code
 		});
-		
+
 		var config = {
-			headers : {
+			headers: {
 				'Content-Type': 'application/x-www-form-urlencoded'
 			}
-		}; 
-		
+		};
+
 		return $http.post('/iam/authenticator-app/enable', data, config);
 	};
-	
-	function disableAuthenticatorApp(code){
+
+	function disableAuthenticatorApp(code) {
 
 		var data = $httpParamSerializerJQLike({
-				code: code
+			code: code
 		});
-		
+
 		var config = {
-			headers : {
+			headers: {
 				'Content-Type': 'application/x-www-form-urlencoded'
 			}
 		};
-		
-		return $http.post('/iam/authenticator-app/disable', data, config);	
+
+		return $http.post('/iam/authenticator-app/disable', data, config);
 	};
 }
\ No newline at end of file
diff --git a/iam-login-service/src/test/java/it/infn/mw/iam/test/api/account/multi_factor_authentication/MultiFactorSettingsTests.java b/iam-login-service/src/test/java/it/infn/mw/iam/test/api/account/multi_factor_authentication/MultiFactorSettingsTests.java
new file mode 100644
index 000000000..8439ee8d4
--- /dev/null
+++ b/iam-login-service/src/test/java/it/infn/mw/iam/test/api/account/multi_factor_authentication/MultiFactorSettingsTests.java
@@ -0,0 +1,128 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.infn.mw.iam.test.api.account.multi_factor_authentication;
+
+import static it.infn.mw.iam.test.TestUtils.passwordTokenGetter;
+import static org.hamcrest.Matchers.equalTo;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.BeforeClass;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.http.HttpStatus;
+import org.springframework.test.context.junit4.SpringRunner;
+
+import io.restassured.RestAssured;
+import io.restassured.response.ValidatableResponse;
+import it.infn.mw.iam.api.account.multi_factor_authentication.MultiFactorSettingsController;
+import it.infn.mw.iam.api.scim.model.ScimEmail;
+import it.infn.mw.iam.api.scim.model.ScimName;
+import it.infn.mw.iam.api.scim.model.ScimUser;
+import it.infn.mw.iam.api.scim.provisioning.ScimUserProvisioning;
+import it.infn.mw.iam.persistence.repository.IamAccountRepository;
+import it.infn.mw.iam.test.TestUtils;
+import it.infn.mw.iam.test.util.annotation.IamRandomPortIntegrationTest;
+
+@RunWith(SpringRunner.class)
+@IamRandomPortIntegrationTest
+public class MultiFactorSettingsTests {
+
+  @Value("${local.server.port}")
+  private Integer iamPort;
+
+  private ScimUser testUser;
+
+  private final String USER_USERNAME = "test_user";
+  private final String USER_PASSWORD = "password";
+  private final ScimName USER_NAME =
+      ScimName.builder().givenName("TESTER").familyName("USER").build();
+  private final ScimEmail USER_EMAIL = ScimEmail.builder().email("test_user@test.org").build();
+
+  @Autowired
+  private ScimUserProvisioning userService;
+  @Autowired
+  private IamAccountRepository accountRepository;
+
+  @BeforeClass
+  public static void init() {
+    TestUtils.initRestAssured();
+  }
+
+  @Before
+  public void setup() {
+    testUser = userService.create(ScimUser.builder()
+      .active(true)
+      .addEmail(USER_EMAIL)
+      .name(USER_NAME)
+      .displayName(USER_USERNAME)
+      .userName(USER_USERNAME)
+      .password(USER_PASSWORD)
+      .build());
+  }
+
+  @After
+  public void tearDown() {
+    userService.delete(testUser.getId());
+  }
+
+  private ValidatableResponse doGet(String accessToken) {
+    return RestAssured.given()
+      .port(iamPort)
+      .auth()
+      .preemptive()
+      .oauth2(accessToken)
+      .log()
+      .all(true)
+      .when()
+      .get(MultiFactorSettingsController.BASE_URL)
+      .then()
+      .log()
+      .all(true);
+  }
+
+  private ValidatableResponse doGet() {
+    return RestAssured.given()
+      .port(iamPort)
+      .log()
+      .all(true)
+      .when()
+      .get(MultiFactorSettingsController.BASE_URL)
+      .then()
+      .log()
+      .all(true);
+  }
+
+  @Test
+  public void testGetSettings() throws Exception {
+    String accessToken = passwordTokenGetter().port(iamPort)
+      .username(testUser.getUserName())
+      .password(USER_PASSWORD)
+      .getAccessToken();
+
+    doGet(accessToken).statusCode(HttpStatus.OK.value());
+  }
+
+  @Test
+  public void testGetSettingsFullAuthenticationRequired() {
+    doGet().statusCode(HttpStatus.UNAUTHORIZED.value())
+      .body("error", equalTo("unauthorized"))
+      .body("error_description",
+          equalTo("Full authentication is required to access this resource"));
+  }
+}
diff --git a/iam-login-service/src/test/java/it/infn/mw/iam/test/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppTests.java b/iam-login-service/src/test/java/it/infn/mw/iam/test/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppTests.java
new file mode 100644
index 000000000..54c3877d0
--- /dev/null
+++ b/iam-login-service/src/test/java/it/infn/mw/iam/test/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppTests.java
@@ -0,0 +1,426 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.infn.mw.iam.test.api.account.multi_factor_authentication.authenticator_app;
+
+import static it.infn.mw.iam.test.TestUtils.passwordTokenGetter;
+import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.containsString;
+import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.Mockito.when;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.BeforeClass;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mockito;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.boot.test.mock.mockito.MockBean;
+import org.springframework.http.HttpStatus;
+import org.springframework.test.context.junit4.SpringRunner;
+
+import dev.samstevens.totp.code.CodeVerifier;
+import io.restassured.RestAssured;
+import io.restassured.response.ValidatableResponse;
+import it.infn.mw.iam.api.account.multi_factor_authentication.authenticator_app.AuthenticatorAppController;
+import it.infn.mw.iam.api.scim.model.ScimEmail;
+import it.infn.mw.iam.api.scim.model.ScimName;
+import it.infn.mw.iam.api.scim.model.ScimUser;
+import it.infn.mw.iam.api.scim.provisioning.ScimUserProvisioning;
+import it.infn.mw.iam.persistence.model.IamAccount;
+import it.infn.mw.iam.persistence.model.IamTotpMfa;
+import it.infn.mw.iam.persistence.repository.IamAccountRepository;
+import it.infn.mw.iam.test.TestUtils;
+import it.infn.mw.iam.test.util.annotation.IamRandomPortIntegrationTest;
+
+// TODO update these to reflect customisation properties for authenticator app, e.g. code length
+
+@RunWith(SpringRunner.class)
+@IamRandomPortIntegrationTest
+public class AuthenticatorAppTests {
+
+  @Value("${local.server.port}")
+  private Integer iamPort;
+
+  private ScimUser testUser;
+
+  private final String USER_USERNAME = "test_user";
+  private final String USER_PASSWORD = "password";
+  private final ScimName USER_NAME =
+      ScimName.builder().givenName("TESTER").familyName("USER").build();
+  private final ScimEmail USER_EMAIL = ScimEmail.builder().email("test_user@test.org").build();
+
+  @Autowired
+  private ScimUserProvisioning userService;
+  @Autowired
+  private IamAccountRepository accountRepository;
+
+  @MockBean
+  private CodeVerifier codeVerifier;
+
+  @BeforeClass
+  public static void init() {
+    TestUtils.initRestAssured();
+  }
+
+  @Before
+  public void setup() {
+
+    testUser = userService.create(ScimUser.builder()
+      .active(true)
+      .addEmail(USER_EMAIL)
+      .name(USER_NAME)
+      .displayName(USER_USERNAME)
+      .userName(USER_USERNAME)
+      .password(USER_PASSWORD)
+      .build());
+  }
+
+  @After
+  public void tearDown() {
+    userService.delete(testUser.getId());
+    Mockito.reset(codeVerifier);
+  }
+
+  private ValidatableResponse doPut(String accessToken) {
+    return RestAssured.given()
+      .port(iamPort)
+      .auth()
+      .preemptive()
+      .oauth2(accessToken)
+      .log()
+      .all(true)
+      .when()
+      .put(AuthenticatorAppController.ADD_SECRET_URL)
+      .then()
+      .log()
+      .all(true);
+  }
+
+  private ValidatableResponse doPut() {
+    return RestAssured.given()
+      .port(iamPort)
+      .log()
+      .all(true)
+      .when()
+      .put(AuthenticatorAppController.ADD_SECRET_URL)
+      .then()
+      .log()
+      .all(true);
+  }
+
+  private ValidatableResponse doPost(String accessToken, String url, String code) {
+    return RestAssured.given()
+      .port(iamPort)
+      .formParam("code", code)
+      .auth()
+      .preemptive()
+      .oauth2(accessToken)
+      .log()
+      .all(true)
+      .when()
+      .post(url)
+      .then()
+      .log()
+      .all(true);
+  }
+
+  private ValidatableResponse doPost(String url, String code) {
+    return RestAssured.given()
+      .port(iamPort)
+      .formParam("code", code)
+      .log()
+      .all(true)
+      .when()
+      .post(url)
+      .then()
+      .log()
+      .all(true);
+  }
+
+  @Test
+  public void testAddSecret() {
+    String accessToken = passwordTokenGetter().port(iamPort)
+      .username(testUser.getUserName())
+      .password(USER_PASSWORD)
+      .getAccessToken();
+
+    doPut(accessToken).statusCode(HttpStatus.OK.value());
+  }
+
+  @Test
+  public void testAddSecretFullAuthenticationRequired() {
+    doPut().statusCode(HttpStatus.UNAUTHORIZED.value())
+      .body("error", equalTo("unauthorized"))
+      .body("error_description",
+          equalTo("Full authentication is required to access this resource"));
+  }
+
+  @Test
+  public void testEnableAuthenticatorApp() throws Exception {
+    String accessToken = passwordTokenGetter().port(iamPort)
+      .username(testUser.getUserName())
+      .password(USER_PASSWORD)
+      .getAccessToken();
+
+    String code = "123456";
+
+    IamAccount account = accountRepository.findByUsername(testUser.getUserName())
+      .orElseThrow(() -> new Exception("Test user not found"));
+    IamTotpMfa totpMfa = new IamTotpMfa(account);
+    totpMfa.setSecret("test");
+    totpMfa.setActive(false);
+    account.setTotpMfa(totpMfa);
+    accountRepository.save(account);
+
+    when(codeVerifier.isValidCode(anyString(), anyString())).thenReturn(true);
+
+    doPost(accessToken, AuthenticatorAppController.ENABLE_URL, code)
+      .statusCode(HttpStatus.OK.value());
+  }
+
+  @Test
+  public void testEnableAuthenticatorAppIncorrectCode() throws Exception {
+    String accessToken = passwordTokenGetter().port(iamPort)
+      .username(testUser.getUserName())
+      .password(USER_PASSWORD)
+      .getAccessToken();
+
+    String code = "123456";
+
+    IamAccount account = accountRepository.findByUsername(testUser.getUserName())
+      .orElseThrow(() -> new Exception("Test user not found"));
+    IamTotpMfa totpMfa = new IamTotpMfa(account);
+    totpMfa.setSecret("test");
+    totpMfa.setActive(false);
+    account.setTotpMfa(totpMfa);
+    accountRepository.save(account);
+
+    when(codeVerifier.isValidCode(anyString(), anyString())).thenReturn(false);
+
+    doPost(accessToken, AuthenticatorAppController.ENABLE_URL, code)
+      .statusCode(HttpStatus.BAD_REQUEST.value())
+      .body(containsString("Incorrect code"));
+  }
+
+  @Test
+  public void testEnableAuthenticatorAppInvalidCharactersInCode() throws Exception {
+    String accessToken = passwordTokenGetter().port(iamPort)
+      .username(testUser.getUserName())
+      .password(USER_PASSWORD)
+      .getAccessToken();
+
+    String code = "abcdef";
+
+    doPost(accessToken, AuthenticatorAppController.ENABLE_URL, code)
+      .statusCode(HttpStatus.BAD_REQUEST.value())
+      .body(containsString("Invalid code format"));
+  }
+
+  @Test
+  public void testEnableAuthenticatorAppCodeTooShort() throws Exception {
+    String accessToken = passwordTokenGetter().port(iamPort)
+      .username(testUser.getUserName())
+      .password(USER_PASSWORD)
+      .getAccessToken();
+
+    String code = "12345";
+
+    doPost(accessToken, AuthenticatorAppController.ENABLE_URL, code)
+      .statusCode(HttpStatus.BAD_REQUEST.value())
+      .body(containsString("Invalid code format"));
+  }
+
+  @Test
+  public void testEnableAuthenticatorAppCodeTooLong() throws Exception {
+    String accessToken = passwordTokenGetter().port(iamPort)
+      .username(testUser.getUserName())
+      .password(USER_PASSWORD)
+      .getAccessToken();
+
+    String code = "1234567";
+
+    doPost(accessToken, AuthenticatorAppController.ENABLE_URL, code)
+      .statusCode(HttpStatus.BAD_REQUEST.value())
+      .body(containsString("Invalid code format"));
+  }
+
+  @Test
+  public void testEnableAuthenticatorAppNullCode() throws Exception {
+    String accessToken = passwordTokenGetter().port(iamPort)
+      .username(testUser.getUserName())
+      .password(USER_PASSWORD)
+      .getAccessToken();
+
+    String code = null;
+
+    doPost(accessToken, AuthenticatorAppController.ENABLE_URL, code)
+      .statusCode(HttpStatus.BAD_REQUEST.value())
+      .body(containsString("Invalid code format"));
+  }
+
+  @Test
+  public void testEnableAuthenticatorAppEmptyCode() throws Exception {
+    String accessToken = passwordTokenGetter().port(iamPort)
+      .username(testUser.getUserName())
+      .password(USER_PASSWORD)
+      .getAccessToken();
+
+    String code = "";
+
+    doPost(accessToken, AuthenticatorAppController.ENABLE_URL, code)
+      .statusCode(HttpStatus.BAD_REQUEST.value())
+      .body(containsString("Invalid code format"));
+  }
+
+  @Test
+  public void testEnableAuthenticatorAppFullAuthenticationRequired() {
+    String code = "123456";
+
+    doPost(AuthenticatorAppController.ENABLE_URL, code).statusCode(HttpStatus.UNAUTHORIZED.value())
+      .body("error", equalTo("unauthorized"))
+      .body("error_description",
+          equalTo("Full authentication is required to access this resource"));
+  }
+
+  @Test
+  public void testDisableAuthenticatorApp() throws Exception {
+    String accessToken = passwordTokenGetter().port(iamPort)
+      .username(testUser.getUserName())
+      .password(USER_PASSWORD)
+      .getAccessToken();
+
+    String code = "123456";
+
+    IamAccount account = accountRepository.findByUsername(testUser.getUserName())
+      .orElseThrow(() -> new Exception("Test user not found"));
+    IamTotpMfa totpMfa = new IamTotpMfa(account);
+    totpMfa.setSecret("test");
+    totpMfa.setActive(true);
+    account.setTotpMfa(totpMfa);
+    accountRepository.save(account);
+
+    when(codeVerifier.isValidCode(anyString(), anyString())).thenReturn(true);
+
+    doPost(accessToken, AuthenticatorAppController.DISABLE_URL, code)
+      .statusCode(HttpStatus.OK.value());
+  }
+
+  @Test
+  public void testDisableAuthenticatorAppIncorrectCode() throws Exception {
+    String accessToken = passwordTokenGetter().port(iamPort)
+      .username(testUser.getUserName())
+      .password(USER_PASSWORD)
+      .getAccessToken();
+
+    String code = "123456";
+
+    IamAccount account = accountRepository.findByUsername(testUser.getUserName())
+      .orElseThrow(() -> new Exception("Test user not found"));
+    IamTotpMfa totpMfa = new IamTotpMfa(account);
+    totpMfa.setSecret("test");
+    totpMfa.setActive(true);
+    account.setTotpMfa(totpMfa);
+    accountRepository.save(account);
+
+    when(codeVerifier.isValidCode(anyString(), anyString())).thenReturn(false);
+
+    doPost(accessToken, AuthenticatorAppController.DISABLE_URL, code)
+      .statusCode(HttpStatus.BAD_REQUEST.value())
+      .body(containsString("Incorrect code"));
+  }
+
+  @Test
+  public void testDisableAuthenticatorAppInvalidCharactersInCode() throws Exception {
+    String accessToken = passwordTokenGetter().port(iamPort)
+      .username(testUser.getUserName())
+      .password(USER_PASSWORD)
+      .getAccessToken();
+
+    String code = "abcdef";
+
+    doPost(accessToken, AuthenticatorAppController.DISABLE_URL, code)
+      .statusCode(HttpStatus.BAD_REQUEST.value())
+      .body(containsString("Invalid code format"));
+  }
+
+  @Test
+  public void testDisableAuthenticatorAppCodeTooShort() throws Exception {
+    String accessToken = passwordTokenGetter().port(iamPort)
+      .username(testUser.getUserName())
+      .password(USER_PASSWORD)
+      .getAccessToken();
+
+    String code = "12345";
+
+    doPost(accessToken, AuthenticatorAppController.DISABLE_URL, code)
+      .statusCode(HttpStatus.BAD_REQUEST.value())
+      .body(containsString("Invalid code format"));
+  }
+
+  @Test
+  public void testDisableAuthenticatorAppCodeTooLong() throws Exception {
+    String accessToken = passwordTokenGetter().port(iamPort)
+      .username(testUser.getUserName())
+      .password(USER_PASSWORD)
+      .getAccessToken();
+
+    String code = "1234567";
+
+    doPost(accessToken, AuthenticatorAppController.DISABLE_URL, code)
+      .statusCode(HttpStatus.BAD_REQUEST.value())
+      .body(containsString("Invalid code format"));
+  }
+
+  @Test
+  public void testDisableAuthenticatorAppNullCode() throws Exception {
+    String accessToken = passwordTokenGetter().port(iamPort)
+      .username(testUser.getUserName())
+      .password(USER_PASSWORD)
+      .getAccessToken();
+
+    String code = null;
+
+    doPost(accessToken, AuthenticatorAppController.DISABLE_URL, code)
+      .statusCode(HttpStatus.BAD_REQUEST.value())
+      .body(containsString("Invalid code format"));
+  }
+
+  @Test
+  public void testDisableAuthenticatorAppEmptyCode() throws Exception {
+    String accessToken = passwordTokenGetter().port(iamPort)
+      .username(testUser.getUserName())
+      .password(USER_PASSWORD)
+      .getAccessToken();
+
+    String code = "";
+
+    doPost(accessToken, AuthenticatorAppController.DISABLE_URL, code)
+      .statusCode(HttpStatus.BAD_REQUEST.value())
+      .body(containsString("Invalid code format"));
+  }
+
+  @Test
+  public void testDisableAuthenticatorAppFullAuthenticationRequired() {
+    String code = "123456";
+
+    doPost(AuthenticatorAppController.DISABLE_URL, code).statusCode(HttpStatus.UNAUTHORIZED.value())
+      .body("error", equalTo("unauthorized"))
+      .body("error_description",
+          equalTo("Full authentication is required to access this resource"));
+  }
+}

From 0a0557ca2e5aea8a5b408552abdd6b4329444de1 Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Thu, 2 Dec 2021 10:17:07 +0000
Subject: [PATCH 33/76] Adding ROLE_PRE_AUTHENTICATED

If an account has MFA enabled, this role will be assigned to them immediately after authenticating with normal login credentials (username, password, etc.). The role will restrict them to access primarily one page or subset of pages, responsible for authenticating the user with an additional factor. Once successful verification takes place here, the normal login procedure completes and the role of ROLE_USER will be assigned to them, after which normal user restrictions will apply.

Still to add the actual pages and pre-authorisation for these pages
---
 .../infn/mw/iam/api/account/AccountUtils.java | 17 ++++----
 .../dashboard-app/services/utils.service.js   |  8 +++-
 .../mw/iam/test/util/AuthenticationUtils.java |  8 +++-
 .../util/WithMockPreAuthenticatedUser.java    | 32 +++++++++++++++
 ...thenticatedUserSecurityContextFactory.java | 39 +++++++++++++++++++
 .../V4___add_pre_authenticated_authority.sql  |  2 +
 .../V20___add_pre_authenticed_authority.sql   |  2 +
 7 files changed, 99 insertions(+), 9 deletions(-)
 create mode 100644 iam-login-service/src/test/java/it/infn/mw/iam/test/util/WithMockPreAuthenticatedUser.java
 create mode 100644 iam-login-service/src/test/java/it/infn/mw/iam/test/util/multi_factor_authentication/WithMockPreAuthenticatedUserSecurityContextFactory.java
 create mode 100644 iam-persistence/src/main/resources/db/migration/prod/V4___add_pre_authenticated_authority.sql
 create mode 100644 iam-persistence/src/main/resources/db/migration/test/V20___add_pre_authenticed_authority.sql

diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/AccountUtils.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/AccountUtils.java
index 1ec400305..81ce00fe7 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/AccountUtils.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/AccountUtils.java
@@ -32,7 +32,7 @@
 @SuppressWarnings("deprecation")
 @Component
 public class AccountUtils {
-  
+
   IamAccountRepository accountRepo;
 
   @Autowired
@@ -40,13 +40,14 @@ public AccountUtils(IamAccountRepository accountRepo) {
     this.accountRepo = accountRepo;
   }
 
-
+  // TODO check pre-authenticated status
   public boolean isAuthenticated() {
     Authentication auth = SecurityContextHolder.getContext().getAuthentication();
 
     return isAuthenticated(auth);
   }
 
+  // TODO check pre-authenticated status
   public boolean isAuthenticated(Authentication auth) {
     return !(isNull(auth) || auth instanceof AnonymousAuthenticationToken);
   }
@@ -57,7 +58,7 @@ public Optional getAuthenticatedUserAccount(Authentication authn) {
     }
 
     Authentication userAuthn = authn;
-    
+
     if (authn instanceof OAuth2Authentication) {
       OAuth2Authentication oauth = (OAuth2Authentication) authn;
       if (oauth.getUserAuthentication() == null) {
@@ -71,13 +72,15 @@ public Optional getAuthenticatedUserAccount(Authentication authn) {
   }
 
   public Optional getAuthenticatedUserAccount() {
-    
+
     Authentication auth = SecurityContextHolder.getContext().getAuthentication();
- 
+
     return getAuthenticatedUserAccount(auth);
   }
-  
-  public Optional getByAccountId(String accountId){
+
+  public Optional getByAccountId(String accountId) {
     return accountRepo.findByUuid(accountId);
   }
+
+  // TODO potentially add checks for pre-authenticated status
 }
diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/services/utils.service.js b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/services/utils.service.js
index bbe64d850..868d737f1 100644
--- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/services/utils.service.js
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/services/utils.service.js
@@ -13,7 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-(function() {
+(function () {
 
     'use strict';
 
@@ -29,6 +29,7 @@
             isMe: isMe,
             isAdmin: isAdmin,
             isUser: isUser,
+            isPreAuthenticated: isPreAuthenticated,
             getLoggedUser: getLoggedUser,
             isRegistrationEnabled: isRegistrationEnabled,
             isOidcEnabled: isOidcEnabled,
@@ -86,6 +87,11 @@
             return (getUserAuthorities().indexOf("ROLE_USER") != -1);
         }
 
+        function isPreAuthenticated() {
+
+            return (getUserAuthorities().indexOf("ROLE_PRE_AUTHENTICATED") != -1);
+        }
+
         function isGroupManager() {
             const hasGmAuth = getUserAuthorities().filter((c) => c.startsWith('ROLE_GM:'));
 
diff --git a/iam-login-service/src/test/java/it/infn/mw/iam/test/util/AuthenticationUtils.java b/iam-login-service/src/test/java/it/infn/mw/iam/test/util/AuthenticationUtils.java
index 0a09ab384..dbeae03e9 100644
--- a/iam-login-service/src/test/java/it/infn/mw/iam/test/util/AuthenticationUtils.java
+++ b/iam-login-service/src/test/java/it/infn/mw/iam/test/util/AuthenticationUtils.java
@@ -27,6 +27,12 @@ public static Authentication adminAuthentication() {
   }
 
   public static Authentication userAuthentication() {
-    return new UsernamePasswordAuthenticationToken("test", "", AuthorityUtils.createAuthorityList("ROLE_USER"));
+    return new UsernamePasswordAuthenticationToken("test", "",
+        AuthorityUtils.createAuthorityList("ROLE_USER"));
+  }
+
+  public static Authentication preAuthenticatedAuthentication() {
+    return new UsernamePasswordAuthenticationToken("test_pre_authenticated", "",
+        AuthorityUtils.createAuthorityList("ROLE_PRE_AUTHENTICATED"));
   }
 }
diff --git a/iam-login-service/src/test/java/it/infn/mw/iam/test/util/WithMockPreAuthenticatedUser.java b/iam-login-service/src/test/java/it/infn/mw/iam/test/util/WithMockPreAuthenticatedUser.java
new file mode 100644
index 000000000..6a42ceb6e
--- /dev/null
+++ b/iam-login-service/src/test/java/it/infn/mw/iam/test/util/WithMockPreAuthenticatedUser.java
@@ -0,0 +1,32 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.infn.mw.iam.test.util;
+
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+
+import org.springframework.security.test.context.support.WithSecurityContext;
+
+import it.infn.mw.iam.test.util.multi_factor_authentication.WithMockPreAuthenticatedUserSecurityContextFactory;
+
+@Retention(RetentionPolicy.RUNTIME)
+@WithSecurityContext(factory = WithMockPreAuthenticatedUserSecurityContextFactory.class)
+public @interface WithMockPreAuthenticatedUser {
+
+  String username() default "test-pre-authenticated-user";
+
+  String[] authorities() default {"ROLE_PRE_AUTHENTICATED"};
+}
diff --git a/iam-login-service/src/test/java/it/infn/mw/iam/test/util/multi_factor_authentication/WithMockPreAuthenticatedUserSecurityContextFactory.java b/iam-login-service/src/test/java/it/infn/mw/iam/test/util/multi_factor_authentication/WithMockPreAuthenticatedUserSecurityContextFactory.java
new file mode 100644
index 000000000..5fbf8249f
--- /dev/null
+++ b/iam-login-service/src/test/java/it/infn/mw/iam/test/util/multi_factor_authentication/WithMockPreAuthenticatedUserSecurityContextFactory.java
@@ -0,0 +1,39 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.infn.mw.iam.test.util.multi_factor_authentication;
+
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.authority.AuthorityUtils;
+import org.springframework.security.core.context.SecurityContext;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.security.test.context.support.WithSecurityContextFactory;
+
+import it.infn.mw.iam.test.util.WithMockPreAuthenticatedUser;
+
+public class WithMockPreAuthenticatedUserSecurityContextFactory
+    implements WithSecurityContextFactory {
+
+  @Override
+  public SecurityContext createSecurityContext(WithMockPreAuthenticatedUser annotation) {
+    SecurityContext context = SecurityContextHolder.createEmptyContext();
+
+    Authentication authentication = new UsernamePasswordAuthenticationToken(annotation.username(),
+        "", AuthorityUtils.createAuthorityList(annotation.authorities()));
+    context.setAuthentication(authentication);
+    return context;
+  }
+}
diff --git a/iam-persistence/src/main/resources/db/migration/prod/V4___add_pre_authenticated_authority.sql b/iam-persistence/src/main/resources/db/migration/prod/V4___add_pre_authenticated_authority.sql
new file mode 100644
index 000000000..cb9d92e6c
--- /dev/null
+++ b/iam-persistence/src/main/resources/db/migration/prod/V4___add_pre_authenticated_authority.sql
@@ -0,0 +1,2 @@
+INSERT INTO iam_authority(ID, AUTH) VALUES
+(3, 'ROLE_PRE_AUTHENTICATED');
\ No newline at end of file
diff --git a/iam-persistence/src/main/resources/db/migration/test/V20___add_pre_authenticed_authority.sql b/iam-persistence/src/main/resources/db/migration/test/V20___add_pre_authenticed_authority.sql
new file mode 100644
index 000000000..cb9d92e6c
--- /dev/null
+++ b/iam-persistence/src/main/resources/db/migration/test/V20___add_pre_authenticed_authority.sql
@@ -0,0 +1,2 @@
+INSERT INTO iam_authority(ID, AUTH) VALUES
+(3, 'ROLE_PRE_AUTHENTICATED');
\ No newline at end of file

From b1dc5fe17d8b740acadba8fc6fd7d875e72cd5ec Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Thu, 2 Dec 2021 14:10:48 +0000
Subject: [PATCH 34/76] Adding UUID for IamTotpMfa, fixing migration version
 numbers

---
 .../AuthenticatorAppController.java           |  1 -
 .../core/user/DefaultIamAccountService.java   |  1 +
 .../mw/iam/persistence/model/IamTotpMfa.java  | 33 +++++++++++++++----
 .../model/IamTotpRecoveryCode.java            | 25 ++++++++++++--
 .../db/migration/h2/V70___totp_mfa.sql        |  2 +-
 .../db/migration/mysql/V70___totp_mfa.sql     |  2 +-
 ...V71___add_pre_authenticated_authority.sql} |  0
 ...> V72___add_pre_authenticed_authority.sql} |  0
 8 files changed, 52 insertions(+), 12 deletions(-)
 rename iam-persistence/src/main/resources/db/migration/prod/{V4___add_pre_authenticated_authority.sql => V71___add_pre_authenticated_authority.sql} (100%)
 rename iam-persistence/src/main/resources/db/migration/test/{V20___add_pre_authenticed_authority.sql => V72___add_pre_authenticed_authority.sql} (100%)

diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppController.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppController.java
index 2f651920b..dd6aabc7c 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppController.java
@@ -94,7 +94,6 @@ public SecretAndDataUriDTO addSecret() {
     return dto;
   }
 
-  // TODO switch to this post method from get request, post method not currently working
   @PreAuthorize("hasRole('USER')")
   @RequestMapping(value = ENABLE_URL, method = RequestMethod.POST,
       produces = MediaType.TEXT_PLAIN_VALUE)
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/DefaultIamAccountService.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/DefaultIamAccountService.java
index 71129c18c..6c032324f 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/DefaultIamAccountService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/DefaultIamAccountService.java
@@ -593,6 +593,7 @@ public IamAccount addTotpMfaSecret(IamAccount account) {
     }
 
     IamTotpMfa totpMfa = new IamTotpMfa(account);
+    totpMfa.setUuid(UUID.randomUUID().toString());
     totpMfa.setSecret(secretGenerator.generate());
 
     String[] recoveryCodeStrings = recoveryCodeGenerator.generateCodes(6);
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpMfa.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpMfa.java
index fb51ac6c9..e7cd578bb 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpMfa.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpMfa.java
@@ -34,10 +34,15 @@
 @Table(name = "iam_totp_mfa")
 public class IamTotpMfa implements Serializable {
 
+  private static final long serialVersionUID = 1L;
+
   @Id
   @GeneratedValue(strategy = GenerationType.IDENTITY)
   private Long id;
 
+  @Column(nullable = false, length = 36, unique = true)
+  private String uuid;
+
   @OneToOne()
   private IamAccount account;
 
@@ -47,8 +52,6 @@ public class IamTotpMfa implements Serializable {
   @Column(name = "active", nullable = false)
   private boolean active;
 
-  // TODO do we need a UUID?
-
   @OneToMany(mappedBy = "totpMfa", cascade = CascadeType.ALL, fetch = FetchType.EAGER,
       orphanRemoval = true)
   private Set recoveryCodes = new HashSet<>();
@@ -67,6 +70,14 @@ public void setId(Long id) {
     this.id = id;
   }
 
+  public String getUuid() {
+    return uuid;
+  }
+
+  public void setUuid(final String uuid) {
+    this.uuid = uuid;
+  }
+
   public IamAccount getAccount() {
     return account;
   }
@@ -112,12 +123,20 @@ public void regenerateRecoveryCodes() {
 
   @Override
   public String toString() {
-    return "IamAccount [id=" + id + ", secret=" + secret + ", active=" + active + "]";
+    return "IamTotpMfa [active=" + active + ", id=" + id + ", secret=" + secret + ", uuid=" + uuid
+        + "]";
   }
 
   @Override
-  public boolean equals(final Object obj) {
+  public int hashCode() {
+    final int prime = 31;
+    int result = 1;
+    result = prime * result + ((uuid == null) ? 0 : uuid.hashCode());
+    return result;
+  }
 
+  @Override
+  public boolean equals(Object obj) {
     if (this == obj)
       return true;
     if (obj == null)
@@ -125,10 +144,10 @@ public boolean equals(final Object obj) {
     if (getClass() != obj.getClass())
       return false;
     IamTotpMfa other = (IamTotpMfa) obj;
-    if (secret == null) {
-      if (other.secret != null)
+    if (uuid == null) {
+      if (other.uuid != null)
         return false;
-    } else if (!secret.equals(other.secret))
+    } else if (!uuid.equals(other.uuid))
       return false;
     return true;
   }
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpRecoveryCode.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpRecoveryCode.java
index c683e3023..c76bc0077 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpRecoveryCode.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpRecoveryCode.java
@@ -31,6 +31,8 @@
 @Table(name = "iam_totp_recovery_code")
 public class IamTotpRecoveryCode implements Serializable {
 
+  private static final long serialVersionUID = 1L;
+
   @Id
   @GeneratedValue(strategy = GenerationType.IDENTITY)
   private Long id;
@@ -74,12 +76,21 @@ public void setCode(final String code) {
 
   @Override
   public String toString() {
-    return "IamAccount [id=" + id + ", code=" + code + "]";
+    return "IamTotpRecoveryCode [code=" + code + ", id=" + id + "]";
   }
 
   @Override
-  public boolean equals(final Object obj) {
+  public int hashCode() {
+    final int prime = 31;
+    int result = 1;
+    result = prime * result + ((code == null) ? 0 : code.hashCode());
+    result = prime * result + ((id == null) ? 0 : id.hashCode());
+    result = prime * result + ((totpMfa == null) ? 0 : totpMfa.hashCode());
+    return result;
+  }
 
+  @Override
+  public boolean equals(Object obj) {
     if (this == obj)
       return true;
     if (obj == null)
@@ -92,6 +103,16 @@ public boolean equals(final Object obj) {
         return false;
     } else if (!code.equals(other.code))
       return false;
+    if (id == null) {
+      if (other.id != null)
+        return false;
+    } else if (!id.equals(other.id))
+      return false;
+    if (totpMfa == null) {
+      if (other.totpMfa != null)
+        return false;
+    } else if (!totpMfa.equals(other.totpMfa))
+      return false;
     return true;
   }
 }
diff --git a/iam-persistence/src/main/resources/db/migration/h2/V70___totp_mfa.sql b/iam-persistence/src/main/resources/db/migration/h2/V70___totp_mfa.sql
index 8c2486cef..0220c58e0 100644
--- a/iam-persistence/src/main/resources/db/migration/h2/V70___totp_mfa.sql
+++ b/iam-persistence/src/main/resources/db/migration/h2/V70___totp_mfa.sql
@@ -1,6 +1,6 @@
 -- TOTP MFA secrets
 
-CREATE TABLE iam_totp_mfa (ID BIGINT IDENTITY NOT NULL, active BOOLEAN NOT NULL, secret VARCHAR(256), ACCOUNT_ID BIGINT, PRIMARY KEY (ID));
+CREATE TABLE iam_totp_mfa (ID BIGINT IDENTITY NOT NULL, UUID VARCHAR(36) NOT NULL UNIQUE, active BOOLEAN NOT NULL, secret VARCHAR(256), ACCOUNT_ID BIGINT, PRIMARY KEY (ID));
 
 CREATE TABLE iam_totp_recovery_code (ID BIGINT IDENTITY NOT NULL, code VARCHAR(255) NOT NULL, totp_mfa_id BIGINT NOT NULL, PRIMARY KEY (ID));
 
diff --git a/iam-persistence/src/main/resources/db/migration/mysql/V70___totp_mfa.sql b/iam-persistence/src/main/resources/db/migration/mysql/V70___totp_mfa.sql
index de17081f8..f2f7d4ca1 100644
--- a/iam-persistence/src/main/resources/db/migration/mysql/V70___totp_mfa.sql
+++ b/iam-persistence/src/main/resources/db/migration/mysql/V70___totp_mfa.sql
@@ -1,6 +1,6 @@
 -- TOTP MFA secrets
 
-CREATE TABLE iam_totp_mfa (ID BIGINT AUTO_INCREMENT NOT NULL, active TINYINT(1) default 0 NOT NULL, secret VARCHAR(256), ACCOUNT_ID BIGINT, PRIMARY KEY (ID));
+CREATE TABLE iam_totp_mfa (ID BIGINT AUTO_INCREMENT NOT NULL, UUID VARCHAR(36) NOT NULL UNIQUE, active TINYINT(1) default 0 NOT NULL, secret VARCHAR(256), ACCOUNT_ID BIGINT, PRIMARY KEY (ID));
 
 CREATE TABLE iam_totp_recovery_code (ID BIGINT AUTO_INCREMENT NOT NULL, code VARCHAR(255) NOT NULL, totp_mfa_id BIGINT NOT NULL, PRIMARY KEY (ID));
 
diff --git a/iam-persistence/src/main/resources/db/migration/prod/V4___add_pre_authenticated_authority.sql b/iam-persistence/src/main/resources/db/migration/prod/V71___add_pre_authenticated_authority.sql
similarity index 100%
rename from iam-persistence/src/main/resources/db/migration/prod/V4___add_pre_authenticated_authority.sql
rename to iam-persistence/src/main/resources/db/migration/prod/V71___add_pre_authenticated_authority.sql
diff --git a/iam-persistence/src/main/resources/db/migration/test/V20___add_pre_authenticed_authority.sql b/iam-persistence/src/main/resources/db/migration/test/V72___add_pre_authenticed_authority.sql
similarity index 100%
rename from iam-persistence/src/main/resources/db/migration/test/V20___add_pre_authenticed_authority.sql
rename to iam-persistence/src/main/resources/db/migration/test/V72___add_pre_authenticed_authority.sql

From cc77a0b4e7d9fc90d33bae3a0cc5cc0ae8189a50 Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Thu, 2 Dec 2021 16:57:36 +0000
Subject: [PATCH 35/76] Removing UUID from IamTotpMfa due to being unnecessary

---
 .../core/user/DefaultIamAccountService.java   |  1 -
 .../service/IamAccountServiceTestSupport.java | 20 ++++++++--------
 .../mw/iam/persistence/model/IamTotpMfa.java  | 24 +++++--------------
 .../db/migration/h2/V70___totp_mfa.sql        |  2 +-
 .../db/migration/mysql/V70___totp_mfa.sql     |  2 +-
 5 files changed, 18 insertions(+), 31 deletions(-)

diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/DefaultIamAccountService.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/DefaultIamAccountService.java
index 6c032324f..71129c18c 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/DefaultIamAccountService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/DefaultIamAccountService.java
@@ -593,7 +593,6 @@ public IamAccount addTotpMfaSecret(IamAccount account) {
     }
 
     IamTotpMfa totpMfa = new IamTotpMfa(account);
-    totpMfa.setUuid(UUID.randomUUID().toString());
     totpMfa.setSecret(secretGenerator.generate());
 
     String[] recoveryCodeStrings = recoveryCodeGenerator.generateCodes(6);
diff --git a/iam-login-service/src/test/java/it/infn/mw/iam/test/service/IamAccountServiceTestSupport.java b/iam-login-service/src/test/java/it/infn/mw/iam/test/service/IamAccountServiceTestSupport.java
index d32ca771d..e3a6c94c8 100644
--- a/iam-login-service/src/test/java/it/infn/mw/iam/test/service/IamAccountServiceTestSupport.java
+++ b/iam-login-service/src/test/java/it/infn/mw/iam/test/service/IamAccountServiceTestSupport.java
@@ -43,11 +43,11 @@ public class IamAccountServiceTestSupport {
   public static final String CICCIO_GIVEN_NAME = "Ciccio";
   public static final String CICCIO_FAMILY_NAME = "Paglia";
 
-  public static final String TOTP_MFA_UUID = "b3e7dd7f-a1ac-eda0-371d-b902a6c5cee2";
-  public static final String TOTP_MFA_USERNAME = "totp";
-  public static final String TOTP_MFA_EMAIL = "totp@example.org";
-  public static final String TOTP_MFA_GIVEN_NAME = "Totp";
-  public static final String TOTP_MFA_FAMILY_NAME = "Mfa";
+  public static final String TOTP_MFA_ACCOUNT_UUID = "b3e7dd7f-a1ac-eda0-371d-b902a6c5cee2";
+  public static final String TOTP_MFA_ACCOUNT_USERNAME = "totp";
+  public static final String TOTP_MFA_ACCOUNT_EMAIL = "totp@example.org";
+  public static final String TOTP_MFA_ACCOUNT_GIVEN_NAME = "Totp";
+  public static final String TOTP_MFA_ACCOUNT_FAMILY_NAME = "Mfa";
 
   public static final String TEST_SAML_ID_IDP_ID = "idpId";
   public static final String TEST_SAML_ID_USER_ID = "userId";
@@ -164,11 +164,11 @@ public IamAccountServiceTestSupport() {
           TOTP_RECOVERY_CODE_3, TOTP_RECOVERY_CODE_4, TOTP_RECOVERY_CODE_5, TOTP_RECOVERY_CODE_6)));
 
     TOTP_MFA_ACCOUNT = IamAccount.newAccount();
-    TOTP_MFA_ACCOUNT.setUuid(TOTP_MFA_UUID);
-    TOTP_MFA_ACCOUNT.setUsername(TOTP_MFA_USERNAME);
-    TOTP_MFA_ACCOUNT.getUserInfo().setEmail(TOTP_MFA_EMAIL);
-    TOTP_MFA_ACCOUNT.getUserInfo().setGivenName(TOTP_MFA_GIVEN_NAME);
-    TOTP_MFA_ACCOUNT.getUserInfo().setFamilyName(TOTP_MFA_FAMILY_NAME);
+    TOTP_MFA_ACCOUNT.setUuid(TOTP_MFA_ACCOUNT_UUID);
+    TOTP_MFA_ACCOUNT.setUsername(TOTP_MFA_ACCOUNT_USERNAME);
+    TOTP_MFA_ACCOUNT.getUserInfo().setEmail(TOTP_MFA_ACCOUNT_EMAIL);
+    TOTP_MFA_ACCOUNT.getUserInfo().setGivenName(TOTP_MFA_ACCOUNT_GIVEN_NAME);
+    TOTP_MFA_ACCOUNT.getUserInfo().setFamilyName(TOTP_MFA_ACCOUNT_FAMILY_NAME);
     TOTP_MFA_ACCOUNT.setTotpMfa(TOTP_MFA);
   }
 
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpMfa.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpMfa.java
index e7cd578bb..982613910 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpMfa.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpMfa.java
@@ -40,13 +40,10 @@ public class IamTotpMfa implements Serializable {
   @GeneratedValue(strategy = GenerationType.IDENTITY)
   private Long id;
 
-  @Column(nullable = false, length = 36, unique = true)
-  private String uuid;
-
   @OneToOne()
   private IamAccount account;
 
-  @Column(name = "secret")
+  @Column(name = "secret", nullable = false)
   private String secret;
 
   @Column(name = "active", nullable = false)
@@ -70,14 +67,6 @@ public void setId(Long id) {
     this.id = id;
   }
 
-  public String getUuid() {
-    return uuid;
-  }
-
-  public void setUuid(final String uuid) {
-    this.uuid = uuid;
-  }
-
   public IamAccount getAccount() {
     return account;
   }
@@ -123,15 +112,14 @@ public void regenerateRecoveryCodes() {
 
   @Override
   public String toString() {
-    return "IamTotpMfa [active=" + active + ", id=" + id + ", secret=" + secret + ", uuid=" + uuid
-        + "]";
+    return "IamTotpMfa [active=" + active + ", id=" + id + ", secret=" + secret + "]";
   }
 
   @Override
   public int hashCode() {
     final int prime = 31;
     int result = 1;
-    result = prime * result + ((uuid == null) ? 0 : uuid.hashCode());
+    result = prime * result + ((secret == null) ? 0 : secret.hashCode());
     return result;
   }
 
@@ -144,10 +132,10 @@ public boolean equals(Object obj) {
     if (getClass() != obj.getClass())
       return false;
     IamTotpMfa other = (IamTotpMfa) obj;
-    if (uuid == null) {
-      if (other.uuid != null)
+    if (secret == null) {
+      if (other.secret != null)
         return false;
-    } else if (!uuid.equals(other.uuid))
+    } else if (!secret.equals(other.secret))
       return false;
     return true;
   }
diff --git a/iam-persistence/src/main/resources/db/migration/h2/V70___totp_mfa.sql b/iam-persistence/src/main/resources/db/migration/h2/V70___totp_mfa.sql
index 0220c58e0..03d54f807 100644
--- a/iam-persistence/src/main/resources/db/migration/h2/V70___totp_mfa.sql
+++ b/iam-persistence/src/main/resources/db/migration/h2/V70___totp_mfa.sql
@@ -1,6 +1,6 @@
 -- TOTP MFA secrets
 
-CREATE TABLE iam_totp_mfa (ID BIGINT IDENTITY NOT NULL, UUID VARCHAR(36) NOT NULL UNIQUE, active BOOLEAN NOT NULL, secret VARCHAR(256), ACCOUNT_ID BIGINT, PRIMARY KEY (ID));
+CREATE TABLE iam_totp_mfa (ID BIGINT IDENTITY NOT NULL, active BOOLEAN NOT NULL, secret VARCHAR(256) NOT NULL, ACCOUNT_ID BIGINT, PRIMARY KEY (ID));
 
 CREATE TABLE iam_totp_recovery_code (ID BIGINT IDENTITY NOT NULL, code VARCHAR(255) NOT NULL, totp_mfa_id BIGINT NOT NULL, PRIMARY KEY (ID));
 
diff --git a/iam-persistence/src/main/resources/db/migration/mysql/V70___totp_mfa.sql b/iam-persistence/src/main/resources/db/migration/mysql/V70___totp_mfa.sql
index f2f7d4ca1..7ca1909d0 100644
--- a/iam-persistence/src/main/resources/db/migration/mysql/V70___totp_mfa.sql
+++ b/iam-persistence/src/main/resources/db/migration/mysql/V70___totp_mfa.sql
@@ -1,6 +1,6 @@
 -- TOTP MFA secrets
 
-CREATE TABLE iam_totp_mfa (ID BIGINT AUTO_INCREMENT NOT NULL, UUID VARCHAR(36) NOT NULL UNIQUE, active TINYINT(1) default 0 NOT NULL, secret VARCHAR(256), ACCOUNT_ID BIGINT, PRIMARY KEY (ID));
+CREATE TABLE iam_totp_mfa (ID BIGINT AUTO_INCREMENT NOT NULL, active TINYINT(1) default 0 NOT NULL, secret VARCHAR(256) NOT NULL, ACCOUNT_ID BIGINT, PRIMARY KEY (ID));
 
 CREATE TABLE iam_totp_recovery_code (ID BIGINT AUTO_INCREMENT NOT NULL, code VARCHAR(255) NOT NULL, totp_mfa_id BIGINT NOT NULL, PRIMARY KEY (ID));
 

From 27c0e65973d43942fae2cfeee3069d1f2de7e14f Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Fri, 3 Dec 2021 13:11:47 +0000
Subject: [PATCH 36/76] Adding java docs for files in iam-login-service

---
 .../MultiFactorSettingsController.java        | 15 +++
 .../MultiFactorSettingsDTO.java               | 12 +++
 .../AuthenticatorAppController.java           | 94 +++++++++++++++++++
 .../authenticator_app/CodeDTO.java            | 12 +++
 .../SecretAndDataUriDTO.java                  | 21 +++++
 .../infn/mw/iam/config/IamTotpMfaConfig.java  | 28 ++++++
 .../core/user/DefaultIamAccountService.java   | 31 +++++-
 .../mw/iam/core/user/IamAccountService.java   | 13 ++-
 8 files changed, 218 insertions(+), 8 deletions(-)

diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/MultiFactorSettingsController.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/MultiFactorSettingsController.java
index 39ab51a15..6c7c1631b 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/MultiFactorSettingsController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/MultiFactorSettingsController.java
@@ -30,6 +30,9 @@
 import it.infn.mw.iam.persistence.model.IamAccount;
 import it.infn.mw.iam.persistence.repository.IamAccountRepository;
 
+/**
+ * Controller for retrieving all multi-factor settings for a user account
+ */
 @SuppressWarnings("deprecation")
 @Controller
 public class MultiFactorSettingsController {
@@ -42,6 +45,12 @@ public MultiFactorSettingsController(IamAccountRepository accountRepository) {
     this.accountRepository = accountRepository;
   }
 
+
+  /**
+   * Retrieve info about MFA settings and return them in a DTO
+   * 
+   * @return MultiFactorSettingsDTO the MFA settings for the account
+   */
   @PreAuthorize("hasRole('USER')")
   @RequestMapping(value = BASE_URL, method = RequestMethod.GET,
       produces = MediaType.APPLICATION_JSON_VALUE)
@@ -59,6 +68,12 @@ public MultiFactorSettingsDTO getMultiFactorSettings() {
     return dto;
   }
 
+
+  /**
+   * Fetch and return the logged-in username from security context
+   * 
+   * @return String username
+   */
   private String getUsernameFromSecurityContext() {
 
     Authentication auth = SecurityContextHolder.getContext().getAuthentication();
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/MultiFactorSettingsDTO.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/MultiFactorSettingsDTO.java
index 2bfd69de4..83901a859 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/MultiFactorSettingsDTO.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/MultiFactorSettingsDTO.java
@@ -17,6 +17,9 @@
 
 import javax.validation.constraints.NotEmpty;
 
+/**
+ * DTO containing info about enabled factors of authentication
+ */
 public class MultiFactorSettingsDTO {
 
   @NotEmpty
@@ -30,10 +33,19 @@ public MultiFactorSettingsDTO(final boolean authenticatorAppActive) {
     this.authenticatorAppActive = authenticatorAppActive;
   }
 
+
+  /**
+   * @return true if authenticator app is active
+   */
   public boolean getAuthenticatorAppActive() {
     return authenticatorAppActive;
   }
 
+
+  /**
+   * @param authenticatorAppActive new status of authenticator app
+   * @return nothing
+   */
   public void setAuthenticatorAppActive(final boolean authenticatorAppActive) {
     this.authenticatorAppActive = authenticatorAppActive;
   }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppController.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppController.java
index dd6aabc7c..1afb9add9 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppController.java
@@ -46,9 +46,15 @@
 import it.infn.mw.iam.api.common.NoSuchAccountError;
 import it.infn.mw.iam.core.user.IamAccountService;
 import it.infn.mw.iam.core.user.exception.MfaSecretAlreadyBoundException;
+import it.infn.mw.iam.core.user.exception.MfaSecretNotFoundException;
+import it.infn.mw.iam.core.user.exception.TotpMfaAlreadyEnabledException;
 import it.infn.mw.iam.persistence.model.IamAccount;
 import it.infn.mw.iam.persistence.repository.IamAccountRepository;
 
+/**
+ * Controller for customising user's authenticator app MFA settings Can enable or disable the
+ * feature through POST requests to the relevant endpoints
+ */
 @SuppressWarnings("deprecation")
 @Controller
 public class AuthenticatorAppController {
@@ -72,6 +78,13 @@ public AuthenticatorAppController(IamAccountService service,
     this.codeVerifier = codeVerifier;
   }
 
+
+  /**
+   * Before we can enable authenticator app, we must first add a TOTP secret to the user's account
+   * The secret is not active until the user enables authenticator app at the /enable endpoint
+   * 
+   * @return DTO containing the plaintext TOTP secret and QR code URI for scanning
+   */
   @PreAuthorize("hasRole('USER')")
   @RequestMapping(value = ADD_SECRET_URL, method = RequestMethod.PUT,
       produces = MediaType.APPLICATION_JSON_VALUE)
@@ -94,6 +107,15 @@ public SecretAndDataUriDTO addSecret() {
     return dto;
   }
 
+
+  /**
+   * Enable authenticator app MFA on account User sends a TOTP through POST which we verify before
+   * enabling
+   * 
+   * @param code the TOTP to verify
+   * @param validationResult result of validation checks on the code
+   * @return nothing
+   */
   @PreAuthorize("hasRole('USER')")
   @RequestMapping(value = ENABLE_URL, method = RequestMethod.POST,
       produces = MediaType.TEXT_PLAIN_VALUE)
@@ -115,6 +137,15 @@ public void enableAuthenticatorApp(@ModelAttribute @Valid CodeDTO code,
     service.enableTotpMfa(account);
   }
 
+
+  /**
+   * Disable authenticator app MFA on account User sends a TOTP through POST which we verify before
+   * disabling
+   * 
+   * @param code the TOTP to verify
+   * @param validationResult result of validation checks on the code
+   * @return nothing
+   */
   @PreAuthorize("hasRole('USER')")
   @RequestMapping(value = DISABLE_URL, method = RequestMethod.POST,
       produces = MediaType.TEXT_PLAIN_VALUE)
@@ -135,6 +166,12 @@ public void disableAuthenticatorApp(@Valid CodeDTO code, BindingResult validatio
     service.disableTotpMfa(account);
   }
 
+
+  /**
+   * Fetch and return the logged-in username from security context
+   * 
+   * @return String username
+   */
   private String getUsernameFromSecurityContext() {
 
     Authentication auth = SecurityContextHolder.getContext().getAuthentication();
@@ -145,6 +182,16 @@ private String getUsernameFromSecurityContext() {
     return auth.getName();
   }
 
+
+  /**
+   * Constructs a data URI for displaying a QR code of the TOTP secret for the user to scan Takes in
+   * details about the issuer, length of TOTP and period of expiry from application properties
+   * 
+   * @param secret the TOTP secret
+   * @param username the logged-in user (attaches a username to the secret in the authenticator app)
+   * @return the data URI to be used with an  tag
+   * @throws QrGenerationException
+   */
   private String generateQRCodeFromSecret(String secret, String username)
       throws QrGenerationException {
 
@@ -169,6 +216,26 @@ private String generateQRCodeFromSecret(String secret, String username)
     return getDataUriForImage(imageData, mimeType);
   }
 
+
+  /**
+   * Exception handler for when an TOTP secret is unexpectedly missing
+   * 
+   * @param e MfaSecretNotFoundException
+   * @return DTO containing error details
+   */
+  @ResponseStatus(code = HttpStatus.CONFLICT)
+  @ExceptionHandler(MfaSecretNotFoundException.class)
+  @ResponseBody
+  public ErrorDTO handleMfaSecretNotFoundException(MfaSecretNotFoundException e) {
+    return ErrorDTO.fromString(e.getMessage());
+  }
+
+  /**
+   * Exception handler for when an TOTP secret is unexpectedly found
+   * 
+   * @param e MfaSecretAlreadyBoundException
+   * @return DTO containing error details
+   */
   @ResponseStatus(code = HttpStatus.CONFLICT)
   @ExceptionHandler(MfaSecretAlreadyBoundException.class)
   @ResponseBody
@@ -176,6 +243,26 @@ public ErrorDTO handleMfaSecretAlreadyBoundException(MfaSecretAlreadyBoundExcept
     return ErrorDTO.fromString(e.getMessage());
   }
 
+  /**
+   * Exception handler for when authenticator app MFA is unexpectedly enabled already
+   * 
+   * @param e TotpMfaAlreadyEnabledException
+   * @return DTO containing error details
+   */
+  @ResponseStatus(code = HttpStatus.CONFLICT)
+  @ExceptionHandler(TotpMfaAlreadyEnabledException.class)
+  @ResponseBody
+  public ErrorDTO handleTotpMfaAlreadyEnabledException(TotpMfaAlreadyEnabledException e) {
+    return ErrorDTO.fromString(e.getMessage());
+  }
+
+
+  /**
+   * Exception handler for when a received TOTP is invalid in format
+   * 
+   * @param e InvalidCodeError
+   * @return DTO containing error details
+   */
   @ResponseStatus(code = HttpStatus.BAD_REQUEST)
   @ExceptionHandler(InvalidCodeError.class)
   @ResponseBody
@@ -183,6 +270,13 @@ public ErrorDTO handleInvalidCodeError(InvalidCodeError e) {
     return ErrorDTO.fromString(e.getMessage());
   }
 
+
+  /**
+   * Exception handler for when a received TOTP is incorrect compared to what the IAM has
+   * 
+   * @param e IncorrectCodeError
+   * @return DTO containing error details
+   */
   @ResponseStatus(code = HttpStatus.BAD_REQUEST)
   @ExceptionHandler(IncorrectCodeError.class)
   @ResponseBody
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/CodeDTO.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/CodeDTO.java
index 31e73507d..a54fb2925 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/CodeDTO.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/CodeDTO.java
@@ -20,6 +20,9 @@
 
 import org.hibernate.validator.constraints.Length;
 
+/**
+ * DTO containing a TOTP for MFA secrets
+ */
 public class CodeDTO {
 
   @NotEmpty(message = "Code cannot be empty")
@@ -27,10 +30,19 @@ public class CodeDTO {
   @Min(value = 0L, message = "Code must be a numerical value")
   private String code;
 
+
+  /**
+   * @return the code
+   */
   public String getCode() {
     return code;
   }
 
+
+  /**
+   * @param code new code
+   * @return nothing
+   */
   public void setCode(final String code) {
     this.code = code;
   }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/SecretAndDataUriDTO.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/SecretAndDataUriDTO.java
index e33b963a6..2bfe60c48 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/SecretAndDataUriDTO.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/SecretAndDataUriDTO.java
@@ -17,6 +17,9 @@
 
 import javax.validation.constraints.NotEmpty;
 
+/**
+ * DTO containing an MFA secret and QR code data URI
+ */
 public class SecretAndDataUriDTO {
 
   @NotEmpty(message = "Secret cannot be empty")
@@ -28,18 +31,36 @@ public SecretAndDataUriDTO(final String secret) {
     this.secret = secret;
   }
 
+
+  /**
+   * @return the MFA secret
+   */
   public String getSecret() {
     return secret;
   }
 
+
+  /**
+   * @param secret the new secret
+   * @return nothing
+   */
   public void setSecret(final String secret) {
     this.secret = secret;
   }
 
+
+  /**
+   * @return the QR code data URI
+   */
   public String getDataUri() {
     return dataUri;
   }
 
+
+  /**
+   * @param dataUri the new QR code data URI
+   * @return nothing
+   */
   public void setDataUri(final String dataUri) {
     this.dataUri = dataUri;
   }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/IamTotpMfaConfig.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/IamTotpMfaConfig.java
index 8317fe482..5d6533699 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/IamTotpMfaConfig.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/IamTotpMfaConfig.java
@@ -31,27 +31,55 @@
 
 // TODO add admin config options from properties file
 
+/**
+ * Beans for handling TOTP MFA functionality
+ */
 @Configuration
 public class IamTotpMfaConfig {
 
+
+  /**
+   * Responsible for generating new TOTP secrets
+   * 
+   * @return SecretGenerator
+   */
   @Bean
   @Qualifier("secretGenerator")
   public SecretGenerator secretGenerator() {
     return new DefaultSecretGenerator();
   }
 
+
+  /**
+   * Responsible for generating QR code data URI strings from given input parameters, e.g. TOTP
+   * secret, issuer, etc.
+   * 
+   * @return QrGenerator
+   */
   @Bean
   @Qualifier("qrGenerator")
   public QrGenerator qrGenerator() {
     return new ZxingPngQrGenerator();
   }
 
+
+  /**
+   * Generates a TOTP from an MFA secret and verifies a user-provided TOTP matches it
+   * 
+   * @return CodeVerifier
+   */
   @Bean
   @Qualifier("codeVerifier")
   public CodeVerifier codeVerifier() {
     return new DefaultCodeVerifier(new DefaultCodeGenerator(), new SystemTimeProvider());
   }
 
+
+  /**
+   * Responsible for generating random recovery codes for backup authentication
+   * 
+   * @return RecoveryCodeGenerator
+   */
   @Bean
   @Qualifier("recoveryCodeGenerator")
   public RecoveryCodeGenerator recoveryCodeGenerator() {
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/DefaultIamAccountService.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/DefaultIamAccountService.java
index 71129c18c..85e13d084 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/DefaultIamAccountService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/DefaultIamAccountService.java
@@ -585,6 +585,15 @@ public void setApplicationEventPublisher(ApplicationEventPublisher applicationEv
 
   // TODO encrypt secret and recovery codes
   // TODO move this secret generation to its own class
+
+  /**
+   * Generates and attaches a TOTP MFA secret to a user account, along with a set of recovery codes
+   * This is pre-emptive to actually enabling TOTP MFA on the account - the secret is written for
+   * server-side TOTP verification
+   * 
+   * @param account the account to add the secret to
+   * @return the account with the new secret added to it
+   */
   @Override
   public IamAccount addTotpMfaSecret(IamAccount account) {
     if (!isNull(account.getTotpMfa()) && account.getTotpMfa().isActive()) {
@@ -592,9 +601,11 @@ public IamAccount addTotpMfaSecret(IamAccount account) {
           "A multi-factor secret is already assigned to this account");
     }
 
+    // Generate secret
     IamTotpMfa totpMfa = new IamTotpMfa(account);
     totpMfa.setSecret(secretGenerator.generate());
 
+    // Generate recovery codes
     String[] recoveryCodeStrings = recoveryCodeGenerator.generateCodes(6);
     Set recoveryCodes = new HashSet<>();
     for (String code : recoveryCodeStrings) {
@@ -603,6 +614,7 @@ public IamAccount addTotpMfaSecret(IamAccount account) {
       recoveryCodes.add(recoveryCode);
     }
 
+    // Attach to account
     totpMfa.setRecoveryCodes(recoveryCodes);
     account.setTotpMfa(totpMfa);
     totpMfa.setAccount(account);
@@ -611,11 +623,19 @@ public IamAccount addTotpMfaSecret(IamAccount account) {
     return account;
   }
 
+
+  /**
+   * Enables TOTP MFA on a provided account. Relies on the account already having a non-active TOTP
+   * secret attached to it
+   * 
+   * @param account the account to enable TOTP MFA on
+   * @return the account with newly-enabled TOTP MFA
+   */
   @Override
   public IamAccount enableTotpMfa(IamAccount account) {
     if (isNull(account.getTotpMfa())) {
       throw new MfaSecretNotFoundException("No multi-factor secret is attached to this account");
-    } else if (!isNull(account.getTotpMfa()) && account.getTotpMfa().isActive()) {
+    } else if (account.getTotpMfa().isActive()) {
       throw new TotpMfaAlreadyEnabledException("TOTP MFA is already enabled on this account");
     }
 
@@ -629,6 +649,15 @@ public IamAccount enableTotpMfa(IamAccount account) {
     return account;
   }
 
+
+  /**
+   * Disables TOTP MFA on a provided account. Relies on the account having an active TOTP secret
+   * attached to it. Disabling means to delete the secret entirely (if a user chooses to enable
+   * again, a new secret is generated anyway)
+   * 
+   * @param account the account to disable TOTP MFA on
+   * @return the account with newly-disabled TOTP MFA
+   */
   @Override
   public IamAccount disableTotpMfa(IamAccount account) {
     if (isNull(account.getTotpMfa())) {
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/IamAccountService.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/IamAccountService.java
index c2f99685e..b9b99b33b 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/IamAccountService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/IamAccountService.java
@@ -185,26 +185,25 @@ public interface IamAccountService {
   IamAccount removeSshKey(IamAccount account, IamSshKey key);
 
   /**
-   * Adds a multi-factor secret to an account
+   * Adds a TOTP secret to an account
    * 
-   * @param account
-   * @param totpMfa
+   * @param account the account to add the secret to
    * @return the updated account
    */
   IamAccount addTotpMfaSecret(IamAccount account);
 
   /**
-   * Enable multi-factor on account with TOTP secret
+   * Enable TOTP MFA on account with TOTP secret
    * 
-   * @param account
+   * @param account the account to enable TOTP MFA on
    * @return the updated account
    */
   IamAccount enableTotpMfa(IamAccount account);
 
   /**
-   * Disable multi-factor on account with TOTP secret
+   * Disable TOTP MFA on account with TOTP secret
    * 
-   * @param account
+   * @param account the account to disable TOTP MFA on
    * @return the updated account
    */
   IamAccount disableTotpMfa(IamAccount account);

From 81b536f04676fb2df85b2e44cd84aba5a2436373 Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Mon, 6 Dec 2021 16:09:08 +0000
Subject: [PATCH 37/76] Adding basic mfa login procedure

This displays a basic code form input page if a user logging in is detected to have MFA enabled. Uses authorisation to assign ROLE_PRE_AUTHENTICATED and a separate MultiFactorAuthenticationProvider for checking multi-factor status on account
---
 ...ltiFactorAuthenticationSuccessHandler.java | 155 ++++++++++++++++++
 .../MultiFactorAuthenticationProvider.java    |  70 ++++++++
 .../Verify2faController.java                  |  91 ++++++++++
 .../error/AccountNotFoundException.java       |  29 ++++
 .../config/security/IamWebSecurityConfig.java |  20 ++-
 .../webapp/WEB-INF/views/iam/verify2fa.jsp    |  42 +++++
 6 files changed, 401 insertions(+), 6 deletions(-)
 create mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/authn/MultiFactorAuthenticationSuccessHandler.java
 create mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorAuthenticationProvider.java
 create mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/Verify2faController.java
 create mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/error/AccountNotFoundException.java
 create mode 100644 iam-login-service/src/main/webapp/WEB-INF/views/iam/verify2fa.jsp

diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/MultiFactorAuthenticationSuccessHandler.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/MultiFactorAuthenticationSuccessHandler.java
new file mode 100644
index 000000000..2e3e1b71a
--- /dev/null
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/MultiFactorAuthenticationSuccessHandler.java
@@ -0,0 +1,155 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.infn.mw.iam.authn;
+
+import static it.infn.mw.iam.core.web.EnforceAupFilter.REQUESTING_SIGNATURE;
+
+import java.io.IOException;
+import java.util.Collection;
+import java.util.Date;
+import java.util.Optional;
+
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.servlet.http.HttpSession;
+
+import org.mitre.openid.connect.web.AuthenticationTimeStamper;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.oauth2.provider.OAuth2Authentication;
+import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
+// import org.springframework.security.web.savedrequest.RequestCache;
+
+import it.infn.mw.iam.api.account.AccountUtils;
+import it.infn.mw.iam.api.aup.AUPSignatureCheckService;
+import it.infn.mw.iam.core.util.IamAuthenticationLogger;
+import it.infn.mw.iam.persistence.model.IamAccount;
+import it.infn.mw.iam.persistence.repository.IamAccountRepository;
+
+@SuppressWarnings("deprecation")
+public class MultiFactorAuthenticationSuccessHandler implements AuthenticationSuccessHandler {
+
+  public static final String MFA_REDIRECTION_URL = "/iam/verify2fa";
+  private final AccountUtils accountUtils;
+  private final AuthenticationSuccessHandler rootIsDashboardSuccessHandler;
+  // private final String iamBaseUrl;
+  // private final RequestCache requestCache;
+  // private final EnforceAupSignatureSuccessHandler enforceAupSignatureSuccessHandler;
+  private final AUPSignatureCheckService aupSignatureCheckService;
+  private final IamAccountRepository accountRepo;
+
+  public MultiFactorAuthenticationSuccessHandler(AccountUtils accountUtils,
+      AuthenticationSuccessHandler delegate, AUPSignatureCheckService aupSignatureCheckService,
+      IamAccountRepository accountRepo) {
+    this.accountUtils = accountUtils;
+    this.rootIsDashboardSuccessHandler = delegate;
+    // this.iamBaseUrl = iamBaseUrl;
+    // this.requestCache = requestCache;
+    // this.enforceAupSignatureSuccessHandler = enforceAupSignatureSuccessHandler;
+    this.aupSignatureCheckService = aupSignatureCheckService;
+    this.accountRepo = accountRepo;
+  }
+
+  @Override
+  public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response,
+      Authentication authentication) throws IOException, ServletException {
+    handle(request, response, authentication);
+  }
+
+  protected void handle(HttpServletRequest request, HttpServletResponse response,
+      Authentication authentication) throws IOException, ServletException {
+    boolean isMfaEnabled = isMfaEnabled(authentication);
+
+    if (response.isCommitted()) {
+      System.out.println(
+          "Response has already been committed. Unable to redirect to " + MFA_REDIRECTION_URL);
+      return;
+    } else if (isMfaEnabled) {
+      // session.setAttribute(REQUESTING_SIGNATURE, true);
+      response.sendRedirect(MFA_REDIRECTION_URL);
+    } else {
+      continuewithDefaultSuccessHandler(request, response, authentication);
+    }
+  }
+
+  protected boolean isMfaEnabled(final Authentication authentication) {
+    final Collection authorities = authentication.getAuthorities();
+    for (final GrantedAuthority grantedAuthority : authorities) {
+      String authorityName = grantedAuthority.getAuthority();
+      if (authorityName.equals("ROLE_PRE_AUTHENTICATED")) {
+        return true;
+      }
+    }
+
+    // throw new IllegalStateException();
+    return false;
+  }
+
+  public void continuewithDefaultSuccessHandler(HttpServletRequest request,
+      HttpServletResponse response, Authentication auth) throws IOException, ServletException {
+    HttpSession session = request.getSession(false);
+
+    setAuthenticationTimestamp(request, auth);
+    touchLastLoginTimeForIamAccount(auth);
+
+    Optional authenticatedAccount = lookupAuthenticatedUser(auth);
+
+    if (!authenticatedAccount.isPresent()
+        || !aupSignatureCheckService.needsAupSignature(authenticatedAccount.get())) {
+      rootIsDashboardSuccessHandler.onAuthenticationSuccess(request, response, auth);
+
+    } else {
+      session.setAttribute(REQUESTING_SIGNATURE, true);
+      response.sendRedirect("/iam/aup/sign");
+    }
+  }
+
+  protected void setAuthenticationTimestamp(HttpServletRequest request,
+      Authentication authentication) {
+
+    Date timestamp = new Date();
+    HttpSession session = request.getSession();
+    session.setAttribute(AuthenticationTimeStamper.AUTH_TIMESTAMP, timestamp);
+    IamAuthenticationLogger.INSTANCE.logAuthenticationSuccess(authentication);
+  }
+
+  protected void touchLastLoginTimeForIamAccount(Authentication authentication) {
+
+    resolveUserAuthentication(authentication)
+      .ifPresent(a -> accountRepo.touchLastLoginTimeForUserWithUsername(a.getName()));
+  }
+
+  private Optional resolveUserAuthentication(Authentication auth) {
+    if (auth instanceof OAuth2Authentication) {
+      OAuth2Authentication oauth = (OAuth2Authentication) auth;
+      return Optional.ofNullable(oauth.getUserAuthentication());
+    }
+    return Optional.of(auth);
+  }
+
+  private Optional lookupAuthenticatedUser(Authentication auth) {
+
+    Optional userAuth = resolveUserAuthentication(auth);
+
+    if (userAuth.isPresent()) {
+      return accountUtils.getAuthenticatedUserAccount(userAuth.get());
+    }
+
+    return Optional.empty();
+
+  }
+}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorAuthenticationProvider.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorAuthenticationProvider.java
new file mode 100644
index 000000000..7d3568183
--- /dev/null
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorAuthenticationProvider.java
@@ -0,0 +1,70 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.infn.mw.iam.authn.multi_factor_authentication;
+
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+
+import org.springframework.security.authentication.AuthenticationProvider;
+import org.springframework.security.authentication.BadCredentialsException;
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.AuthenticationException;
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.authority.SimpleGrantedAuthority;
+import org.springframework.security.crypto.password.PasswordEncoder;
+
+import it.infn.mw.iam.api.common.NoSuchAccountError;
+import it.infn.mw.iam.persistence.model.IamAccount;
+import it.infn.mw.iam.persistence.repository.IamAccountRepository;
+
+public class MultiFactorAuthenticationProvider implements AuthenticationProvider {
+
+  private IamAccountRepository accountRepo;
+  private PasswordEncoder passwordEncoder;
+
+  public MultiFactorAuthenticationProvider(IamAccountRepository accountRepo,
+      PasswordEncoder passwordEncoder) {
+    this.accountRepo = accountRepo;
+    this.passwordEncoder = passwordEncoder;
+  }
+
+  @Override
+  public Authentication authenticate(Authentication authentication) throws AuthenticationException {
+    IamAccount account = accountRepo.findByUsername(authentication.getName())
+      .orElseThrow(() -> NoSuchAccountError.forUsername(authentication.getName()));
+    String password = authentication.getCredentials().toString();
+    if (!passwordEncoder.matches(password, account.getPassword())) {
+      throw new BadCredentialsException("Invalid login details");
+    }
+
+    if (account.getTotpMfa() != null && account.getTotpMfa().isActive()) {
+      List updatedAuthorities =
+          new ArrayList<>(Arrays.asList(new SimpleGrantedAuthority("ROLE_PRE_AUTHENTICATED")));
+
+      return new UsernamePasswordAuthenticationToken(authentication.getPrincipal(),
+          authentication.getCredentials(), updatedAuthorities);
+    }
+
+    return null;
+  }
+
+  @Override
+  public boolean supports(Class authentication) {
+    return authentication.equals(UsernamePasswordAuthenticationToken.class);
+  }
+}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/Verify2faController.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/Verify2faController.java
new file mode 100644
index 000000000..30151c588
--- /dev/null
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/Verify2faController.java
@@ -0,0 +1,91 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.infn.mw.iam.authn.multi_factor_authentication;
+
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+
+import javax.validation.Valid;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.authority.SimpleGrantedAuthority;
+import org.springframework.security.core.context.SecurityContext;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.stereotype.Controller;
+import org.springframework.validation.BindingResult;
+import org.springframework.web.bind.annotation.ModelAttribute;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
+
+import dev.samstevens.totp.code.CodeVerifier;
+import it.infn.mw.iam.api.account.AccountUtils;
+import it.infn.mw.iam.api.account.multi_factor_authentication.authenticator_app.CodeDTO;
+import it.infn.mw.iam.api.account.multi_factor_authentication.authenticator_app.error.IncorrectCodeError;
+import it.infn.mw.iam.api.account.multi_factor_authentication.authenticator_app.error.InvalidCodeError;
+import it.infn.mw.iam.authn.multi_factor_authentication.error.AccountNotFoundException;
+import it.infn.mw.iam.persistence.model.IamAccount;
+
+@Controller
+public class Verify2faController {
+
+  private final AccountUtils accountUtils;
+  private final CodeVerifier codeVerifier;
+
+  @Autowired
+  public Verify2faController(AccountUtils accountUtils, CodeVerifier codeVerifier) {
+    this.accountUtils = accountUtils;
+    this.codeVerifier = codeVerifier;
+  }
+
+  @PreAuthorize("hasRole('PRE_AUTHENTICATED')")
+  @RequestMapping(method = RequestMethod.GET, path = "/iam/verify2fa")
+  public String getVerify2faView() {
+    return "iam/verify2fa";
+  }
+
+  @PreAuthorize("hasRole('PRE_AUTHENTICATED')")
+  @RequestMapping(method = RequestMethod.POST, path = "/iam/verify2fa")
+  public String verify2fa(@ModelAttribute @Valid CodeDTO code, BindingResult validationResult) {
+    if (validationResult.hasErrors()) {
+      throw new InvalidCodeError("Invalid code format. Code must be six numeric characters");
+    }
+
+    IamAccount account = accountUtils.getAuthenticatedUserAccount()
+      .orElseThrow(() -> new AccountNotFoundException("Account not found"));
+
+    if (!codeVerifier.isValidCode(account.getTotpMfa().getSecret(), code.getCode())) {
+      throw new IncorrectCodeError("Incorrect code. Try again");
+    }
+
+    SecurityContext sc = SecurityContextHolder.getContext();
+    Authentication authentication = sc.getAuthentication();
+    List updatedAuthorities =
+        new ArrayList<>(Arrays.asList(new SimpleGrantedAuthority("ROLE_USER")));
+
+    Authentication newAuth = new UsernamePasswordAuthenticationToken(authentication.getPrincipal(),
+        authentication.getCredentials(), updatedAuthorities);
+    sc.setAuthentication(newAuth);
+
+    // TODO touch account, i.e. log the successful verification
+
+    return "redirect:/dashboard";
+  }
+}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/error/AccountNotFoundException.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/error/AccountNotFoundException.java
new file mode 100644
index 000000000..79661030a
--- /dev/null
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/error/AccountNotFoundException.java
@@ -0,0 +1,29 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.infn.mw.iam.authn.multi_factor_authentication.error;
+
+public class AccountNotFoundException extends RuntimeException {
+
+  /**
+   * 
+   */
+  private static final long serialVersionUID = 1L;
+
+  public AccountNotFoundException(String message) {
+    super(message);
+  }
+
+}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java
index d01c8512d..717647c4d 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java
@@ -50,10 +50,12 @@
 
 import it.infn.mw.iam.api.account.AccountUtils;
 import it.infn.mw.iam.api.aup.AUPSignatureCheckService;
-import it.infn.mw.iam.authn.EnforceAupSignatureSuccessHandler;
+// import it.infn.mw.iam.authn.EnforceAupSignatureSuccessHandler;
 import it.infn.mw.iam.authn.ExternalAuthenticationHintService;
 import it.infn.mw.iam.authn.HintAwareAuthenticationEntryPoint;
+import it.infn.mw.iam.authn.MultiFactorAuthenticationSuccessHandler;
 import it.infn.mw.iam.authn.RootIsDashboardSuccessHandler;
+import it.infn.mw.iam.authn.multi_factor_authentication.MultiFactorAuthenticationProvider;
 import it.infn.mw.iam.authn.oidc.OidcAuthenticationProvider;
 import it.infn.mw.iam.authn.oidc.OidcClientFilter;
 import it.infn.mw.iam.authn.x509.IamX509AuthenticationProvider;
@@ -63,13 +65,14 @@
 import it.infn.mw.iam.config.IamProperties;
 import it.infn.mw.iam.core.IamLocalAuthenticationProvider;
 import it.infn.mw.iam.persistence.repository.IamAccountRepository;
+import it.infn.mw.iam.persistence.repository.IamAuthoritiesRepository;
 
 @SuppressWarnings("deprecation")
 @Configuration
 @EnableWebSecurity
 public class IamWebSecurityConfig {
-  
-  
+
+
 
   @Bean
   public SecurityEvaluationContextExtension contextExtension() {
@@ -106,6 +109,7 @@ public static class UserLoginConfig extends WebSecurityConfigurerAdapter {
     @Autowired
     private IamAccountRepository accountRepo;
 
+
     @Autowired
     private AUPSignatureCheckService aupSignatureCheckService;
 
@@ -121,6 +125,7 @@ public static class UserLoginConfig extends WebSecurityConfigurerAdapter {
     @Autowired
     public void configureGlobal(final AuthenticationManagerBuilder auth) throws Exception {
       // @formatter:off
+      auth.authenticationProvider(new MultiFactorAuthenticationProvider(accountRepo, passwordEncoder));
       auth.authenticationProvider(new IamLocalAuthenticationProvider(iamProperties, iamUserDetailsService, passwordEncoder));
       // @formatter:on
     }
@@ -194,15 +199,18 @@ public AuthenticationSuccessHandler successHandler() {
       AuthenticationSuccessHandler delegate =
           new RootIsDashboardSuccessHandler(iamBaseUrl, new HttpSessionRequestCache());
 
-      return new EnforceAupSignatureSuccessHandler(delegate, aupSignatureCheckService, accountUtils,
-          accountRepo);
+      return new MultiFactorAuthenticationSuccessHandler(accountUtils, delegate,
+          aupSignatureCheckService, accountRepo);
+
+      // return new EnforceAupSignatureSuccessHandler(delegate, aupSignatureCheckService,
+      // accountUtils, accountRepo);
     }
   }
 
   @Configuration
   @Order(101)
   public static class RegistrationConfig extends WebSecurityConfigurerAdapter {
-    
+
     public static final String START_REGISTRATION_ENDPOINT = "/start-registration";
 
     @Autowired
diff --git a/iam-login-service/src/main/webapp/WEB-INF/views/iam/verify2fa.jsp b/iam-login-service/src/main/webapp/WEB-INF/views/iam/verify2fa.jsp
new file mode 100644
index 000000000..3fb4c460f
--- /dev/null
+++ b/iam-login-service/src/main/webapp/WEB-INF/views/iam/verify2fa.jsp
@@ -0,0 +1,42 @@
+<%--
+
+    Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
+
+        http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
+
+--%>
+<%@ taglib prefix="authz" uri="http://www.springframework.org/security/tags"%>
+<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%>
+<%@ taglib prefix="t" tagdir="/WEB-INF/tags/iam"%>
+<%@ taglib prefix="spring" uri="http://www.springframework.org/tags"%>
+
+  
+  

+    

+      
+        
+      
+      
+    

+  

+    
+    
+  

+
+
\ No newline at end of file

From c9feb7c579731c04f4b751784bd61ca0c09f45f3 Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Tue, 7 Dec 2021 17:02:10 +0000
Subject: [PATCH 38/76] Improving TOTP input screen post-login, fixing Java 17
 Docker upgrade issue

Improving the look and feel of the form for inputting a TOTP after logging in with an MFA user. This form will be the basis of step-up authentication and will be navigated to whenever the user is required to verify their identity again.

Will separate the controller for this stage into two distinct paths so that we have one verify "homepage" where the user can choose which factor of authentication to use and then a sub-resource, /verify/authenticator-app for example, which we POST the TOTP to.

Still to add in error checking of TOTP on the verify form.

Also fixing a problem with the test-client's Dockerfile which meant that the Dockerised IAM could not properly start following the upgrade to Java 17.
---
 ...> AuthenticatorAppSettingsController.java} |  4 +-
 ...ntroller.java => MfaVerifyController.java} | 10 ++--
 .../it/infn/mw/iam/config/IamProperties.java  | 28 ++++++-----
 .../VerifyButtonProperties.java               | 50 +++++++++++++++++++
 .../config/security/IamWebSecurityConfig.java |  3 +-
 .../iam/core/web/IamViewInfoInterceptor.java  | 22 +++++---
 ...tiFactorVerificationPageConfiguration.java | 37 ++++++++++++++
 ...tiFactorVerificationPageConfiguration.java | 10 ++++
 ....jsp => verify-authenticator-app-form.jsp} | 21 +++-----
 .../webapp/WEB-INF/views/iam/verify-mfa.jsp   | 44 ++++++++++++++++
 .../src/main/webapp/resources/iam/css/iam.css | 10 ++--
 .../MultiFactorSettingsTests.java             |  3 --
 .../AuthenticatorAppTests.java                | 40 ++++++++-------
 iam-test-client/docker/Dockerfile             |  2 +-
 iam-test-client/docker/Dockerfile.prod        |  2 +-
 15 files changed, 217 insertions(+), 69 deletions(-)
 rename iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/{AuthenticatorAppController.java => AuthenticatorAppSettingsController.java} (98%)
 rename iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/{Verify2faController.java => MfaVerifyController.java} (89%)
 create mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/config/multi_factor_authentication/VerifyButtonProperties.java
 create mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/core/web/multi_factor_authentication/DefaultMultiFactorVerificationPageConfiguration.java
 create mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/core/web/multi_factor_authentication/MultiFactorVerificationPageConfiguration.java
 rename iam-login-service/src/main/webapp/WEB-INF/views/iam/{verify2fa.jsp => verify-authenticator-app-form.jsp} (59%)
 create mode 100644 iam-login-service/src/main/webapp/WEB-INF/views/iam/verify-mfa.jsp

diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppController.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppSettingsController.java
similarity index 98%
rename from iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppController.java
rename to iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppSettingsController.java
index 1afb9add9..38628ef19 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppSettingsController.java
@@ -57,7 +57,7 @@
  */
 @SuppressWarnings("deprecation")
 @Controller
-public class AuthenticatorAppController {
+public class AuthenticatorAppSettingsController {
 
   public static final String BASE_URL = "/iam/authenticator-app";
   public static final String ADD_SECRET_URL = BASE_URL + "/add-secret";
@@ -70,7 +70,7 @@ public class AuthenticatorAppController {
   private CodeVerifier codeVerifier;
 
   @Autowired
-  public AuthenticatorAppController(IamAccountService service,
+  public AuthenticatorAppSettingsController(IamAccountService service,
       IamAccountRepository accountRepository, QrGenerator qrGenerator, CodeVerifier codeVerifier) {
     this.service = service;
     this.accountRepository = accountRepository;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/Verify2faController.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MfaVerifyController.java
similarity index 89%
rename from iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/Verify2faController.java
rename to iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MfaVerifyController.java
index 30151c588..dc888e6d5 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/Verify2faController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MfaVerifyController.java
@@ -43,14 +43,16 @@
 import it.infn.mw.iam.authn.multi_factor_authentication.error.AccountNotFoundException;
 import it.infn.mw.iam.persistence.model.IamAccount;
 
+//TODO when unauthenticated and navigating to other pages like /dashboard, we redirect to /login. But here we show up as unauthorized. Can we replicate the behaviour of /dashboard?
+
 @Controller
-public class Verify2faController {
+public class MfaVerifyController {
 
   private final AccountUtils accountUtils;
   private final CodeVerifier codeVerifier;
 
   @Autowired
-  public Verify2faController(AccountUtils accountUtils, CodeVerifier codeVerifier) {
+  public MfaVerifyController(AccountUtils accountUtils, CodeVerifier codeVerifier) {
     this.accountUtils = accountUtils;
     this.codeVerifier = codeVerifier;
   }
@@ -58,9 +60,11 @@ public Verify2faController(AccountUtils accountUtils, CodeVerifier codeVerifier)
   @PreAuthorize("hasRole('PRE_AUTHENTICATED')")
   @RequestMapping(method = RequestMethod.GET, path = "/iam/verify2fa")
   public String getVerify2faView() {
-    return "iam/verify2fa";
+    return "iam/verify-mfa";
   }
 
+  // TODO separate this into a different path. Currently spring complains about a lack of an
+  // authentication object in security context
   @PreAuthorize("hasRole('PRE_AUTHENTICATED')")
   @RequestMapping(method = RequestMethod.POST, path = "/iam/verify2fa")
   public String verify2fa(@ModelAttribute @Valid CodeDTO code, BindingResult validationResult) {
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/IamProperties.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/IamProperties.java
index 661c3c624..0ce602fd4 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/IamProperties.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/IamProperties.java
@@ -28,28 +28,22 @@
 
 import it.infn.mw.iam.authn.ExternalAuthenticationRegistrationInfo.ExternalAuthenticationType;
 import it.infn.mw.iam.config.login.LoginButtonProperties;
+import it.infn.mw.iam.config.multi_factor_authentication.VerifyButtonProperties;
 
 @Component
 @ConfigurationProperties(prefix = "iam")
 public class IamProperties {
 
   public enum EditableFields {
-    NAME,
-    SURNAME,
-    EMAIL,
-    PICTURE
+    NAME, SURNAME, EMAIL, PICTURE
   }
 
   public enum LocalAuthenticationAllowedUsers {
-    ALL,
-    VO_ADMINS,
-    NONE
+    ALL, VO_ADMINS, NONE
   }
 
   public enum LocalAuthenticationLoginPageMode {
-    VISIBLE,
-    HIDDEN,
-    HIDDEN_WITH_LINK
+    VISIBLE, HIDDEN, HIDDEN_WITH_LINK
   }
 
   public static class AccountLinkingProperties {
@@ -352,9 +346,7 @@ public void setDefaultJweEncryptKeyId(String defaultJweEncryptKeyId) {
   public static class JWTProfile {
 
     public enum Profile {
-      IAM,
-      WLCG,
-      AARC
+      IAM, WLCG, AARC
     }
 
     Profile defaultProfile = Profile.IAM;
@@ -540,6 +532,8 @@ public void setUrnNamespace(String urnNamespace) {
 
   private LoginButtonProperties loginButton = new LoginButtonProperties();
 
+  private VerifyButtonProperties verifyButton = new VerifyButtonProperties();
+
   private RegistractionAccessToken token = new RegistractionAccessToken();
 
   private PrivacyPolicy privacyPolicy = new PrivacyPolicy();
@@ -638,6 +632,14 @@ public void setLoginButton(LoginButtonProperties loginButton) {
     this.loginButton = loginButton;
   }
 
+  public VerifyButtonProperties getVerifyButton() {
+    return verifyButton;
+  }
+
+  public void setVerifyButton(VerifyButtonProperties verifyButton) {
+    this.verifyButton = verifyButton;
+  }
+
   public void setPrivacyPolicy(PrivacyPolicy privacyPolicy) {
     this.privacyPolicy = privacyPolicy;
   }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/multi_factor_authentication/VerifyButtonProperties.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/multi_factor_authentication/VerifyButtonProperties.java
new file mode 100644
index 000000000..5e07b6d55
--- /dev/null
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/multi_factor_authentication/VerifyButtonProperties.java
@@ -0,0 +1,50 @@
+package it.infn.mw.iam.config.multi_factor_authentication;
+
+import javax.validation.constraints.NotBlank;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonInclude.Include;
+
+@JsonInclude(Include.NON_EMPTY)
+public class VerifyButtonProperties {
+  private String text;
+
+  private String title;
+
+  @NotBlank
+  private String style = "btn-verify";
+
+  private boolean visible = true;
+
+  public String getText() {
+    return text;
+  }
+
+  public void setText(String text) {
+    this.text = text;
+  }
+
+  public String getStyle() {
+    return style;
+  }
+
+  public void setStyle(String style) {
+    this.style = style;
+  }
+
+  public boolean isVisible() {
+    return visible;
+  }
+
+  public void setVisible(boolean visible) {
+    this.visible = visible;
+  }
+
+  public String getTitle() {
+    return title;
+  }
+
+  public void setTitle(String title) {
+    this.title = title;
+  }
+}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java
index 717647c4d..9794d407d 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java
@@ -65,7 +65,6 @@
 import it.infn.mw.iam.config.IamProperties;
 import it.infn.mw.iam.core.IamLocalAuthenticationProvider;
 import it.infn.mw.iam.persistence.repository.IamAccountRepository;
-import it.infn.mw.iam.persistence.repository.IamAuthoritiesRepository;
 
 @SuppressWarnings("deprecation")
 @Configuration
@@ -109,7 +108,6 @@ public static class UserLoginConfig extends WebSecurityConfigurerAdapter {
     @Autowired
     private IamAccountRepository accountRepo;
 
-
     @Autowired
     private AUPSignatureCheckService aupSignatureCheckService;
 
@@ -195,6 +193,7 @@ public OAuth2WebSecurityExpressionHandler oAuth2WebSecurityExpressionHandler() {
       return new OAuth2WebSecurityExpressionHandler();
     }
 
+    // TODO refactor this
     public AuthenticationSuccessHandler successHandler() {
       AuthenticationSuccessHandler delegate =
           new RootIsDashboardSuccessHandler(iamBaseUrl, new HttpSessionRequestCache());
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/web/IamViewInfoInterceptor.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/web/IamViewInfoInterceptor.java
index 25291ef5d..5b381ed9b 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/web/IamViewInfoInterceptor.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/web/IamViewInfoInterceptor.java
@@ -25,12 +25,15 @@
 
 import it.infn.mw.iam.config.IamProperties;
 import it.infn.mw.iam.config.saml.IamSamlProperties;
+import it.infn.mw.iam.core.web.multi_factor_authentication.MultiFactorVerificationPageConfiguration;
 import it.infn.mw.iam.rcauth.RCAuthProperties;
 
 @Component
 public class IamViewInfoInterceptor implements HandlerInterceptor {
 
   public static final String LOGIN_PAGE_CONFIGURATION_KEY = "loginPageConfiguration";
+  public static final String MULTI_FACTOR_VERIFICATION_KEY =
+      "multiFactorVerificationPageConfiguration";
   public static final String ORGANISATION_NAME_KEY = "iamOrganisationName";
   public static final String IAM_SAML_PROPERTIES_KEY = "iamSamlProperties";
   public static final String IAM_OIDC_PROPERTIES_KEY = "iamOidcProperties";
@@ -49,13 +52,16 @@ public class IamViewInfoInterceptor implements HandlerInterceptor {
 
   @Value("${iam.organisation.name}")
   String organisationName;
-  
+
   @Autowired
   LoginPageConfiguration loginPageConfiguration;
 
+  @Autowired
+  MultiFactorVerificationPageConfiguration multiFactorVerificationPageConfiguration;
+
   @Autowired
   IamSamlProperties samlProperties;
-  
+
   @Autowired
   RCAuthProperties rcAuthProperties;
 
@@ -65,18 +71,20 @@ public class IamViewInfoInterceptor implements HandlerInterceptor {
   @Override
   public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler)
       throws Exception {
-    
+
     request.setAttribute(IAM_VERSION_KEY, iamVersion);
     request.setAttribute(GIT_COMMIT_ID_KEY, gitCommitId);
 
     request.setAttribute(ORGANISATION_NAME_KEY, organisationName);
-    
+
     request.setAttribute(LOGIN_PAGE_CONFIGURATION_KEY, loginPageConfiguration);
-    
+
+    request.setAttribute(MULTI_FACTOR_VERIFICATION_KEY, multiFactorVerificationPageConfiguration);
+
     request.setAttribute(IAM_SAML_PROPERTIES_KEY, samlProperties);
-    
+
     request.setAttribute(RCAUTH_ENABLED_KEY, rcAuthProperties.isEnabled());
-    
+
 
     if (iamProperties.getVersionedStaticResources().isEnableVersioning()) {
       request.setAttribute(RESOURCES_PATH_KEY, String.format("/resources/%s", gitCommitId));
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/web/multi_factor_authentication/DefaultMultiFactorVerificationPageConfiguration.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/web/multi_factor_authentication/DefaultMultiFactorVerificationPageConfiguration.java
new file mode 100644
index 000000000..c793c07f6
--- /dev/null
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/web/multi_factor_authentication/DefaultMultiFactorVerificationPageConfiguration.java
@@ -0,0 +1,37 @@
+package it.infn.mw.iam.core.web.multi_factor_authentication;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Component;
+
+import it.infn.mw.iam.config.IamProperties;
+import it.infn.mw.iam.config.IamProperties.Logo;
+
+import com.google.common.base.Strings;
+
+@Component
+public class DefaultMultiFactorVerificationPageConfiguration
+    implements MultiFactorVerificationPageConfiguration {
+
+  private final IamProperties iamProperties;
+
+  public static final String DEFAULT_VERIFICATION_BUTTON_TEXT = "Verify";
+
+  @Autowired
+  public DefaultMultiFactorVerificationPageConfiguration(IamProperties properties) {
+    this.iamProperties = properties;
+  }
+
+  @Override
+  public Logo getLogo() {
+    return iamProperties.getLogo();
+  }
+
+  @Override
+  public String getVerifyButtonText() {
+    if (Strings.isNullOrEmpty(iamProperties.getVerifyButton().getText())) {
+      return DEFAULT_VERIFICATION_BUTTON_TEXT;
+    }
+    return iamProperties.getVerifyButton().getText();
+  }
+
+}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/web/multi_factor_authentication/MultiFactorVerificationPageConfiguration.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/web/multi_factor_authentication/MultiFactorVerificationPageConfiguration.java
new file mode 100644
index 000000000..460bdcbdd
--- /dev/null
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/web/multi_factor_authentication/MultiFactorVerificationPageConfiguration.java
@@ -0,0 +1,10 @@
+package it.infn.mw.iam.core.web.multi_factor_authentication;
+
+import it.infn.mw.iam.config.IamProperties.Logo;
+
+public interface MultiFactorVerificationPageConfiguration {
+
+  String getVerifyButtonText();
+
+  Logo getLogo();
+}
diff --git a/iam-login-service/src/main/webapp/WEB-INF/views/iam/verify2fa.jsp b/iam-login-service/src/main/webapp/WEB-INF/views/iam/verify-authenticator-app-form.jsp
similarity index 59%
rename from iam-login-service/src/main/webapp/WEB-INF/views/iam/verify2fa.jsp
rename to iam-login-service/src/main/webapp/WEB-INF/views/iam/verify-authenticator-app-form.jsp
index 3fb4c460f..690f99502 100644
--- a/iam-login-service/src/main/webapp/WEB-INF/views/iam/verify2fa.jsp
+++ b/iam-login-service/src/main/webapp/WEB-INF/views/iam/verify-authenticator-app-form.jsp
@@ -19,24 +19,19 @@
 <%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%>
 <%@ taglib prefix="t" tagdir="/WEB-INF/tags/iam"%>
 <%@ taglib prefix="spring" uri="http://www.springframework.org/tags"%>
-

-  
+
+  
For your security, please enter a code from your authenticator app

   

     

       
-        
+        
       
-      
+      
     

   

     
-    
+    
   

-
-
\ No newline at end of file
+
\ No newline at end of file
diff --git a/iam-login-service/src/main/webapp/WEB-INF/views/iam/verify-mfa.jsp b/iam-login-service/src/main/webapp/WEB-INF/views/iam/verify-mfa.jsp
new file mode 100644
index 000000000..9cdc72ed5
--- /dev/null
+++ b/iam-login-service/src/main/webapp/WEB-INF/views/iam/verify-mfa.jsp
@@ -0,0 +1,44 @@
+<%--
+
+    Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
+
+        http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
+
+--%>
+<%@ taglib prefix="authz" uri="http://www.springframework.org/security/tags"%>
+<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%>
+<%@ taglib prefix="t" tagdir="/WEB-INF/tags/iam"%>
+<%@ taglib prefix="spring" uri="http://www.springframework.org/tags"%>
+
+  
+        
+        
+        
+    
+  
+    

+      
+        
Incorrect code. Try again

+      
+      
+        

+          
+            
+          
+          
${SPRING_SECURITY_LAST_EXCEPTION.message}

+        

+      
+    

+    
+  
+
\ No newline at end of file
diff --git a/iam-login-service/src/main/webapp/resources/iam/css/iam.css b/iam-login-service/src/main/webapp/resources/iam/css/iam.css
index ad07f564c..464ff7955 100644
--- a/iam-login-service/src/main/webapp/resources/iam/css/iam.css
+++ b/iam-login-service/src/main/webapp/resources/iam/css/iam.css
@@ -65,7 +65,7 @@
     text-align: center;
 }
 
-#login-form {
+#login-form #verify-form {
     padding-top: 1em;
     margin: 0 auto;
     max-width: 250px;
@@ -101,7 +101,7 @@
     text-align: center;
 }
 
-#login-error {
+#login-error #verify-error {
     margin: 0 auto;
     max-width: 400px;
 }
@@ -314,13 +314,13 @@ body.skin-blue {
     border-bottom: none;
 }
 
-.btn-login {
+.btn-login .btn-verify {
     background-color: white;
     border-color: #ddd;
     color: inherit;
 }
 
-.btn-login:hover {
+.btn-login:hover .btn-verify:hover {
     background-color: white;
 }
 
@@ -343,7 +343,7 @@ body.skin-blue {
     margin-top: 1em;
 }
 
-.signin-preamble {
+.signin-preamble .verify-preamble {
     margin-bottom: 1em;
     text-align: center;
 }
diff --git a/iam-login-service/src/test/java/it/infn/mw/iam/test/api/account/multi_factor_authentication/MultiFactorSettingsTests.java b/iam-login-service/src/test/java/it/infn/mw/iam/test/api/account/multi_factor_authentication/MultiFactorSettingsTests.java
index 8439ee8d4..6333f415e 100644
--- a/iam-login-service/src/test/java/it/infn/mw/iam/test/api/account/multi_factor_authentication/MultiFactorSettingsTests.java
+++ b/iam-login-service/src/test/java/it/infn/mw/iam/test/api/account/multi_factor_authentication/MultiFactorSettingsTests.java
@@ -35,7 +35,6 @@
 import it.infn.mw.iam.api.scim.model.ScimName;
 import it.infn.mw.iam.api.scim.model.ScimUser;
 import it.infn.mw.iam.api.scim.provisioning.ScimUserProvisioning;
-import it.infn.mw.iam.persistence.repository.IamAccountRepository;
 import it.infn.mw.iam.test.TestUtils;
 import it.infn.mw.iam.test.util.annotation.IamRandomPortIntegrationTest;
 
@@ -56,8 +55,6 @@ public class MultiFactorSettingsTests {
 
   @Autowired
   private ScimUserProvisioning userService;
-  @Autowired
-  private IamAccountRepository accountRepository;
 
   @BeforeClass
   public static void init() {
diff --git a/iam-login-service/src/test/java/it/infn/mw/iam/test/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppTests.java b/iam-login-service/src/test/java/it/infn/mw/iam/test/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppTests.java
index 54c3877d0..f674c8aec 100644
--- a/iam-login-service/src/test/java/it/infn/mw/iam/test/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppTests.java
+++ b/iam-login-service/src/test/java/it/infn/mw/iam/test/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppTests.java
@@ -36,7 +36,7 @@
 import dev.samstevens.totp.code.CodeVerifier;
 import io.restassured.RestAssured;
 import io.restassured.response.ValidatableResponse;
-import it.infn.mw.iam.api.account.multi_factor_authentication.authenticator_app.AuthenticatorAppController;
+import it.infn.mw.iam.api.account.multi_factor_authentication.authenticator_app.AuthenticatorAppSettingsController;
 import it.infn.mw.iam.api.scim.model.ScimEmail;
 import it.infn.mw.iam.api.scim.model.ScimName;
 import it.infn.mw.iam.api.scim.model.ScimUser;
@@ -105,7 +105,7 @@ private ValidatableResponse doPut(String accessToken) {
       .log()
       .all(true)
       .when()
-      .put(AuthenticatorAppController.ADD_SECRET_URL)
+      .put(AuthenticatorAppSettingsController.ADD_SECRET_URL)
       .then()
       .log()
       .all(true);
@@ -117,7 +117,7 @@ private ValidatableResponse doPut() {
       .log()
       .all(true)
       .when()
-      .put(AuthenticatorAppController.ADD_SECRET_URL)
+      .put(AuthenticatorAppSettingsController.ADD_SECRET_URL)
       .then()
       .log()
       .all(true);
@@ -189,7 +189,7 @@ public void testEnableAuthenticatorApp() throws Exception {
 
     when(codeVerifier.isValidCode(anyString(), anyString())).thenReturn(true);
 
-    doPost(accessToken, AuthenticatorAppController.ENABLE_URL, code)
+    doPost(accessToken, AuthenticatorAppSettingsController.ENABLE_URL, code)
       .statusCode(HttpStatus.OK.value());
   }
 
@@ -212,7 +212,7 @@ public void testEnableAuthenticatorAppIncorrectCode() throws Exception {
 
     when(codeVerifier.isValidCode(anyString(), anyString())).thenReturn(false);
 
-    doPost(accessToken, AuthenticatorAppController.ENABLE_URL, code)
+    doPost(accessToken, AuthenticatorAppSettingsController.ENABLE_URL, code)
       .statusCode(HttpStatus.BAD_REQUEST.value())
       .body(containsString("Incorrect code"));
   }
@@ -226,7 +226,7 @@ public void testEnableAuthenticatorAppInvalidCharactersInCode() throws Exception
 
     String code = "abcdef";
 
-    doPost(accessToken, AuthenticatorAppController.ENABLE_URL, code)
+    doPost(accessToken, AuthenticatorAppSettingsController.ENABLE_URL, code)
       .statusCode(HttpStatus.BAD_REQUEST.value())
       .body(containsString("Invalid code format"));
   }
@@ -240,7 +240,7 @@ public void testEnableAuthenticatorAppCodeTooShort() throws Exception {
 
     String code = "12345";
 
-    doPost(accessToken, AuthenticatorAppController.ENABLE_URL, code)
+    doPost(accessToken, AuthenticatorAppSettingsController.ENABLE_URL, code)
       .statusCode(HttpStatus.BAD_REQUEST.value())
       .body(containsString("Invalid code format"));
   }
@@ -254,7 +254,7 @@ public void testEnableAuthenticatorAppCodeTooLong() throws Exception {
 
     String code = "1234567";
 
-    doPost(accessToken, AuthenticatorAppController.ENABLE_URL, code)
+    doPost(accessToken, AuthenticatorAppSettingsController.ENABLE_URL, code)
       .statusCode(HttpStatus.BAD_REQUEST.value())
       .body(containsString("Invalid code format"));
   }
@@ -268,7 +268,7 @@ public void testEnableAuthenticatorAppNullCode() throws Exception {
 
     String code = null;
 
-    doPost(accessToken, AuthenticatorAppController.ENABLE_URL, code)
+    doPost(accessToken, AuthenticatorAppSettingsController.ENABLE_URL, code)
       .statusCode(HttpStatus.BAD_REQUEST.value())
       .body(containsString("Invalid code format"));
   }
@@ -282,7 +282,7 @@ public void testEnableAuthenticatorAppEmptyCode() throws Exception {
 
     String code = "";
 
-    doPost(accessToken, AuthenticatorAppController.ENABLE_URL, code)
+    doPost(accessToken, AuthenticatorAppSettingsController.ENABLE_URL, code)
       .statusCode(HttpStatus.BAD_REQUEST.value())
       .body(containsString("Invalid code format"));
   }
@@ -291,7 +291,8 @@ public void testEnableAuthenticatorAppEmptyCode() throws Exception {
   public void testEnableAuthenticatorAppFullAuthenticationRequired() {
     String code = "123456";
 
-    doPost(AuthenticatorAppController.ENABLE_URL, code).statusCode(HttpStatus.UNAUTHORIZED.value())
+    doPost(AuthenticatorAppSettingsController.ENABLE_URL, code)
+      .statusCode(HttpStatus.UNAUTHORIZED.value())
       .body("error", equalTo("unauthorized"))
       .body("error_description",
           equalTo("Full authentication is required to access this resource"));
@@ -316,7 +317,7 @@ public void testDisableAuthenticatorApp() throws Exception {
 
     when(codeVerifier.isValidCode(anyString(), anyString())).thenReturn(true);
 
-    doPost(accessToken, AuthenticatorAppController.DISABLE_URL, code)
+    doPost(accessToken, AuthenticatorAppSettingsController.DISABLE_URL, code)
       .statusCode(HttpStatus.OK.value());
   }
 
@@ -339,7 +340,7 @@ public void testDisableAuthenticatorAppIncorrectCode() throws Exception {
 
     when(codeVerifier.isValidCode(anyString(), anyString())).thenReturn(false);
 
-    doPost(accessToken, AuthenticatorAppController.DISABLE_URL, code)
+    doPost(accessToken, AuthenticatorAppSettingsController.DISABLE_URL, code)
       .statusCode(HttpStatus.BAD_REQUEST.value())
       .body(containsString("Incorrect code"));
   }
@@ -353,7 +354,7 @@ public void testDisableAuthenticatorAppInvalidCharactersInCode() throws Exceptio
 
     String code = "abcdef";
 
-    doPost(accessToken, AuthenticatorAppController.DISABLE_URL, code)
+    doPost(accessToken, AuthenticatorAppSettingsController.DISABLE_URL, code)
       .statusCode(HttpStatus.BAD_REQUEST.value())
       .body(containsString("Invalid code format"));
   }
@@ -367,7 +368,7 @@ public void testDisableAuthenticatorAppCodeTooShort() throws Exception {
 
     String code = "12345";
 
-    doPost(accessToken, AuthenticatorAppController.DISABLE_URL, code)
+    doPost(accessToken, AuthenticatorAppSettingsController.DISABLE_URL, code)
       .statusCode(HttpStatus.BAD_REQUEST.value())
       .body(containsString("Invalid code format"));
   }
@@ -381,7 +382,7 @@ public void testDisableAuthenticatorAppCodeTooLong() throws Exception {
 
     String code = "1234567";
 
-    doPost(accessToken, AuthenticatorAppController.DISABLE_URL, code)
+    doPost(accessToken, AuthenticatorAppSettingsController.DISABLE_URL, code)
       .statusCode(HttpStatus.BAD_REQUEST.value())
       .body(containsString("Invalid code format"));
   }
@@ -395,7 +396,7 @@ public void testDisableAuthenticatorAppNullCode() throws Exception {
 
     String code = null;
 
-    doPost(accessToken, AuthenticatorAppController.DISABLE_URL, code)
+    doPost(accessToken, AuthenticatorAppSettingsController.DISABLE_URL, code)
       .statusCode(HttpStatus.BAD_REQUEST.value())
       .body(containsString("Invalid code format"));
   }
@@ -409,7 +410,7 @@ public void testDisableAuthenticatorAppEmptyCode() throws Exception {
 
     String code = "";
 
-    doPost(accessToken, AuthenticatorAppController.DISABLE_URL, code)
+    doPost(accessToken, AuthenticatorAppSettingsController.DISABLE_URL, code)
       .statusCode(HttpStatus.BAD_REQUEST.value())
       .body(containsString("Invalid code format"));
   }
@@ -418,7 +419,8 @@ public void testDisableAuthenticatorAppEmptyCode() throws Exception {
   public void testDisableAuthenticatorAppFullAuthenticationRequired() {
     String code = "123456";
 
-    doPost(AuthenticatorAppController.DISABLE_URL, code).statusCode(HttpStatus.UNAUTHORIZED.value())
+    doPost(AuthenticatorAppSettingsController.DISABLE_URL, code)
+      .statusCode(HttpStatus.UNAUTHORIZED.value())
       .body("error", equalTo("unauthorized"))
       .body("error_description",
           equalTo("Full authentication is required to access this resource"));
diff --git a/iam-test-client/docker/Dockerfile b/iam-test-client/docker/Dockerfile
index 7b1dce9d4..9d22da88f 100644
--- a/iam-test-client/docker/Dockerfile
+++ b/iam-test-client/docker/Dockerfile
@@ -1,4 +1,4 @@
-FROM openjdk:11
+FROM openjdk:17
 
 RUN mkdir /app
 WORKDIR /app
diff --git a/iam-test-client/docker/Dockerfile.prod b/iam-test-client/docker/Dockerfile.prod
index 3ddcfc6df..77abbd3fd 100644
--- a/iam-test-client/docker/Dockerfile.prod
+++ b/iam-test-client/docker/Dockerfile.prod
@@ -1,4 +1,4 @@
-FROM openjdk:11
+FROM openjdk:17
 
 RUN mkdir /app
 WORKDIR /app

From b05cce27f8eafdf9df5ca3e99045a032f3203822 Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Wed, 8 Dec 2021 14:22:27 +0000
Subject: [PATCH 39/76] Adding error handling for MFA failure, fixing CSS bugs

MFA code input page now displays an error if the input TOTP is invalid.

Also fixing CSS bugs introduced in the last commit which meant error messages were accidentally spanning the width of the page.
---
 .../AuthenticatorAppSettingsController.java   | 33 +++-------
 ...lidCodeError.java => BadMfaCodeError.java} | 12 ++--
 .../error/IncorrectCodeError.java             | 29 ---------
 ...ltiFactorAuthenticationSuccessHandler.java |  4 +-
 .../MfaVerifyController.java                  | 61 ++++++++++++++++---
 .../MultiFactorAuthenticationProvider.java    |  3 +-
 ...va => MultiFactorAuthenticationError.java} | 12 ++--
 .../VerifyButtonProperties.java               | 15 +++++
 ...tiFactorVerificationPageConfiguration.java | 15 +++++
 ...tiFactorVerificationPageConfiguration.java | 15 +++++
 .../webapp/WEB-INF/views/iam/verify-mfa.jsp   |  7 +--
 .../src/main/webapp/resources/iam/css/iam.css | 15 ++++-
 12 files changed, 135 insertions(+), 86 deletions(-)
 rename iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/error/{InvalidCodeError.java => BadMfaCodeError.java} (85%)
 delete mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/error/IncorrectCodeError.java
 rename iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/error/{AccountNotFoundException.java => MultiFactorAuthenticationError.java} (78%)

diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppSettingsController.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppSettingsController.java
index 38628ef19..7301b8a32 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppSettingsController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppSettingsController.java
@@ -40,8 +40,7 @@
 import dev.samstevens.totp.exceptions.QrGenerationException;
 import dev.samstevens.totp.qr.QrData;
 import dev.samstevens.totp.qr.QrGenerator;
-import it.infn.mw.iam.api.account.multi_factor_authentication.authenticator_app.error.IncorrectCodeError;
-import it.infn.mw.iam.api.account.multi_factor_authentication.authenticator_app.error.InvalidCodeError;
+import it.infn.mw.iam.api.account.multi_factor_authentication.authenticator_app.error.BadMfaCodeError;
 import it.infn.mw.iam.api.common.ErrorDTO;
 import it.infn.mw.iam.api.common.NoSuchAccountError;
 import it.infn.mw.iam.core.user.IamAccountService;
@@ -123,7 +122,7 @@ public SecretAndDataUriDTO addSecret() {
   public void enableAuthenticatorApp(@ModelAttribute @Valid CodeDTO code,
       BindingResult validationResult) {
     if (validationResult.hasErrors()) {
-      throw new InvalidCodeError("Invalid code format. Code must be six numeric characters");
+      throw new BadMfaCodeError("Bad MFA code");
     }
 
     final String username = getUsernameFromSecurityContext();
@@ -131,7 +130,7 @@ public void enableAuthenticatorApp(@ModelAttribute @Valid CodeDTO code,
       .orElseThrow(() -> NoSuchAccountError.forUsername(username));
 
     if (!codeVerifier.isValidCode(account.getTotpMfa().getSecret(), code.getCode())) {
-      throw new IncorrectCodeError("Incorrect code. Try again");
+      throw new BadMfaCodeError("Bad MFA code");
     }
 
     service.enableTotpMfa(account);
@@ -152,7 +151,7 @@ public void enableAuthenticatorApp(@ModelAttribute @Valid CodeDTO code,
   @ResponseBody
   public void disableAuthenticatorApp(@Valid CodeDTO code, BindingResult validationResult) {
     if (validationResult.hasErrors()) {
-      throw new InvalidCodeError("Invalid code format. Code must be six numeric characters");
+      throw new BadMfaCodeError("Bad MFA code");
     }
 
     final String username = getUsernameFromSecurityContext();
@@ -160,7 +159,7 @@ public void disableAuthenticatorApp(@Valid CodeDTO code, BindingResult validatio
       .orElseThrow(() -> NoSuchAccountError.forUsername(username));
 
     if (!codeVerifier.isValidCode(account.getTotpMfa().getSecret(), code.getCode())) {
-      throw new IncorrectCodeError("Incorrect code. Try again");
+      throw new BadMfaCodeError("Bad MFA code");
     }
 
     service.disableTotpMfa(account);
@@ -258,29 +257,15 @@ public ErrorDTO handleTotpMfaAlreadyEnabledException(TotpMfaAlreadyEnabledExcept
 
 
   /**
-   * Exception handler for when a received TOTP is invalid in format
+   * Exception handler for when a received TOTP is invalid
    * 
-   * @param e InvalidCodeError
+   * @param e BadCodeError
    * @return DTO containing error details
    */
   @ResponseStatus(code = HttpStatus.BAD_REQUEST)
-  @ExceptionHandler(InvalidCodeError.class)
+  @ExceptionHandler(BadMfaCodeError.class)
   @ResponseBody
-  public ErrorDTO handleInvalidCodeError(InvalidCodeError e) {
-    return ErrorDTO.fromString(e.getMessage());
-  }
-
-
-  /**
-   * Exception handler for when a received TOTP is incorrect compared to what the IAM has
-   * 
-   * @param e IncorrectCodeError
-   * @return DTO containing error details
-   */
-  @ResponseStatus(code = HttpStatus.BAD_REQUEST)
-  @ExceptionHandler(IncorrectCodeError.class)
-  @ResponseBody
-  public ErrorDTO handleIncorrectCodeError(IncorrectCodeError e) {
+  public ErrorDTO handleBadCodeError(BadMfaCodeError e) {
     return ErrorDTO.fromString(e.getMessage());
   }
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/error/InvalidCodeError.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/error/BadMfaCodeError.java
similarity index 85%
rename from iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/error/InvalidCodeError.java
rename to iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/error/BadMfaCodeError.java
index 9b17216b9..6f737642a 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/error/InvalidCodeError.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/error/BadMfaCodeError.java
@@ -15,15 +15,13 @@
  */
 package it.infn.mw.iam.api.account.multi_factor_authentication.authenticator_app.error;
 
-public class InvalidCodeError extends RuntimeException {
-
+public class BadMfaCodeError extends RuntimeException {
   /**
-   * 
-   */
+  * 
+  */
   private static final long serialVersionUID = 1L;
 
-  public InvalidCodeError(String message) {
-    super(message);
+  public BadMfaCodeError(String msg) {
+    super(msg);
   }
-
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/error/IncorrectCodeError.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/error/IncorrectCodeError.java
deleted file mode 100644
index fb7b41222..000000000
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/error/IncorrectCodeError.java
+++ /dev/null
@@ -1,29 +0,0 @@
-/**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package it.infn.mw.iam.api.account.multi_factor_authentication.authenticator_app.error;
-
-public class IncorrectCodeError extends RuntimeException {
-
-  /**
-   * 
-   */
-  private static final long serialVersionUID = 1L;
-
-  public IncorrectCodeError(String message) {
-    super(message);
-  }
-
-}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/MultiFactorAuthenticationSuccessHandler.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/MultiFactorAuthenticationSuccessHandler.java
index 2e3e1b71a..dbb887191 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/MultiFactorAuthenticationSuccessHandler.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/MultiFactorAuthenticationSuccessHandler.java
@@ -82,7 +82,7 @@ protected void handle(HttpServletRequest request, HttpServletResponse response,
       // session.setAttribute(REQUESTING_SIGNATURE, true);
       response.sendRedirect(MFA_REDIRECTION_URL);
     } else {
-      continuewithDefaultSuccessHandler(request, response, authentication);
+      continueWithDefaultSuccessHandler(request, response, authentication);
     }
   }
 
@@ -99,7 +99,7 @@ protected boolean isMfaEnabled(final Authentication authentication) {
     return false;
   }
 
-  public void continuewithDefaultSuccessHandler(HttpServletRequest request,
+  public void continueWithDefaultSuccessHandler(HttpServletRequest request,
       HttpServletResponse response, Authentication auth) throws IOException, ServletException {
     HttpSession session = request.getSession(false);
 
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MfaVerifyController.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MfaVerifyController.java
index dc888e6d5..2c5b25017 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MfaVerifyController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MfaVerifyController.java
@@ -22,25 +22,31 @@
 import javax.validation.Valid;
 
 import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.http.HttpStatus;
 import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.security.authentication.AuthenticationEventPublisher;
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
 import org.springframework.security.core.Authentication;
+import org.springframework.security.core.AuthenticationException;
 import org.springframework.security.core.GrantedAuthority;
 import org.springframework.security.core.authority.SimpleGrantedAuthority;
 import org.springframework.security.core.context.SecurityContext;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.stereotype.Controller;
 import org.springframework.validation.BindingResult;
+import org.springframework.web.bind.annotation.ExceptionHandler;
 import org.springframework.web.bind.annotation.ModelAttribute;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RequestMethod;
+import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.ResponseStatus;
+import org.springframework.web.servlet.mvc.support.RedirectAttributes;
 
 import dev.samstevens.totp.code.CodeVerifier;
 import it.infn.mw.iam.api.account.AccountUtils;
 import it.infn.mw.iam.api.account.multi_factor_authentication.authenticator_app.CodeDTO;
-import it.infn.mw.iam.api.account.multi_factor_authentication.authenticator_app.error.IncorrectCodeError;
-import it.infn.mw.iam.api.account.multi_factor_authentication.authenticator_app.error.InvalidCodeError;
-import it.infn.mw.iam.authn.multi_factor_authentication.error.AccountNotFoundException;
+import it.infn.mw.iam.api.common.ErrorDTO;
+import it.infn.mw.iam.authn.multi_factor_authentication.error.MultiFactorAuthenticationError;
 import it.infn.mw.iam.persistence.model.IamAccount;
 
 //TODO when unauthenticated and navigating to other pages like /dashboard, we redirect to /login. But here we show up as unauthorized. Can we replicate the behaviour of /dashboard?
@@ -50,11 +56,27 @@ public class MfaVerifyController {
 
   private final AccountUtils accountUtils;
   private final CodeVerifier codeVerifier;
+  private final AuthenticationEventPublisher eventPublisher;
+
+  // TODO - step up authentication page can't read SPRING_SECURITY_LAST_EXCEPTION.message to display
+  // "Bad code" error. Fix this and use
+  // ExternalAuthenticationHandlerSupport.saveAuthenticationErrorInSession() as a reference
 
   @Autowired
-  public MfaVerifyController(AccountUtils accountUtils, CodeVerifier codeVerifier) {
+  public MfaVerifyController(AccountUtils accountUtils, CodeVerifier codeVerifier,
+      AuthenticationEventPublisher eventPublisher) {
     this.accountUtils = accountUtils;
     this.codeVerifier = codeVerifier;
+    this.eventPublisher = eventPublisher;
+  }
+
+  private void authenticationSuccessEvent(Authentication authentication) {
+    eventPublisher.publishAuthenticationSuccess(authentication);
+  }
+
+  private void authenticationFailureEvent(AuthenticationException exception,
+      Authentication authentication) {
+    eventPublisher.publishAuthenticationFailure(exception, authentication);
   }
 
   @PreAuthorize("hasRole('PRE_AUTHENTICATED')")
@@ -67,20 +89,26 @@ public String getVerify2faView() {
   // authentication object in security context
   @PreAuthorize("hasRole('PRE_AUTHENTICATED')")
   @RequestMapping(method = RequestMethod.POST, path = "/iam/verify2fa")
-  public String verify2fa(@ModelAttribute @Valid CodeDTO code, BindingResult validationResult) {
+  public String verify2fa(@ModelAttribute @Valid CodeDTO code, BindingResult validationResult,
+      Authentication authentication, RedirectAttributes redirectAttributes) {
     if (validationResult.hasErrors()) {
-      throw new InvalidCodeError("Invalid code format. Code must be six numeric characters");
+      MultiFactorAuthenticationError error = new MultiFactorAuthenticationError("Bad MFA code");
+      authenticationFailureEvent(error, authentication);
+      redirectAttributes.addAttribute("error", "failure");
+      return "redirect:/iam/verify2fa";
     }
 
     IamAccount account = accountUtils.getAuthenticatedUserAccount()
-      .orElseThrow(() -> new AccountNotFoundException("Account not found"));
+      .orElseThrow(() -> new MultiFactorAuthenticationError("Account not found"));
 
     if (!codeVerifier.isValidCode(account.getTotpMfa().getSecret(), code.getCode())) {
-      throw new IncorrectCodeError("Incorrect code. Try again");
+      MultiFactorAuthenticationError error = new MultiFactorAuthenticationError("Bad MFA code");
+      authenticationFailureEvent(error, authentication);
+      redirectAttributes.addAttribute("error", "failure");
+      return "redirect:/iam/verify2fa";
     }
 
     SecurityContext sc = SecurityContextHolder.getContext();
-    Authentication authentication = sc.getAuthentication();
     List updatedAuthorities =
         new ArrayList<>(Arrays.asList(new SimpleGrantedAuthority("ROLE_USER")));
 
@@ -90,6 +118,21 @@ public String verify2fa(@ModelAttribute @Valid CodeDTO code, BindingResult valid
 
     // TODO touch account, i.e. log the successful verification
 
+    authenticationSuccessEvent(newAuth);
+
     return "redirect:/dashboard";
   }
+
+  /**
+   * Exception handler for an incorrect or invalid code or a logged-in account not being found
+   * 
+   * @param e MultiFactorAuthenticationError
+   * @return DTO containing error details
+   */
+  @ResponseStatus(code = HttpStatus.BAD_REQUEST)
+  @ExceptionHandler(MultiFactorAuthenticationError.class)
+  @ResponseBody
+  public ErrorDTO handleMultiFactorAuthenticationError(MultiFactorAuthenticationError e) {
+    return ErrorDTO.fromString(e.getMessage());
+  }
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorAuthenticationProvider.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorAuthenticationProvider.java
index 7d3568183..1607bba44 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorAuthenticationProvider.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorAuthenticationProvider.java
@@ -28,7 +28,6 @@
 import org.springframework.security.core.authority.SimpleGrantedAuthority;
 import org.springframework.security.crypto.password.PasswordEncoder;
 
-import it.infn.mw.iam.api.common.NoSuchAccountError;
 import it.infn.mw.iam.persistence.model.IamAccount;
 import it.infn.mw.iam.persistence.repository.IamAccountRepository;
 
@@ -46,7 +45,7 @@ public MultiFactorAuthenticationProvider(IamAccountRepository accountRepo,
   @Override
   public Authentication authenticate(Authentication authentication) throws AuthenticationException {
     IamAccount account = accountRepo.findByUsername(authentication.getName())
-      .orElseThrow(() -> NoSuchAccountError.forUsername(authentication.getName()));
+      .orElseThrow(() -> new BadCredentialsException("Invalid login details"));
     String password = authentication.getCredentials().toString();
     if (!passwordEncoder.matches(password, account.getPassword())) {
       throw new BadCredentialsException("Invalid login details");
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/error/AccountNotFoundException.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/error/MultiFactorAuthenticationError.java
similarity index 78%
rename from iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/error/AccountNotFoundException.java
rename to iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/error/MultiFactorAuthenticationError.java
index 79661030a..da5c9420f 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/error/AccountNotFoundException.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/error/MultiFactorAuthenticationError.java
@@ -15,15 +15,13 @@
  */
 package it.infn.mw.iam.authn.multi_factor_authentication.error;
 
-public class AccountNotFoundException extends RuntimeException {
+import org.springframework.security.core.AuthenticationException;
+
+public class MultiFactorAuthenticationError extends AuthenticationException {
 
-  /**
-   * 
-   */
   private static final long serialVersionUID = 1L;
 
-  public AccountNotFoundException(String message) {
-    super(message);
+  public MultiFactorAuthenticationError(String msg) {
+    super(msg);
   }
-
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/multi_factor_authentication/VerifyButtonProperties.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/multi_factor_authentication/VerifyButtonProperties.java
index 5e07b6d55..1f51e1182 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/multi_factor_authentication/VerifyButtonProperties.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/multi_factor_authentication/VerifyButtonProperties.java
@@ -1,3 +1,18 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 package it.infn.mw.iam.config.multi_factor_authentication;
 
 import javax.validation.constraints.NotBlank;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/web/multi_factor_authentication/DefaultMultiFactorVerificationPageConfiguration.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/web/multi_factor_authentication/DefaultMultiFactorVerificationPageConfiguration.java
index c793c07f6..2d6fb92cb 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/web/multi_factor_authentication/DefaultMultiFactorVerificationPageConfiguration.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/web/multi_factor_authentication/DefaultMultiFactorVerificationPageConfiguration.java
@@ -1,3 +1,18 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 package it.infn.mw.iam.core.web.multi_factor_authentication;
 
 import org.springframework.beans.factory.annotation.Autowired;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/web/multi_factor_authentication/MultiFactorVerificationPageConfiguration.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/web/multi_factor_authentication/MultiFactorVerificationPageConfiguration.java
index 460bdcbdd..46ac650e9 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/web/multi_factor_authentication/MultiFactorVerificationPageConfiguration.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/web/multi_factor_authentication/MultiFactorVerificationPageConfiguration.java
@@ -1,3 +1,18 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 package it.infn.mw.iam.core.web.multi_factor_authentication;
 
 import it.infn.mw.iam.config.IamProperties.Logo;
diff --git a/iam-login-service/src/main/webapp/WEB-INF/views/iam/verify-mfa.jsp b/iam-login-service/src/main/webapp/WEB-INF/views/iam/verify-mfa.jsp
index 9cdc72ed5..1866f5131 100644
--- a/iam-login-service/src/main/webapp/WEB-INF/views/iam/verify-mfa.jsp
+++ b/iam-login-service/src/main/webapp/WEB-INF/views/iam/verify-mfa.jsp
@@ -27,15 +27,14 @@
     
   
     

-      
-        
Incorrect code. Try again

-      
       
         

           
             
           
-          
${SPRING_SECURITY_LAST_EXCEPTION.message}

+          
+          
Bad code

+          
         

       
     

diff --git a/iam-login-service/src/main/webapp/resources/iam/css/iam.css b/iam-login-service/src/main/webapp/resources/iam/css/iam.css
index 464ff7955..d871498b1 100644
--- a/iam-login-service/src/main/webapp/resources/iam/css/iam.css
+++ b/iam-login-service/src/main/webapp/resources/iam/css/iam.css
@@ -65,7 +65,13 @@
     text-align: center;
 }
 
-#login-form #verify-form {
+#login-form {
+    padding-top: 1em;
+    margin: 0 auto;
+    max-width: 250px;
+}
+
+#verify-form {
     padding-top: 1em;
     margin: 0 auto;
     max-width: 250px;
@@ -101,7 +107,12 @@
     text-align: center;
 }
 
-#login-error #verify-error {
+#login-error {
+    margin: 0 auto;
+    max-width: 400px;
+}
+
+#verify-error {
     margin: 0 auto;
     max-width: 400px;
 }

From f67d9b7bc630235a0172e636218330e2866614af Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Wed, 8 Dec 2021 17:21:50 +0000
Subject: [PATCH 40/76] Separating MFA verification controllers, adding "Back
 to login" button

Adding a base controller for handling which factor of authentication the user wishes to choose from and making use of a separate controller for handling the specifics of each factor.

Also adding a "Back to login page" button on the verify endpoint which POSTs to /logout to delete all session data securely.
---
 ...ltiFactorAuthenticationSuccessHandler.java |   8 +-
 .../MfaVerifyController.java                  | 106 ++---------------
 .../AuthenticatorAppVerifyController.java     | 112 ++++++++++++++++++
 .../iam/verify-authenticator-app-form.jsp     |   2 +-
 .../webapp/WEB-INF/views/iam/verify-mfa.jsp   |   6 +
 .../src/main/webapp/resources/iam/css/iam.css |   4 +
 6 files changed, 134 insertions(+), 104 deletions(-)
 create mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/AuthenticatorAppVerifyController.java

diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/MultiFactorAuthenticationSuccessHandler.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/MultiFactorAuthenticationSuccessHandler.java
index dbb887191..e61bd065a 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/MultiFactorAuthenticationSuccessHandler.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/MultiFactorAuthenticationSuccessHandler.java
@@ -16,6 +16,7 @@
 package it.infn.mw.iam.authn;
 
 import static it.infn.mw.iam.core.web.EnforceAupFilter.REQUESTING_SIGNATURE;
+import static it.infn.mw.iam.authn.multi_factor_authentication.MfaVerifyController.MFA_VERIFY_URL;
 
 import java.io.IOException;
 import java.util.Collection;
@@ -43,7 +44,6 @@
 @SuppressWarnings("deprecation")
 public class MultiFactorAuthenticationSuccessHandler implements AuthenticationSuccessHandler {
 
-  public static final String MFA_REDIRECTION_URL = "/iam/verify2fa";
   private final AccountUtils accountUtils;
   private final AuthenticationSuccessHandler rootIsDashboardSuccessHandler;
   // private final String iamBaseUrl;
@@ -75,12 +75,12 @@ protected void handle(HttpServletRequest request, HttpServletResponse response,
     boolean isMfaEnabled = isMfaEnabled(authentication);
 
     if (response.isCommitted()) {
-      System.out.println(
-          "Response has already been committed. Unable to redirect to " + MFA_REDIRECTION_URL);
+      System.out
+        .println("Response has already been committed. Unable to redirect to " + MFA_VERIFY_URL);
       return;
     } else if (isMfaEnabled) {
       // session.setAttribute(REQUESTING_SIGNATURE, true);
-      response.sendRedirect(MFA_REDIRECTION_URL);
+      response.sendRedirect(MFA_VERIFY_URL);
     } else {
       continueWithDefaultSuccessHandler(request, response, authentication);
     }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MfaVerifyController.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MfaVerifyController.java
index 2c5b25017..e94498725 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MfaVerifyController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MfaVerifyController.java
@@ -15,124 +15,32 @@
  */
 package it.infn.mw.iam.authn.multi_factor_authentication;
 
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.List;
-
-import javax.validation.Valid;
+import static it.infn.mw.iam.authn.multi_factor_authentication.MfaVerifyController.MFA_VERIFY_URL;
 
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.http.HttpStatus;
 import org.springframework.security.access.prepost.PreAuthorize;
-import org.springframework.security.authentication.AuthenticationEventPublisher;
-import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.core.AuthenticationException;
-import org.springframework.security.core.GrantedAuthority;
-import org.springframework.security.core.authority.SimpleGrantedAuthority;
-import org.springframework.security.core.context.SecurityContext;
-import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.stereotype.Controller;
-import org.springframework.validation.BindingResult;
-import org.springframework.web.bind.annotation.ExceptionHandler;
-import org.springframework.web.bind.annotation.ModelAttribute;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RequestMethod;
-import org.springframework.web.bind.annotation.ResponseBody;
-import org.springframework.web.bind.annotation.ResponseStatus;
-import org.springframework.web.servlet.mvc.support.RedirectAttributes;
-
-import dev.samstevens.totp.code.CodeVerifier;
-import it.infn.mw.iam.api.account.AccountUtils;
-import it.infn.mw.iam.api.account.multi_factor_authentication.authenticator_app.CodeDTO;
-import it.infn.mw.iam.api.common.ErrorDTO;
-import it.infn.mw.iam.authn.multi_factor_authentication.error.MultiFactorAuthenticationError;
-import it.infn.mw.iam.persistence.model.IamAccount;
 
 //TODO when unauthenticated and navigating to other pages like /dashboard, we redirect to /login. But here we show up as unauthorized. Can we replicate the behaviour of /dashboard?
 
 @Controller
+@RequestMapping(MFA_VERIFY_URL)
 public class MfaVerifyController {
 
-  private final AccountUtils accountUtils;
-  private final CodeVerifier codeVerifier;
-  private final AuthenticationEventPublisher eventPublisher;
-
   // TODO - step up authentication page can't read SPRING_SECURITY_LAST_EXCEPTION.message to display
   // "Bad code" error. Fix this and use
   // ExternalAuthenticationHandlerSupport.saveAuthenticationErrorInSession() as a reference
 
-  @Autowired
-  public MfaVerifyController(AccountUtils accountUtils, CodeVerifier codeVerifier,
-      AuthenticationEventPublisher eventPublisher) {
-    this.accountUtils = accountUtils;
-    this.codeVerifier = codeVerifier;
-    this.eventPublisher = eventPublisher;
-  }
+  public static final String MFA_VERIFY_URL = "/iam/verify";
 
-  private void authenticationSuccessEvent(Authentication authentication) {
-    eventPublisher.publishAuthenticationSuccess(authentication);
-  }
-
-  private void authenticationFailureEvent(AuthenticationException exception,
-      Authentication authentication) {
-    eventPublisher.publishAuthenticationFailure(exception, authentication);
-  }
+  @Autowired
+  public MfaVerifyController() {}
 
   @PreAuthorize("hasRole('PRE_AUTHENTICATED')")
-  @RequestMapping(method = RequestMethod.GET, path = "/iam/verify2fa")
-  public String getVerify2faView() {
+  @RequestMapping(method = RequestMethod.GET, path = "")
+  public String getVerifyMfaView() {
     return "iam/verify-mfa";
   }
-
-  // TODO separate this into a different path. Currently spring complains about a lack of an
-  // authentication object in security context
-  @PreAuthorize("hasRole('PRE_AUTHENTICATED')")
-  @RequestMapping(method = RequestMethod.POST, path = "/iam/verify2fa")
-  public String verify2fa(@ModelAttribute @Valid CodeDTO code, BindingResult validationResult,
-      Authentication authentication, RedirectAttributes redirectAttributes) {
-    if (validationResult.hasErrors()) {
-      MultiFactorAuthenticationError error = new MultiFactorAuthenticationError("Bad MFA code");
-      authenticationFailureEvent(error, authentication);
-      redirectAttributes.addAttribute("error", "failure");
-      return "redirect:/iam/verify2fa";
-    }
-
-    IamAccount account = accountUtils.getAuthenticatedUserAccount()
-      .orElseThrow(() -> new MultiFactorAuthenticationError("Account not found"));
-
-    if (!codeVerifier.isValidCode(account.getTotpMfa().getSecret(), code.getCode())) {
-      MultiFactorAuthenticationError error = new MultiFactorAuthenticationError("Bad MFA code");
-      authenticationFailureEvent(error, authentication);
-      redirectAttributes.addAttribute("error", "failure");
-      return "redirect:/iam/verify2fa";
-    }
-
-    SecurityContext sc = SecurityContextHolder.getContext();
-    List updatedAuthorities =
-        new ArrayList<>(Arrays.asList(new SimpleGrantedAuthority("ROLE_USER")));
-
-    Authentication newAuth = new UsernamePasswordAuthenticationToken(authentication.getPrincipal(),
-        authentication.getCredentials(), updatedAuthorities);
-    sc.setAuthentication(newAuth);
-
-    // TODO touch account, i.e. log the successful verification
-
-    authenticationSuccessEvent(newAuth);
-
-    return "redirect:/dashboard";
-  }
-
-  /**
-   * Exception handler for an incorrect or invalid code or a logged-in account not being found
-   * 
-   * @param e MultiFactorAuthenticationError
-   * @return DTO containing error details
-   */
-  @ResponseStatus(code = HttpStatus.BAD_REQUEST)
-  @ExceptionHandler(MultiFactorAuthenticationError.class)
-  @ResponseBody
-  public ErrorDTO handleMultiFactorAuthenticationError(MultiFactorAuthenticationError e) {
-    return ErrorDTO.fromString(e.getMessage());
-  }
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/AuthenticatorAppVerifyController.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/AuthenticatorAppVerifyController.java
new file mode 100644
index 000000000..c3be699c7
--- /dev/null
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/AuthenticatorAppVerifyController.java
@@ -0,0 +1,112 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.infn.mw.iam.authn.multi_factor_authentication.authenticator_app;
+
+import static it.infn.mw.iam.authn.multi_factor_authentication.MfaVerifyController.MFA_VERIFY_URL;
+
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+
+import javax.validation.Valid;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.security.authentication.AuthenticationEventPublisher;
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.AuthenticationException;
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.authority.SimpleGrantedAuthority;
+import org.springframework.security.core.context.SecurityContext;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.stereotype.Controller;
+import org.springframework.validation.BindingResult;
+import org.springframework.web.bind.annotation.ModelAttribute;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
+import org.springframework.web.servlet.mvc.support.RedirectAttributes;
+
+import dev.samstevens.totp.code.CodeVerifier;
+import it.infn.mw.iam.api.account.AccountUtils;
+import it.infn.mw.iam.api.account.multi_factor_authentication.authenticator_app.CodeDTO;
+import it.infn.mw.iam.authn.multi_factor_authentication.error.MultiFactorAuthenticationError;
+import it.infn.mw.iam.persistence.model.IamAccount;
+
+@Controller
+public class AuthenticatorAppVerifyController {
+
+  private final AccountUtils accountUtils;
+  private final CodeVerifier codeVerifier;
+  private final AuthenticationEventPublisher eventPublisher;
+
+  // TODO - step up authentication page can't read SPRING_SECURITY_LAST_EXCEPTION.message to display
+  // "Bad code" error. Fix this and use
+  // ExternalAuthenticationHandlerSupport.saveAuthenticationErrorInSession() as a reference
+
+  @Autowired
+  public AuthenticatorAppVerifyController(AccountUtils accountUtils, CodeVerifier codeVerifier,
+      AuthenticationEventPublisher eventPublisher) {
+    this.accountUtils = accountUtils;
+    this.codeVerifier = codeVerifier;
+    this.eventPublisher = eventPublisher;
+  }
+
+  private void authenticationSuccessEvent(Authentication authentication) {
+    eventPublisher.publishAuthenticationSuccess(authentication);
+  }
+
+  private void authenticationFailureEvent(AuthenticationException exception,
+      Authentication authentication) {
+    eventPublisher.publishAuthenticationFailure(exception, authentication);
+  }
+
+  @PreAuthorize("hasRole('PRE_AUTHENTICATED')")
+  @RequestMapping(method = RequestMethod.POST, path = MFA_VERIFY_URL + "/authenticator-app")
+  public String verifyCode(@ModelAttribute @Valid CodeDTO code, BindingResult validationResult,
+      Authentication authentication, RedirectAttributes redirectAttributes) {
+    if (validationResult.hasErrors()) {
+      MultiFactorAuthenticationError error = new MultiFactorAuthenticationError("Bad MFA code");
+      authenticationFailureEvent(error, authentication);
+      redirectAttributes.addAttribute("error", "failure");
+      return "redirect:/iam/verify";
+    }
+
+    IamAccount account = accountUtils.getAuthenticatedUserAccount()
+      .orElseThrow(() -> new MultiFactorAuthenticationError("Account not found"));
+
+    if (!codeVerifier.isValidCode(account.getTotpMfa().getSecret(), code.getCode())) {
+      MultiFactorAuthenticationError error = new MultiFactorAuthenticationError("Bad MFA code");
+      authenticationFailureEvent(error, authentication);
+      redirectAttributes.addAttribute("error", "failure");
+      return "redirect:/iam/verify";
+    }
+
+    SecurityContext sc = SecurityContextHolder.getContext();
+    List updatedAuthorities =
+        new ArrayList<>(Arrays.asList(new SimpleGrantedAuthority("ROLE_USER")));
+
+    Authentication newAuth = new UsernamePasswordAuthenticationToken(authentication.getPrincipal(),
+        authentication.getCredentials(), updatedAuthorities);
+    sc.setAuthentication(newAuth);
+
+    // TODO touch account, i.e. log the successful verification
+
+    authenticationSuccessEvent(newAuth);
+
+    return "redirect:/dashboard";
+  }
+}
diff --git a/iam-login-service/src/main/webapp/WEB-INF/views/iam/verify-authenticator-app-form.jsp b/iam-login-service/src/main/webapp/WEB-INF/views/iam/verify-authenticator-app-form.jsp
index 690f99502..da763551e 100644
--- a/iam-login-service/src/main/webapp/WEB-INF/views/iam/verify-authenticator-app-form.jsp
+++ b/iam-login-service/src/main/webapp/WEB-INF/views/iam/verify-authenticator-app-form.jsp
@@ -19,7 +19,7 @@
 <%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%>
 <%@ taglib prefix="t" tagdir="/WEB-INF/tags/iam"%>
 <%@ taglib prefix="spring" uri="http://www.springframework.org/tags"%>
-

+
   
For your security, please enter a code from your authenticator app

   

     

diff --git a/iam-login-service/src/main/webapp/WEB-INF/views/iam/verify-mfa.jsp b/iam-login-service/src/main/webapp/WEB-INF/views/iam/verify-mfa.jsp
index 1866f5131..2b3ea2f19 100644
--- a/iam-login-service/src/main/webapp/WEB-INF/views/iam/verify-mfa.jsp
+++ b/iam-login-service/src/main/webapp/WEB-INF/views/iam/verify-mfa.jsp
@@ -39,5 +39,11 @@
       
     

     
+
+    

+      
+        
+      
+    

   
 
\ No newline at end of file
diff --git a/iam-login-service/src/main/webapp/resources/iam/css/iam.css b/iam-login-service/src/main/webapp/resources/iam/css/iam.css
index d871498b1..84bd8d29c 100644
--- a/iam-login-service/src/main/webapp/resources/iam/css/iam.css
+++ b/iam-login-service/src/main/webapp/resources/iam/css/iam.css
@@ -151,6 +151,10 @@
     margin-top: 2em;
 }
 
+#verify-confirm-back-btn {
+    margin-top: 2em
+}
+
 .reset-password-form {
     margin: 0 auto;
     max-width: 400px;

From 82af215b71c4e8a78b45e66819f2304994ec1b8f Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Thu, 9 Dec 2021 11:34:00 +0000
Subject: [PATCH 41/76] Adding mechanism for looping through available factors
 of authentication on /iam/verify

This will later allow for the user to choose which factor of authentication to use when verifying their identity. Will also look to extend this later on so that, if only one factor is set up, display this one automatically without requiring the user to select a button/dropdown.
---
 .../MultiFactorSettingsController.java        |  4 +--
 .../MultiFactorSettingsDTO.java               |  8 ++++++
 .../MfaVerifyController.java                  | 26 +++++++++++++++++--
 .../webapp/WEB-INF/views/iam/verify-mfa.jsp   | 11 ++++++--
 .../MultiFactorSettingsTests.java             |  4 +--
 5 files changed, 45 insertions(+), 8 deletions(-)

diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/MultiFactorSettingsController.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/MultiFactorSettingsController.java
index 6c7c1631b..68c4b4382 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/MultiFactorSettingsController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/MultiFactorSettingsController.java
@@ -37,7 +37,7 @@
 @Controller
 public class MultiFactorSettingsController {
 
-  public static final String BASE_URL = "/iam/multi-factor-settings";
+  public static final String MULTI_FACTOR_SETTINGS_URL = "/iam/multi-factor-settings";
   final IamAccountRepository accountRepository;
 
   @Autowired
@@ -52,7 +52,7 @@ public MultiFactorSettingsController(IamAccountRepository accountRepository) {
    * @return MultiFactorSettingsDTO the MFA settings for the account
    */
   @PreAuthorize("hasRole('USER')")
-  @RequestMapping(value = BASE_URL, method = RequestMethod.GET,
+  @RequestMapping(value = MULTI_FACTOR_SETTINGS_URL, method = RequestMethod.GET,
       produces = MediaType.APPLICATION_JSON_VALUE)
   @ResponseBody
   public MultiFactorSettingsDTO getMultiFactorSettings() {
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/MultiFactorSettingsDTO.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/MultiFactorSettingsDTO.java
index 83901a859..dbf554b23 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/MultiFactorSettingsDTO.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/MultiFactorSettingsDTO.java
@@ -17,6 +17,8 @@
 
 import javax.validation.constraints.NotEmpty;
 
+import com.nimbusds.jose.shaded.json.JSONObject;
+
 /**
  * DTO containing info about enabled factors of authentication
  */
@@ -49,4 +51,10 @@ public boolean getAuthenticatorAppActive() {
   public void setAuthenticatorAppActive(final boolean authenticatorAppActive) {
     this.authenticatorAppActive = authenticatorAppActive;
   }
+
+  public JSONObject toJson() {
+    JSONObject json = new JSONObject();
+    json.put("authenticatorAppActive", authenticatorAppActive);
+    return json;
+  }
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MfaVerifyController.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MfaVerifyController.java
index e94498725..b4a7a40d0 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MfaVerifyController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MfaVerifyController.java
@@ -19,10 +19,17 @@
 
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.security.core.Authentication;
 import org.springframework.stereotype.Controller;
+import org.springframework.ui.ModelMap;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RequestMethod;
 
+import it.infn.mw.iam.api.account.multi_factor_authentication.MultiFactorSettingsDTO;
+import it.infn.mw.iam.api.common.NoSuchAccountError;
+import it.infn.mw.iam.persistence.model.IamAccount;
+import it.infn.mw.iam.persistence.repository.IamAccountRepository;
+
 //TODO when unauthenticated and navigating to other pages like /dashboard, we redirect to /login. But here we show up as unauthorized. Can we replicate the behaviour of /dashboard?
 
 @Controller
@@ -34,13 +41,28 @@ public class MfaVerifyController {
   // ExternalAuthenticationHandlerSupport.saveAuthenticationErrorInSession() as a reference
 
   public static final String MFA_VERIFY_URL = "/iam/verify";
+  final IamAccountRepository accountRepository;
 
   @Autowired
-  public MfaVerifyController() {}
+  public MfaVerifyController(IamAccountRepository accountRepository) {
+    this.accountRepository = accountRepository;
+  }
 
   @PreAuthorize("hasRole('PRE_AUTHENTICATED')")
   @RequestMapping(method = RequestMethod.GET, path = "")
-  public String getVerifyMfaView() {
+  public String getVerifyMfaView(Authentication authentication, ModelMap model) {
+    IamAccount account = accountRepository.findByUsername(authentication.getName())
+      .orElseThrow(() -> NoSuchAccountError.forUsername(authentication.getName()));
+    MultiFactorSettingsDTO dto = populateMfaSettings(account);
+    model.addAttribute("factors", dto.toJson());
+
     return "iam/verify-mfa";
   }
+
+  private MultiFactorSettingsDTO populateMfaSettings(IamAccount account) {
+    MultiFactorSettingsDTO dto = new MultiFactorSettingsDTO();
+    dto.setAuthenticatorAppActive(account.getTotpMfa() != null && account.getTotpMfa().isActive());
+
+    return dto;
+  }
 }
diff --git a/iam-login-service/src/main/webapp/WEB-INF/views/iam/verify-mfa.jsp b/iam-login-service/src/main/webapp/WEB-INF/views/iam/verify-mfa.jsp
index 2b3ea2f19..5721d2ff7 100644
--- a/iam-login-service/src/main/webapp/WEB-INF/views/iam/verify-mfa.jsp
+++ b/iam-login-service/src/main/webapp/WEB-INF/views/iam/verify-mfa.jsp
@@ -38,8 +38,15 @@
         

       
     

-    
-
+    

+      
+      
+      
+        
+          
+        
+      
+    

     

       

         
diff --git a/iam-login-service/src/test/java/it/infn/mw/iam/test/api/account/multi_factor_authentication/MultiFactorSettingsTests.java b/iam-login-service/src/test/java/it/infn/mw/iam/test/api/account/multi_factor_authentication/MultiFactorSettingsTests.java
index 6333f415e..4516febce 100644
--- a/iam-login-service/src/test/java/it/infn/mw/iam/test/api/account/multi_factor_authentication/MultiFactorSettingsTests.java
+++ b/iam-login-service/src/test/java/it/infn/mw/iam/test/api/account/multi_factor_authentication/MultiFactorSettingsTests.java
@@ -87,7 +87,7 @@ private ValidatableResponse doGet(String accessToken) {
       .log()
       .all(true)
       .when()
-      .get(MultiFactorSettingsController.BASE_URL)
+      .get(MultiFactorSettingsController.MULTI_FACTOR_SETTINGS_URL)
       .then()
       .log()
       .all(true);
@@ -99,7 +99,7 @@ private ValidatableResponse doGet() {
       .log()
       .all(true)
       .when()
-      .get(MultiFactorSettingsController.BASE_URL)
+      .get(MultiFactorSettingsController.MULTI_FACTOR_SETTINGS_URL)
       .then()
       .log()
       .all(true);

From 3479f43c0158a93f70f3ed42eb84e3ee2109bd92 Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Fri, 10 Dec 2021 17:25:02 +0000
Subject: [PATCH 42/76] Adding recovery code login procedure, backend for
 regenerating recovery codes

Currently, codes regenerate but still need to display them to the user once done
---
 .../AuthenticatorAppVerifyController.java     | 90 ++++++++++++++++++-
 .../authenticator_app/RecoveryCodeDTO.java    | 44 +++++++++
 .../core/user/DefaultIamAccountService.java   | 27 ++++--
 .../mw/iam/core/user/IamAccountService.java   |  2 +
 .../views/iam/reset-recovery-codes-choice.jsp | 41 +++++++++
 .../iam/verify-authenticator-app-form.jsp     | 58 ++++++++----
 .../webapp/WEB-INF/views/iam/verify-mfa.jsp   | 18 ++--
 .../src/main/webapp/resources/iam/css/iam.css |  2 +-
 8 files changed, 243 insertions(+), 39 deletions(-)
 create mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/RecoveryCodeDTO.java
 create mode 100644 iam-login-service/src/main/webapp/WEB-INF/views/iam/reset-recovery-codes-choice.jsp

diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/AuthenticatorAppVerifyController.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/AuthenticatorAppVerifyController.java
index c3be699c7..0c34d0705 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/AuthenticatorAppVerifyController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/AuthenticatorAppVerifyController.java
@@ -20,6 +20,7 @@
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;
+import java.util.Set;
 
 import javax.validation.Valid;
 
@@ -34,6 +35,7 @@
 import org.springframework.security.core.context.SecurityContext;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.stereotype.Controller;
+import org.springframework.ui.ModelMap;
 import org.springframework.validation.BindingResult;
 import org.springframework.web.bind.annotation.ModelAttribute;
 import org.springframework.web.bind.annotation.RequestMapping;
@@ -44,7 +46,9 @@
 import it.infn.mw.iam.api.account.AccountUtils;
 import it.infn.mw.iam.api.account.multi_factor_authentication.authenticator_app.CodeDTO;
 import it.infn.mw.iam.authn.multi_factor_authentication.error.MultiFactorAuthenticationError;
+import it.infn.mw.iam.core.user.IamAccountService;
 import it.infn.mw.iam.persistence.model.IamAccount;
+import it.infn.mw.iam.persistence.model.IamTotpRecoveryCode;
 
 @Controller
 public class AuthenticatorAppVerifyController {
@@ -52,6 +56,7 @@ public class AuthenticatorAppVerifyController {
   private final AccountUtils accountUtils;
   private final CodeVerifier codeVerifier;
   private final AuthenticationEventPublisher eventPublisher;
+  final IamAccountService service;
 
   // TODO - step up authentication page can't read SPRING_SECURITY_LAST_EXCEPTION.message to display
   // "Bad code" error. Fix this and use
@@ -59,10 +64,11 @@ public class AuthenticatorAppVerifyController {
 
   @Autowired
   public AuthenticatorAppVerifyController(AccountUtils accountUtils, CodeVerifier codeVerifier,
-      AuthenticationEventPublisher eventPublisher) {
+      AuthenticationEventPublisher eventPublisher, IamAccountService service) {
     this.accountUtils = accountUtils;
     this.codeVerifier = codeVerifier;
     this.eventPublisher = eventPublisher;
+    this.service = service;
   }
 
   private void authenticationSuccessEvent(Authentication authentication) {
@@ -75,7 +81,7 @@ private void authenticationFailureEvent(AuthenticationException exception,
   }
 
   @PreAuthorize("hasRole('PRE_AUTHENTICATED')")
-  @RequestMapping(method = RequestMethod.POST, path = MFA_VERIFY_URL + "/authenticator-app")
+  @RequestMapping(method = RequestMethod.POST, path = MFA_VERIFY_URL + "/authenticator-app/code")
   public String verifyCode(@ModelAttribute @Valid CodeDTO code, BindingResult validationResult,
       Authentication authentication, RedirectAttributes redirectAttributes) {
     if (validationResult.hasErrors()) {
@@ -109,4 +115,84 @@ public String verifyCode(@ModelAttribute @Valid CodeDTO code, BindingResult vali
 
     return "redirect:/dashboard";
   }
+
+  @PreAuthorize("hasRole('PRE_AUTHENTICATED')")
+  @RequestMapping(method = RequestMethod.POST,
+      path = MFA_VERIFY_URL + "/authenticator-app/recovery-code")
+  public String verifyRecoveryCode(@ModelAttribute @Valid RecoveryCodeDTO recoveryCode,
+      BindingResult validationResult, Authentication authentication,
+      RedirectAttributes redirectAttributes) {
+    if (validationResult.hasErrors()) {
+      MultiFactorAuthenticationError error =
+          new MultiFactorAuthenticationError("Bad recovery code");
+      authenticationFailureEvent(error, authentication);
+      redirectAttributes.addAttribute("error", "failure");
+      return "redirect:/iam/verify";
+    }
+
+    IamAccount account = accountUtils.getAuthenticatedUserAccount()
+      .orElseThrow(() -> new MultiFactorAuthenticationError("Account not found"));
+
+    Set accountRecoveryCodes = account.getTotpMfa().getRecoveryCodes();
+    if (!isValidRecoveryCode(accountRecoveryCodes, recoveryCode.getRecoveryCode())) {
+      MultiFactorAuthenticationError error =
+          new MultiFactorAuthenticationError("Bad recovery code");
+      authenticationFailureEvent(error, authentication);
+      redirectAttributes.addAttribute("error", "failure");
+      return "redirect:/iam/verify";
+    }
+
+    SecurityContext sc = SecurityContextHolder.getContext();
+    List updatedAuthorities =
+        new ArrayList<>(Arrays.asList(new SimpleGrantedAuthority("ROLE_USER")));
+
+    Authentication newAuth = new UsernamePasswordAuthenticationToken(authentication.getPrincipal(),
+        authentication.getCredentials(), updatedAuthorities);
+    sc.setAuthentication(newAuth);
+
+    // TODO touch account, i.e. log the successful verification
+
+    authenticationSuccessEvent(newAuth);
+
+    return "redirect:" + MFA_VERIFY_URL + "/authenticator-app/recovery-code/reset";
+  }
+
+  private boolean isValidRecoveryCode(Set accountRecoveryCodes,
+      String inputRecoveryCode) {
+    for (IamTotpRecoveryCode recoveryCodeObject : accountRecoveryCodes) {
+      String currentRecoveryCode = recoveryCodeObject.getCode();
+      if (currentRecoveryCode.equals(inputRecoveryCode)) {
+        return true;
+      }
+    }
+
+    return false;
+  }
+
+  @PreAuthorize("hasRole('USER')")
+  @RequestMapping(method = RequestMethod.GET,
+      path = MFA_VERIFY_URL + "/authenticator-app/recovery-code/reset")
+  public String getResetRecoveryCodesView() {
+    return "/iam/reset-recovery-codes-choice";
+  }
+
+  @PreAuthorize("hasRole('USER')")
+  @RequestMapping(method = RequestMethod.POST,
+      path = MFA_VERIFY_URL + "/authenticator-app/recovery-code/reset")
+  public String resetRecoveryCodes(ModelMap model) {
+    IamAccount account = accountUtils.getAuthenticatedUserAccount()
+      .orElseThrow(() -> new MultiFactorAuthenticationError("Account not found"));
+    account = service.addTotpMfaRecoveryCodes(account);
+    service.saveAccount(account);
+
+    List recs = new ArrayList<>(account.getTotpMfa().getRecoveryCodes());
+    String[] codes = new String[recs.size()];
+
+    for (int i = 0; i < recs.size(); i++) {
+      codes[i] = recs.get(i).getCode();
+    }
+
+    model.addAttribute("recoveryCodes", codes);
+    return "redirect:" + MFA_VERIFY_URL + "/authenticator-app/recovery-code/view";
+  }
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/RecoveryCodeDTO.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/RecoveryCodeDTO.java
new file mode 100644
index 000000000..46f5ee87e
--- /dev/null
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/RecoveryCodeDTO.java
@@ -0,0 +1,44 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.infn.mw.iam.authn.multi_factor_authentication.authenticator_app;
+
+import javax.validation.constraints.NotEmpty;
+
+/**
+ * DTO containing a recovery code for MFA secrets
+ */
+public class RecoveryCodeDTO {
+
+  @NotEmpty(message = "Recovery code cannot be empty")
+  private String recoveryCode;
+
+
+  /**
+   * @return the recoveryCode
+   */
+  public String getRecoveryCode() {
+    return recoveryCode;
+  }
+
+
+  /**
+   * @param recoveryCode new recoveryCode
+   * @return nothing
+   */
+  public void setRecoveryCode(final String recoveryCode) {
+    this.recoveryCode = recoveryCode;
+  }
+}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/DefaultIamAccountService.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/DefaultIamAccountService.java
index 85e13d084..545366982 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/DefaultIamAccountService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/DefaultIamAccountService.java
@@ -604,6 +604,23 @@ public IamAccount addTotpMfaSecret(IamAccount account) {
     // Generate secret
     IamTotpMfa totpMfa = new IamTotpMfa(account);
     totpMfa.setSecret(secretGenerator.generate());
+    totpMfa.setAccount(account);
+    account.setTotpMfa(totpMfa);
+
+    // Generate recovery codes
+    account = addTotpMfaRecoveryCodes(account);
+
+    accountRepo.save(account);
+    return account;
+  }
+
+  @Override
+  public IamAccount addTotpMfaRecoveryCodes(IamAccount account) {
+    if (isNull(account.getTotpMfa())) {
+      throw new MfaSecretNotFoundException("No multi-factor secret is attached to this account");
+    }
+
+    IamTotpMfa totpMfa = account.getTotpMfa();
 
     // Generate recovery codes
     String[] recoveryCodeStrings = recoveryCodeGenerator.generateCodes(6);
@@ -616,10 +633,6 @@ public IamAccount addTotpMfaSecret(IamAccount account) {
 
     // Attach to account
     totpMfa.setRecoveryCodes(recoveryCodes);
-    account.setTotpMfa(totpMfa);
-    totpMfa.setAccount(account);
-
-    accountRepo.save(account);
     return account;
   }
 
@@ -642,9 +655,8 @@ public IamAccount enableTotpMfa(IamAccount account) {
     IamTotpMfa totpMfa = account.getTotpMfa();
     totpMfa.setActive(true);
     account.setTotpMfa(totpMfa);
-    account.touch();
 
-    accountRepo.save(account);
+    account = saveAccount(account);
     authenticatorAppEnabledEvent(account);
     return account;
   }
@@ -665,9 +677,8 @@ public IamAccount disableTotpMfa(IamAccount account) {
     }
 
     account.setTotpMfa(null);
-    account.touch();
 
-    accountRepo.save(account);
+    account = saveAccount(account);
     authenticatorAppDisabledEvent(account);
     return account;
   }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/IamAccountService.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/IamAccountService.java
index b9b99b33b..120eab34d 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/IamAccountService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/IamAccountService.java
@@ -192,6 +192,8 @@ public interface IamAccountService {
    */
   IamAccount addTotpMfaSecret(IamAccount account);
 
+  IamAccount addTotpMfaRecoveryCodes(IamAccount account);
+
   /**
    * Enable TOTP MFA on account with TOTP secret
    * 
diff --git a/iam-login-service/src/main/webapp/WEB-INF/views/iam/reset-recovery-codes-choice.jsp b/iam-login-service/src/main/webapp/WEB-INF/views/iam/reset-recovery-codes-choice.jsp
new file mode 100644
index 000000000..a97f075fd
--- /dev/null
+++ b/iam-login-service/src/main/webapp/WEB-INF/views/iam/reset-recovery-codes-choice.jsp
@@ -0,0 +1,41 @@
+<%--
+
+    Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
+
+        http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
+
+--%>
+<%@ taglib prefix="authz" uri="http://www.springframework.org/security/tags"%>
+<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%>
+<%@ taglib prefix="t" tagdir="/WEB-INF/tags/iam"%>
+<%@ taglib prefix="spring" uri="http://www.springframework.org/tags"%>
+
+  
+    
+    
+    
+  
+  
+    
+      
+      
+    
+    
+    

+      
+      
+    

+  
+
\ No newline at end of file
diff --git a/iam-login-service/src/main/webapp/WEB-INF/views/iam/verify-authenticator-app-form.jsp b/iam-login-service/src/main/webapp/WEB-INF/views/iam/verify-authenticator-app-form.jsp
index da763551e..68638af18 100644
--- a/iam-login-service/src/main/webapp/WEB-INF/views/iam/verify-authenticator-app-form.jsp
+++ b/iam-login-service/src/main/webapp/WEB-INF/views/iam/verify-authenticator-app-form.jsp
@@ -15,23 +15,43 @@
     limitations under the License.
 
 --%>
-<%@ taglib prefix="authz" uri="http://www.springframework.org/security/tags"%>
-<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%>
-<%@ taglib prefix="t" tagdir="/WEB-INF/tags/iam"%>
-<%@ taglib prefix="spring" uri="http://www.springframework.org/tags"%>
-

-  
For your security, please enter a code from your authenticator app

-  

-    

-      
-        
-      
-      
-    

+
+  

+    
+      

+        For your security, please enter a code from your authenticator app
+      

+      

+        

+          
+            
+          
+          
+        

+      

+        
+        
+      

+    
+    

+      

+        Lost access to your authenticator app? Enter a recovery code to regain access
+      

+      

+        

+          
+            
+          
+          
+        

+      

+        
+        
+      

+    
   

-    
-    
-  

-
\ No newline at end of file
+
diff --git a/iam-login-service/src/main/webapp/WEB-INF/views/iam/verify-mfa.jsp b/iam-login-service/src/main/webapp/WEB-INF/views/iam/verify-mfa.jsp
index 5721d2ff7..37b3c3b13 100644
--- a/iam-login-service/src/main/webapp/WEB-INF/views/iam/verify-mfa.jsp
+++ b/iam-login-service/src/main/webapp/WEB-INF/views/iam/verify-mfa.jsp
@@ -38,15 +38,15 @@
         

       
     

-    

-      
-      
-      
-        
-          
-        
-      
-    

+
+    
+     
+    
+      

+        
+      

+    
+
     

       

         
diff --git a/iam-login-service/src/main/webapp/resources/iam/css/iam.css b/iam-login-service/src/main/webapp/resources/iam/css/iam.css
index 84bd8d29c..39858da1d 100644
--- a/iam-login-service/src/main/webapp/resources/iam/css/iam.css
+++ b/iam-login-service/src/main/webapp/resources/iam/css/iam.css
@@ -71,7 +71,7 @@
     max-width: 250px;
 }
 
-#verify-form {
+.verify-form {
     padding-top: 1em;
     margin: 0 auto;
     max-width: 250px;

From 915c6a9d697e186827d345ffbb4a7f412b85e672 Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Mon, 13 Dec 2021 15:00:08 +0000
Subject: [PATCH 43/76] Fixing css bug that broke the btn-login class

This was due to a new class using the wrong syntax while trying to inherit the same css properties as the btn-login class
---
 .../src/main/webapp/resources/iam/css/iam.css             | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/iam-login-service/src/main/webapp/resources/iam/css/iam.css b/iam-login-service/src/main/webapp/resources/iam/css/iam.css
index 39858da1d..019a281fc 100644
--- a/iam-login-service/src/main/webapp/resources/iam/css/iam.css
+++ b/iam-login-service/src/main/webapp/resources/iam/css/iam.css
@@ -151,7 +151,7 @@
     margin-top: 2em;
 }
 
-#verify-confirm-back-btn {
+#verify-confirm {
     margin-top: 2em
 }
 
@@ -329,13 +329,13 @@ body.skin-blue {
     border-bottom: none;
 }
 
-.btn-login .btn-verify {
+.btn-login, .btn-verify {
     background-color: white;
     border-color: #ddd;
     color: inherit;
 }
 
-.btn-login:hover .btn-verify:hover {
+.btn-login:hover, .btn-verify:hover {
     background-color: white;
 }
 
@@ -358,7 +358,7 @@ body.skin-blue {
     margin-top: 1em;
 }
 
-.signin-preamble .verify-preamble {
+.signin-preamble, .verify-preamble {
     margin-bottom: 1em;
     text-align: center;
 }

From 6a1364354f1843d09b2c7d319fa3f31a5d431d92 Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Mon, 13 Dec 2021 16:41:23 +0000
Subject: [PATCH 44/76] Fixing css bugs with MFA verify button

More clashes with login button
---
 .../src/main/webapp/resources/iam/css/iam.css | 21 ++++++++++++++++---
 1 file changed, 18 insertions(+), 3 deletions(-)

diff --git a/iam-login-service/src/main/webapp/resources/iam/css/iam.css b/iam-login-service/src/main/webapp/resources/iam/css/iam.css
index 019a281fc..a198b2e81 100644
--- a/iam-login-service/src/main/webapp/resources/iam/css/iam.css
+++ b/iam-login-service/src/main/webapp/resources/iam/css/iam.css
@@ -329,13 +329,23 @@ body.skin-blue {
     border-bottom: none;
 }
 
-.btn-login, .btn-verify {
+.btn-login {
     background-color: white;
     border-color: #ddd;
     color: inherit;
 }
 
-.btn-login:hover, .btn-verify:hover {
+.btn-verify {
+    background-color: white;
+    border-color: #ddd;
+    color: inherit;
+}
+
+.btn-login:hover {
+    background-color: white;
+}
+
+.btn-verify:hover {
     background-color: white;
 }
 
@@ -358,7 +368,12 @@ body.skin-blue {
     margin-top: 1em;
 }
 
-.signin-preamble, .verify-preamble {
+.signin-preamble {
+    margin-bottom: 1em;
+    text-align: center;
+}
+
+.verify-preamble {
     margin-bottom: 1em;
     text-align: center;
 }

From e13a1691ae616feacc0439f5d69c759176306762 Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Mon, 13 Dec 2021 16:43:19 +0000
Subject: [PATCH 45/76] Adding recovery code regeneration after use and webpage
 navigation

Now have all functionality for entering a recovery code, choosing to regenerate recovery codes or skip this step and then the actual recovery code regeneration, the results of which are displayed to the user.
---
 .../AuthenticatorAppVerifyController.java     | 30 +++++++++----
 .../recovery-code/reset.jsp}                  |  5 ++-
 .../authenticator-app/recovery-code/view.jsp  | 43 +++++++++++++++++++
 .../verify-authenticator-app-form.jsp         |  4 ++
 .../webapp/WEB-INF/views/iam/verify-mfa.jsp   |  8 +---
 5 files changed, 73 insertions(+), 17 deletions(-)
 rename iam-login-service/src/main/webapp/WEB-INF/views/iam/{reset-recovery-codes-choice.jsp => authenticator-app/recovery-code/reset.jsp} (85%)
 create mode 100644 iam-login-service/src/main/webapp/WEB-INF/views/iam/authenticator-app/recovery-code/view.jsp
 rename iam-login-service/src/main/webapp/WEB-INF/views/iam/{ => authenticator-app}/verify-authenticator-app-form.jsp (93%)

diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/AuthenticatorAppVerifyController.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/AuthenticatorAppVerifyController.java
index 0c34d0705..d297e707b 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/AuthenticatorAppVerifyController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/AuthenticatorAppVerifyController.java
@@ -154,7 +154,7 @@ public String verifyRecoveryCode(@ModelAttribute @Valid RecoveryCodeDTO recovery
 
     authenticationSuccessEvent(newAuth);
 
-    return "redirect:" + MFA_VERIFY_URL + "/authenticator-app/recovery-code/reset";
+    return "redirect:/iam/authenticator-app/recovery-code/reset";
   }
 
   private boolean isValidRecoveryCode(Set accountRecoveryCodes,
@@ -169,22 +169,34 @@ private boolean isValidRecoveryCode(Set accountRecoveryCode
     return false;
   }
 
+  // TODO if the resetting of recovery codes after use is a requirement, we need to prevent the user
+  // from accessing IAM webpages after authenticating. This may require an additional ROLE for
+  // handling this. Should also try and tie this in with a generic page for resetting recovery codes
+  // for anyone who is logged in
+
   @PreAuthorize("hasRole('USER')")
-  @RequestMapping(method = RequestMethod.GET,
-      path = MFA_VERIFY_URL + "/authenticator-app/recovery-code/reset")
-  public String getResetRecoveryCodesView() {
-    return "/iam/reset-recovery-codes-choice";
+  @RequestMapping(method = RequestMethod.GET, path = "/iam/authenticator-app/recovery-code/reset")
+  public String getResetRecoveryCodesResetView() {
+    return "/iam/authenticator-app/recovery-code/reset";
   }
 
   @PreAuthorize("hasRole('USER')")
-  @RequestMapping(method = RequestMethod.POST,
-      path = MFA_VERIFY_URL + "/authenticator-app/recovery-code/reset")
-  public String resetRecoveryCodes(ModelMap model) {
+  @RequestMapping(method = RequestMethod.POST, path = "/iam/authenticator-app/recovery-code/reset")
+  public String resetRecoveryCodes() {
     IamAccount account = accountUtils.getAuthenticatedUserAccount()
       .orElseThrow(() -> new MultiFactorAuthenticationError("Account not found"));
     account = service.addTotpMfaRecoveryCodes(account);
     service.saveAccount(account);
 
+    return "redirect:/iam/authenticator-app/recovery-code/view";
+  }
+
+  @PreAuthorize("hasRole('USER')")
+  @RequestMapping(method = RequestMethod.GET, path = "/iam/authenticator-app/recovery-code/view")
+  public String viewRecoveryCodes(ModelMap model) {
+    IamAccount account = accountUtils.getAuthenticatedUserAccount()
+      .orElseThrow(() -> new MultiFactorAuthenticationError("Account not found"));
+
     List recs = new ArrayList<>(account.getTotpMfa().getRecoveryCodes());
     String[] codes = new String[recs.size()];
 
@@ -193,6 +205,6 @@ public String resetRecoveryCodes(ModelMap model) {
     }
 
     model.addAttribute("recoveryCodes", codes);
-    return "redirect:" + MFA_VERIFY_URL + "/authenticator-app/recovery-code/view";
+    return "/iam/authenticator-app/recovery-code/view";
   }
 }
diff --git a/iam-login-service/src/main/webapp/WEB-INF/views/iam/reset-recovery-codes-choice.jsp b/iam-login-service/src/main/webapp/WEB-INF/views/iam/authenticator-app/recovery-code/reset.jsp
similarity index 85%
rename from iam-login-service/src/main/webapp/WEB-INF/views/iam/reset-recovery-codes-choice.jsp
rename to iam-login-service/src/main/webapp/WEB-INF/views/iam/authenticator-app/recovery-code/reset.jsp
index a97f075fd..faa018993 100644
--- a/iam-login-service/src/main/webapp/WEB-INF/views/iam/reset-recovery-codes-choice.jsp
+++ b/iam-login-service/src/main/webapp/WEB-INF/views/iam/authenticator-app/recovery-code/reset.jsp
@@ -26,7 +26,10 @@
     
   
   
-    
+    
+      

+        To strengthen account security, it is strongly recommended you reset your account recovery codes after one is used. To do this, press Reset. Otherwise, press Skip.
+      

       
       
diff --git a/iam-login-service/src/main/webapp/WEB-INF/views/iam/authenticator-app/recovery-code/view.jsp b/iam-login-service/src/main/webapp/WEB-INF/views/iam/authenticator-app/recovery-code/view.jsp
new file mode 100644
index 000000000..48473e95c
--- /dev/null
+++ b/iam-login-service/src/main/webapp/WEB-INF/views/iam/authenticator-app/recovery-code/view.jsp
@@ -0,0 +1,43 @@
+<%--
+
+    Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
+
+        http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
+
+--%>
+<%@ taglib prefix="authz" uri="http://www.springframework.org/security/tags"%>
+<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core"%>
+<%@ taglib prefix="t" tagdir="/WEB-INF/tags/iam"%>
+<%@ taglib prefix="spring" uri="http://www.springframework.org/tags"%>
+
+    
+    
+    
+    
+  
+  
+    
+      

+        Here are your account recovery codes. It is important you write these down as they will help you get back into your account if you lose access to your authenticator app.
+      

+      
+        
${ code }

+      
+    
+    

+      

+        
+      

+    

+  
+
\ No newline at end of file
diff --git a/iam-login-service/src/main/webapp/WEB-INF/views/iam/verify-authenticator-app-form.jsp b/iam-login-service/src/main/webapp/WEB-INF/views/iam/authenticator-app/verify-authenticator-app-form.jsp
similarity index 93%
rename from iam-login-service/src/main/webapp/WEB-INF/views/iam/verify-authenticator-app-form.jsp
rename to iam-login-service/src/main/webapp/WEB-INF/views/iam/authenticator-app/verify-authenticator-app-form.jsp
index 68638af18..fc6a3ee25 100644
--- a/iam-login-service/src/main/webapp/WEB-INF/views/iam/verify-authenticator-app-form.jsp
+++ b/iam-login-service/src/main/webapp/WEB-INF/views/iam/authenticator-app/verify-authenticator-app-form.jsp
@@ -53,5 +53,9 @@
           value="${multiFactorVerificationPageConfiguration.verifyButtonText}" name="submit" class="form-control">
       

     
+    

+      
+    

+    
   
 
diff --git a/iam-login-service/src/main/webapp/WEB-INF/views/iam/verify-mfa.jsp b/iam-login-service/src/main/webapp/WEB-INF/views/iam/verify-mfa.jsp
index 37b3c3b13..02764e527 100644
--- a/iam-login-service/src/main/webapp/WEB-INF/views/iam/verify-mfa.jsp
+++ b/iam-login-service/src/main/webapp/WEB-INF/views/iam/verify-mfa.jsp
@@ -43,14 +43,8 @@
      
     
       

-        
+        
       

     
-
-    

-      

-        
-      

-    

   
 
\ No newline at end of file

From ad2b1ad6d9b10024289ae1a7f215533805f1496a Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Tue, 14 Dec 2021 15:44:34 +0000
Subject: [PATCH 46/76] Adding ability to view and reset recovery codes

User can view recovery codes in MFA settings. They then have the option to regenerate them if they wish
---
 .../AuthenticatorAppVerifyController.java     |  36 ++++-
 .../authenticator-app.controller.js           | 141 ++++++++++++++----
 .../controllers/user-mfa.controller.js        |  34 +++--
 .../services/authenticator-app.service.js     |  14 +-
 .../home/disable-authenticator-app.html       |   3 +-
 .../templates/home/editmfasettings.html       |  27 ++--
 .../home/enable-authenticator-app.html        |   3 +-
 .../home/recovery-codes-reset-confirm.html    |  32 ++++
 .../templates/home/view-recovery-codes.html   |  35 +++++
 9 files changed, 268 insertions(+), 57 deletions(-)
 create mode 100644 iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/recovery-codes-reset-confirm.html
 create mode 100644 iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/view-recovery-codes.html

diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/AuthenticatorAppVerifyController.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/AuthenticatorAppVerifyController.java
index d297e707b..e1544ef4e 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/AuthenticatorAppVerifyController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/AuthenticatorAppVerifyController.java
@@ -25,6 +25,8 @@
 import javax.validation.Valid;
 
 import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.ResponseEntity;
 import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.security.authentication.AuthenticationEventPublisher;
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
@@ -37,14 +39,18 @@
 import org.springframework.stereotype.Controller;
 import org.springframework.ui.ModelMap;
 import org.springframework.validation.BindingResult;
+import org.springframework.web.bind.annotation.ExceptionHandler;
 import org.springframework.web.bind.annotation.ModelAttribute;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RequestMethod;
+import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.ResponseStatus;
 import org.springframework.web.servlet.mvc.support.RedirectAttributes;
 
 import dev.samstevens.totp.code.CodeVerifier;
 import it.infn.mw.iam.api.account.AccountUtils;
 import it.infn.mw.iam.api.account.multi_factor_authentication.authenticator_app.CodeDTO;
+import it.infn.mw.iam.api.common.ErrorDTO;
 import it.infn.mw.iam.authn.multi_factor_authentication.error.MultiFactorAuthenticationError;
 import it.infn.mw.iam.core.user.IamAccountService;
 import it.infn.mw.iam.persistence.model.IamAccount;
@@ -182,18 +188,34 @@ public String getResetRecoveryCodesResetView() {
 
   @PreAuthorize("hasRole('USER')")
   @RequestMapping(method = RequestMethod.POST, path = "/iam/authenticator-app/recovery-code/reset")
-  public String resetRecoveryCodes() {
+  public String resetRecoveryCodesAndView() {
+    resetRecoveryCodes();
+
+    return "redirect:/iam/authenticator-app/recovery-code/view";
+  }
+
+  @PreAuthorize("hasRole('USER')")
+  @RequestMapping(method = RequestMethod.PUT, path = "/iam/authenticator-app/recovery-code/reset")
+  public ResponseEntity resetRecoveryCodes() {
     IamAccount account = accountUtils.getAuthenticatedUserAccount()
       .orElseThrow(() -> new MultiFactorAuthenticationError("Account not found"));
     account = service.addTotpMfaRecoveryCodes(account);
     service.saveAccount(account);
 
-    return "redirect:/iam/authenticator-app/recovery-code/view";
+    return ResponseEntity.ok().build();
   }
 
   @PreAuthorize("hasRole('USER')")
   @RequestMapping(method = RequestMethod.GET, path = "/iam/authenticator-app/recovery-code/view")
   public String viewRecoveryCodes(ModelMap model) {
+    String[] codes = getRecoveryCodes();
+    model.addAttribute("recoveryCodes", codes);
+    return "/iam/authenticator-app/recovery-code/view";
+  }
+
+  @PreAuthorize("hasRole('USER')")
+  @RequestMapping(method = RequestMethod.GET, path = "/iam/authenticator-app/recovery-code/get")
+  public @ResponseBody String[] getRecoveryCodes() {
     IamAccount account = accountUtils.getAuthenticatedUserAccount()
       .orElseThrow(() -> new MultiFactorAuthenticationError("Account not found"));
 
@@ -204,7 +226,13 @@ public String viewRecoveryCodes(ModelMap model) {
       codes[i] = recs.get(i).getCode();
     }
 
-    model.addAttribute("recoveryCodes", codes);
-    return "/iam/authenticator-app/recovery-code/view";
+    return codes;
+  }
+
+  @ResponseStatus(code = HttpStatus.BAD_REQUEST)
+  @ExceptionHandler(MultiFactorAuthenticationError.class)
+  @ResponseBody
+  public ErrorDTO handleMultiFactorAuthenticationError(MultiFactorAuthenticationError e) {
+    return ErrorDTO.fromString(e.getMessage());
   }
 }
diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/authenticator-app.controller.js b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/authenticator-app.controller.js
index fc272a35a..50434a4a0 100644
--- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/authenticator-app.controller.js
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/authenticator-app.controller.js
@@ -13,29 +13,44 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-(function() {
+(function () {
   'use strict';
 
   angular.module('dashboardApp')
-      .controller('EnableAuthenticatorAppController', EnableAuthenticatorAppController);
+    .controller('EnableAuthenticatorAppController', EnableAuthenticatorAppController);
 
   angular.module('dashboardApp')
-      .controller('DisableAuthenticatorAppController', DisableAuthenticatorAppController);
+    .controller('DisableAuthenticatorAppController', DisableAuthenticatorAppController);
+
+  angular.module('dashboardApp')
+    .controller('ViewRecoveryCodesController', ViewRecoveryCodesController);
+
+  angular.module('dashboardApp')
+    .controller('ResetRecoveryCodesController', ResetRecoveryCodesController);
 
   EnableAuthenticatorAppController.$inject = [
-    '$scope', '$state', '$uibModalInstance', 'Utils', 'AuthenticatorAppService', 'user'
+    '$scope', '$uibModalInstance', 'Utils', 'AuthenticatorAppService', 'user'
   ];
 
   DisableAuthenticatorAppController.$inject = [
-    '$scope', '$state', '$uibModalInstance', 'Utils', 'AuthenticatorAppService', 'user'
+    '$scope', '$uibModalInstance', 'Utils', 'AuthenticatorAppService', 'user'
+  ];
+
+  ViewRecoveryCodesController.$inject = [
+    '$uibModalInstance', '$uibModal', 'AuthenticatorAppService'
+  ];
+
+  ResetRecoveryCodesController.$inject = [
+    '$uibModalInstance', 'Utils', 'AuthenticatorAppService'
   ];
 
   function EnableAuthenticatorAppController(
-      $scope, $state, $uibModalInstance, Utils, AuthenticatorAppService, user) {
+    $scope, $uibModalInstance, Utils, AuthenticatorAppService, user) {
     var authAppCtrl = this;
+    authAppCtrl.disabled = false;
 
-    authAppCtrl.$onInit = function() {
-      AuthenticatorAppService.addMfaSecretToUser().then(function(response) {
+    authAppCtrl.$onInit = function () {
+      AuthenticatorAppService.addMfaSecretToUser().then(function (response) {
         authAppCtrl.secret = response.data.secret;
         authAppCtrl.dataUri = response.data.dataUri;
       });
@@ -50,8 +65,6 @@
     function reset() {
       console.log('reset form');
 
-      authAppCtrl.enabled = true;
-
       authAppCtrl.user = {
         code: ''
       };
@@ -67,21 +80,25 @@
 
     authAppCtrl.message = '';
 
-    authAppCtrl.submitEnable = function() {
+    authAppCtrl.submitEnable = function () {
+      authAppCtrl.disabled = true;
       AuthenticatorAppService
-          .enableAuthenticatorApp(
-              authAppCtrl.user.code)
-          .then(function() { return $uibModalInstance.close('Authenticator app enabled'); })
-          .catch(function(error) {
-            console.error(error);
-            $scope.operationResult = Utils.buildErrorResult(error.data.error);
-          });
+        .enableAuthenticatorApp(
+          authAppCtrl.user.code)
+        .then(function () {
+          authAppCtrl.disabled = false;
+          return $uibModalInstance.close('Authenticator app enabled');
+        })
+        .catch(function (error) {
+          $scope.operationResult = Utils.buildErrorResult(error.data.error);
+        });
     };
   }
 
   function DisableAuthenticatorAppController(
-      $scope, $state, $uibModalInstance, Utils, AuthenticatorAppService, user) {
+    $scope, $uibModalInstance, Utils, AuthenticatorAppService, user) {
     var authAppCtrl = this;
+    authAppCtrl.disabled = false;
 
     authAppCtrl.userToEdit = user;
     authAppCtrl.codeMinlength = 6;
@@ -92,8 +109,6 @@
     function reset() {
       console.log('reset form');
 
-      authAppCtrl.enabled = true;
-
       authAppCtrl.user = {
         code: ''
       };
@@ -109,15 +124,83 @@
 
     authAppCtrl.message = '';
 
-    authAppCtrl.submitDisable = function() {
+    authAppCtrl.submitDisable = function () {
+      authAppCtrl.disabled = true;
       AuthenticatorAppService
-          .disableAuthenticatorApp(
-              authAppCtrl.user.code)
-          .then(function() { return $uibModalInstance.close('Authenticator app disabled'); })
-          .catch(function(error) {
-            console.error(error);
-            $scope.operationResult = Utils.buildErrorResult(error.data.error);
-          });
+        .disableAuthenticatorApp(
+          authAppCtrl.user.code)
+        .then(function () {
+          authAppCtrl.disabled = false;
+          return $uibModalInstance.close('Authenticator app disabled');
+        })
+        .catch(function (error) {
+          $scope.operationResult = Utils.buildErrorResult(error.data.error);
+        });
     };
   }
+
+  function ViewRecoveryCodesController($uibModalInstance, $uibModal, AuthenticatorAppService) {
+    var authAppCtrl = this;
+    authAppCtrl.populateRecoveryCodes = populateRecoveryCodes;
+    authAppCtrl.dismiss = dismiss;
+    authAppCtrl.resetRecoveryCodesConfirmation = resetRecoveryCodesConfirmation;
+    authAppCtrl.disabled = false;
+
+    authAppCtrl.$onInit = function () {
+      populateRecoveryCodes();
+    }
+
+    function populateRecoveryCodes() {
+      AuthenticatorAppService.viewRecoveryCodes().then(function (response) {
+        authAppCtrl.recoveryCodes = response.data;
+        buildListElement();
+      });
+    }
+
+    function buildListElement() {
+      var str = '
    ';
+      authAppCtrl.recoveryCodes.forEach(function (recoveryCode) {
+        str += '
  • ' + recoveryCode + '
    • ';
+      });
+      str += '
';
+      document.getElementById("recoveryCodes").innerHTML = str;
+    }
+
+    function dismiss() { return $uibModalInstance.dismiss('Back'); }
+
+    function resetRecoveryCodesConfirmation() {
+      var modalInstance = $uibModal.open({
+        templateUrl: '/resources/iam/apps/dashboard-app/templates/home/recovery-codes-reset-confirm.html',
+        controller: 'ResetRecoveryCodesController',
+        controllerAs: 'authAppCtrl',
+        resolve: { user: function () { return self.user; } }
+      });
+
+      modalInstance.result.then(function () {
+        populateRecoveryCodes();
+      });
+    }
+  }
+
+  function ResetRecoveryCodesController($uibModalInstance, Utils, AuthenticatorAppService) {
+    var authAppCtrl = this;
+    authAppCtrl.dismiss = dismiss;
+    authAppCtrl.resetRecoveryCodes = resetRecoveryCodes;
+    authAppCtrl.disabled = false;
+
+    function dismiss() { return $uibModalInstance.dismiss('Back'); }
+
+    function resetRecoveryCodes() {
+      authAppCtrl.disabled = true;
+      AuthenticatorAppService.resetRecoveryCodes()
+        .then(function () {
+          authAppCtrl.disabled = false;
+          $uibModalInstance.close('Recovery codes updated');
+        })
+        .catch(function (error) {
+          $scope.operationResult = Utils.buildErrorResult(error.data);
+        });
+    }
+  }
+
 })();
\ No newline at end of file
diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/user-mfa.controller.js b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/user-mfa.controller.js
index a860d922b..096e2d235 100644
--- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/user-mfa.controller.js
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/user-mfa.controller.js
@@ -16,33 +16,34 @@
 'use strict';
 
 angular.module('dashboardApp')
-    .controller('UserMfaController', UserMfaController);
+  .controller('UserMfaController', UserMfaController);
 
 UserMfaController.$inject = [
   '$http', '$scope', '$state', '$uibModalInstance', 'Utils', 'user', '$uibModal', 'toaster'
 ];
 
 function UserMfaController(
-    $http, $scope, $state, $uibModalInstance, Utils, user, $uibModal, toaster) {
+  $http, $scope, $state, $uibModalInstance, Utils, user, $uibModal, toaster) {
   var userMfaCtrl = this;
 
-  userMfaCtrl.$onInit = function() {
+  userMfaCtrl.$onInit = function () {
     console.log('UserMfaController onInit');
     getMfaSettings();
   };
 
   // TODO include this data in what is fetched from the /scim/me endpoint
   function getMfaSettings() {
-    $http.get('/iam/multi-factor-settings').then(function(response) {
+    $http.get('/iam/multi-factor-settings').then(function (response) {
       userMfaCtrl.authenticatorAppActive = response.data.authenticatorAppActive;
     });
   }
 
   userMfaCtrl.userToEdit = user;
-  
+
   userMfaCtrl.yubiKeyActive = false;
   userMfaCtrl.enableAuthenticatorApp = enableAuthenticatorApp;
   userMfaCtrl.disableAuthenticatorApp = disableAuthenticatorApp;
+  userMfaCtrl.viewRecoveryCodes = viewRecoveryCodes;
   userMfaCtrl.enableYubiKey = enableYubiKey;
   userMfaCtrl.disableYubiKey = disableYubiKey;
 
@@ -51,10 +52,10 @@ function UserMfaController(
       templateUrl: '/resources/iam/apps/dashboard-app/templates/home/enable-authenticator-app.html',
       controller: 'EnableAuthenticatorAppController',
       controllerAs: 'authAppCtrl',
-      resolve: {user: function() { return self.user; }}
+      resolve: { user: function () { return self.user; } }
     });
 
-    modalInstance.result.then(function(msg) {
+    modalInstance.result.then(function (msg) {
       return $uibModalInstance.close(msg);
     });
   }
@@ -64,10 +65,23 @@ function UserMfaController(
       templateUrl: '/resources/iam/apps/dashboard-app/templates/home/disable-authenticator-app.html',
       controller: 'DisableAuthenticatorAppController',
       controllerAs: 'authAppCtrl',
-      resolve: {user: function() { return self.user; }}
+      resolve: { user: function () { return self.user; } }
+    });
+
+    modalInstance.result.then(function (msg) {
+      return $uibModalInstance.close(msg);
+    });
+  }
+
+  function viewRecoveryCodes() {
+    var modalInstance = $uibModal.open({
+      templateUrl: '/resources/iam/apps/dashboard-app/templates/home/view-recovery-codes.html',
+      controller: 'ViewRecoveryCodesController',
+      controllerAs: 'authAppCtrl',
+      resolve: { user: function () { return self.user; } }
     });
 
-    modalInstance.result.then(function(msg) {
+    modalInstance.result.then(function (msg) {
       return $uibModalInstance.close(msg);
     });
   }
@@ -99,7 +113,7 @@ function UserMfaController(
 
   userMfaCtrl.message = '';
 
-  userMfaCtrl.submit = function() {
+  userMfaCtrl.submit = function () {
     return $uibModalInstance.close('Updated settings');
     // ResetPasswordService
     //     .updatePassword(
diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/services/authenticator-app.service.js b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/services/authenticator-app.service.js
index ccfc5826c..f4833100e 100644
--- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/services/authenticator-app.service.js
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/services/authenticator-app.service.js
@@ -24,7 +24,9 @@ function AuthenticatorAppService($http, $httpParamSerializerJQLike) {
 	var service = {
 		addMfaSecretToUser: addMfaSecretToUser,
 		enableAuthenticatorApp: enableAuthenticatorApp,
-		disableAuthenticatorApp: disableAuthenticatorApp
+		disableAuthenticatorApp: disableAuthenticatorApp,
+		viewRecoveryCodes: viewRecoveryCodes,
+		resetRecoveryCodes: resetRecoveryCodes
 	};
 
 	return service;
@@ -63,4 +65,14 @@ function AuthenticatorAppService($http, $httpParamSerializerJQLike) {
 
 		return $http.post('/iam/authenticator-app/disable', data, config);
 	};
+
+	function viewRecoveryCodes() {
+
+		return $http.get('/iam/authenticator-app/recovery-code/get');
+	}
+
+	function resetRecoveryCodes() {
+
+		return $http.put('/iam/authenticator-app/recovery-code/reset');
+	}
 }
\ No newline at end of file
diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/disable-authenticator-app.html b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/disable-authenticator-app.html
index f52ed5b0b..12b4c3759 100644
--- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/disable-authenticator-app.html
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/disable-authenticator-app.html
@@ -39,9 +39,10 @@ 
Disable MFA through authenticator app

         Minimum length required is {{authAppCtrl.codeMinlength}}
       
     
+  
 
   

-    
+    
     
     
   

diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/editmfasettings.html b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/editmfasettings.html
index 871c3b8b3..4a26f42bb 100644
--- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/editmfasettings.html
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/editmfasettings.html
@@ -27,17 +27,22 @@ 
Edit multi-factor authentication settings for {{userMfaC
         

           
           
-          
-            
-            
-               Enabled
-            
-            
-            
-               Disabled
-            
-            
-          
+          
+            
+              
+              
+                 Enabled
+              
+              
+              
+                 Disabled
+              
+              
+            
+            
+              
+            
+          
         

 
         

diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/enable-authenticator-app.html b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/enable-authenticator-app.html
index a2e28b419..1244cd5e2 100644
--- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/enable-authenticator-app.html
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/enable-authenticator-app.html
@@ -40,9 +40,10 @@ 
Enable authenticator app

         Minimum length required is {{authAppCtrl.codeMinlength}}
       

     
+  
 
   

-    
+    
     
     
   

diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/recovery-codes-reset-confirm.html b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/recovery-codes-reset-confirm.html
new file mode 100644
index 000000000..e693b43fd
--- /dev/null
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/recovery-codes-reset-confirm.html
@@ -0,0 +1,32 @@
+
+

+  
Reset recovery codes

+

+
+

+  
+
+  
Are you sure you want to reset your recovery codes?

+  
This action can't be undone.

+

+
+

+  
+  
+

\ No newline at end of file
diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/view-recovery-codes.html b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/view-recovery-codes.html
new file mode 100644
index 000000000..ba38b4c92
--- /dev/null
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/view-recovery-codes.html
@@ -0,0 +1,35 @@
+
+

+  
Authenticator app recovery codes

+

+
+

+  
+
+  
Here are your multi-factor recovery codes.

+  
It is important you write these down and store them in a safe place.

+  
They will help you access your account if you lose access to your authenticator app.

+
+  

+

+
+

+  
+  
+

\ No newline at end of file

From d378875691ae3f3ca4e9ebbc92910fc641eea7ec Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Tue, 14 Dec 2021 15:57:59 +0000
Subject: [PATCH 47/76] Fixing error message tests in
 AuthenticatorAppSettingsTests

---
 ...ava => AuthenticatorAppSettingsTests.java} | 26 +++++++++----------
 1 file changed, 13 insertions(+), 13 deletions(-)
 rename iam-login-service/src/test/java/it/infn/mw/iam/test/api/account/multi_factor_authentication/authenticator_app/{AuthenticatorAppTests.java => AuthenticatorAppSettingsTests.java} (95%)

diff --git a/iam-login-service/src/test/java/it/infn/mw/iam/test/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppTests.java b/iam-login-service/src/test/java/it/infn/mw/iam/test/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppSettingsTests.java
similarity index 95%
rename from iam-login-service/src/test/java/it/infn/mw/iam/test/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppTests.java
rename to iam-login-service/src/test/java/it/infn/mw/iam/test/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppSettingsTests.java
index f674c8aec..a8cc590aa 100644
--- a/iam-login-service/src/test/java/it/infn/mw/iam/test/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppTests.java
+++ b/iam-login-service/src/test/java/it/infn/mw/iam/test/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppSettingsTests.java
@@ -51,7 +51,7 @@
 
 @RunWith(SpringRunner.class)
 @IamRandomPortIntegrationTest
-public class AuthenticatorAppTests {
+public class AuthenticatorAppSettingsTests {
 
   @Value("${local.server.port}")
   private Integer iamPort;
@@ -214,7 +214,7 @@ public void testEnableAuthenticatorAppIncorrectCode() throws Exception {
 
     doPost(accessToken, AuthenticatorAppSettingsController.ENABLE_URL, code)
       .statusCode(HttpStatus.BAD_REQUEST.value())
-      .body(containsString("Incorrect code"));
+      .body(containsString("Bad MFA code"));
   }
 
   @Test
@@ -228,7 +228,7 @@ public void testEnableAuthenticatorAppInvalidCharactersInCode() throws Exception
 
     doPost(accessToken, AuthenticatorAppSettingsController.ENABLE_URL, code)
       .statusCode(HttpStatus.BAD_REQUEST.value())
-      .body(containsString("Invalid code format"));
+      .body(containsString("Bad MFA code"));
   }
 
   @Test
@@ -242,7 +242,7 @@ public void testEnableAuthenticatorAppCodeTooShort() throws Exception {
 
     doPost(accessToken, AuthenticatorAppSettingsController.ENABLE_URL, code)
       .statusCode(HttpStatus.BAD_REQUEST.value())
-      .body(containsString("Invalid code format"));
+      .body(containsString("Bad MFA code"));
   }
 
   @Test
@@ -256,7 +256,7 @@ public void testEnableAuthenticatorAppCodeTooLong() throws Exception {
 
     doPost(accessToken, AuthenticatorAppSettingsController.ENABLE_URL, code)
       .statusCode(HttpStatus.BAD_REQUEST.value())
-      .body(containsString("Invalid code format"));
+      .body(containsString("Bad MFA code"));
   }
 
   @Test
@@ -270,7 +270,7 @@ public void testEnableAuthenticatorAppNullCode() throws Exception {
 
     doPost(accessToken, AuthenticatorAppSettingsController.ENABLE_URL, code)
       .statusCode(HttpStatus.BAD_REQUEST.value())
-      .body(containsString("Invalid code format"));
+      .body(containsString("Bad MFA code"));
   }
 
   @Test
@@ -284,7 +284,7 @@ public void testEnableAuthenticatorAppEmptyCode() throws Exception {
 
     doPost(accessToken, AuthenticatorAppSettingsController.ENABLE_URL, code)
       .statusCode(HttpStatus.BAD_REQUEST.value())
-      .body(containsString("Invalid code format"));
+      .body(containsString("Bad MFA code"));
   }
 
   @Test
@@ -342,7 +342,7 @@ public void testDisableAuthenticatorAppIncorrectCode() throws Exception {
 
     doPost(accessToken, AuthenticatorAppSettingsController.DISABLE_URL, code)
       .statusCode(HttpStatus.BAD_REQUEST.value())
-      .body(containsString("Incorrect code"));
+      .body(containsString("Bad MFA code"));
   }
 
   @Test
@@ -356,7 +356,7 @@ public void testDisableAuthenticatorAppInvalidCharactersInCode() throws Exceptio
 
     doPost(accessToken, AuthenticatorAppSettingsController.DISABLE_URL, code)
       .statusCode(HttpStatus.BAD_REQUEST.value())
-      .body(containsString("Invalid code format"));
+      .body(containsString("Bad MFA code"));
   }
 
   @Test
@@ -370,7 +370,7 @@ public void testDisableAuthenticatorAppCodeTooShort() throws Exception {
 
     doPost(accessToken, AuthenticatorAppSettingsController.DISABLE_URL, code)
       .statusCode(HttpStatus.BAD_REQUEST.value())
-      .body(containsString("Invalid code format"));
+      .body(containsString("Bad MFA code"));
   }
 
   @Test
@@ -384,7 +384,7 @@ public void testDisableAuthenticatorAppCodeTooLong() throws Exception {
 
     doPost(accessToken, AuthenticatorAppSettingsController.DISABLE_URL, code)
       .statusCode(HttpStatus.BAD_REQUEST.value())
-      .body(containsString("Invalid code format"));
+      .body(containsString("Bad MFA code"));
   }
 
   @Test
@@ -398,7 +398,7 @@ public void testDisableAuthenticatorAppNullCode() throws Exception {
 
     doPost(accessToken, AuthenticatorAppSettingsController.DISABLE_URL, code)
       .statusCode(HttpStatus.BAD_REQUEST.value())
-      .body(containsString("Invalid code format"));
+      .body(containsString("Bad MFA code"));
   }
 
   @Test
@@ -412,7 +412,7 @@ public void testDisableAuthenticatorAppEmptyCode() throws Exception {
 
     doPost(accessToken, AuthenticatorAppSettingsController.DISABLE_URL, code)
       .statusCode(HttpStatus.BAD_REQUEST.value())
-      .body(containsString("Invalid code format"));
+      .body(containsString("Bad MFA code"));
   }
 
   @Test

From a0d900df29520ad7bca0d190475f5481508c2331 Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Wed, 15 Dec 2021 09:26:46 +0000
Subject: [PATCH 48/76] Fixing enabling and disabing totpMfa tests for
 IamAccount

This was due to a bug caused by not properly mocking the save() call to the account repository
---
 .../java/it/infn/mw/iam/test/service/IamAccountServiceTests.java | 1 +
 1 file changed, 1 insertion(+)

diff --git a/iam-login-service/src/test/java/it/infn/mw/iam/test/service/IamAccountServiceTests.java b/iam-login-service/src/test/java/it/infn/mw/iam/test/service/IamAccountServiceTests.java
index 13124ba67..830d4aaaa 100644
--- a/iam-login-service/src/test/java/it/infn/mw/iam/test/service/IamAccountServiceTests.java
+++ b/iam-login-service/src/test/java/it/infn/mw/iam/test/service/IamAccountServiceTests.java
@@ -135,6 +135,7 @@ public void setup() {
     when(accountRepo.findByEmail(anyString())).thenReturn(Optional.empty());
     when(accountRepo.findByUsername(TEST_USERNAME)).thenReturn(Optional.of(TEST_ACCOUNT));
     when(accountRepo.findByEmail(TEST_EMAIL)).thenReturn(Optional.of(TEST_ACCOUNT));
+    when(accountRepo.save(any(IamAccount.class))).thenAnswer(i -> i.getArguments()[0]);
     when(authoritiesRepo.findByAuthority(anyString())).thenReturn(Optional.empty());
     when(authoritiesRepo.findByAuthority("ROLE_USER")).thenReturn(Optional.of(ROLE_USER_AUTHORITY));
     when(passwordEncoder.encode(any())).thenReturn(PASSWORD);

From 79e5248332268bc8937da07a74146ee8d6797ab0 Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Thu, 16 Dec 2021 16:12:02 +0000
Subject: [PATCH 49/76] Adding tests for MfaVerify and AuthenticatorAppVerify
 controllers

Going to separate unrelated functionality in the AuthenticatorAppVerify controller. Some functionality is to do with resetting and viewing account recovery codes, which is separate from the verification process, which should be the point of this controller. A new controller will be made to house that separate functionality.
---
 .../MfaVerifyController.java                  |  12 ++
 .../AuthenticatorAppVerifyController.java     |   9 +-
 .../MfaVerifyControllerTests.java             |  85 ++++++++
 .../MultiFactorTestSupport.java               |  65 ++++++
 ...AuthenticatorAppVerifyControllerTests.java | 202 ++++++++++++++++++
 5 files changed, 370 insertions(+), 3 deletions(-)
 create mode 100644 iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/MfaVerifyControllerTests.java
 create mode 100644 iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/MultiFactorTestSupport.java
 create mode 100644 iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/authenticator_app/AuthenticatorAppVerifyControllerTests.java

diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MfaVerifyController.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MfaVerifyController.java
index b4a7a40d0..631b4486b 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MfaVerifyController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MfaVerifyController.java
@@ -18,14 +18,19 @@
 import static it.infn.mw.iam.authn.multi_factor_authentication.MfaVerifyController.MFA_VERIFY_URL;
 
 import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.http.HttpStatus;
 import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.security.core.Authentication;
 import org.springframework.stereotype.Controller;
 import org.springframework.ui.ModelMap;
+import org.springframework.web.bind.annotation.ExceptionHandler;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RequestMethod;
+import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.ResponseStatus;
 
 import it.infn.mw.iam.api.account.multi_factor_authentication.MultiFactorSettingsDTO;
+import it.infn.mw.iam.api.common.ErrorDTO;
 import it.infn.mw.iam.api.common.NoSuchAccountError;
 import it.infn.mw.iam.persistence.model.IamAccount;
 import it.infn.mw.iam.persistence.repository.IamAccountRepository;
@@ -65,4 +70,11 @@ private MultiFactorSettingsDTO populateMfaSettings(IamAccount account) {
 
     return dto;
   }
+
+  @ResponseStatus(code = HttpStatus.BAD_REQUEST)
+  @ExceptionHandler(NoSuchAccountError.class)
+  @ResponseBody
+  public ErrorDTO handleNoSuchAccountError(NoSuchAccountError e) {
+    return ErrorDTO.fromString(e.getMessage());
+  }
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/AuthenticatorAppVerifyController.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/AuthenticatorAppVerifyController.java
index e1544ef4e..a32f19678 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/AuthenticatorAppVerifyController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/AuthenticatorAppVerifyController.java
@@ -59,6 +59,10 @@
 @Controller
 public class AuthenticatorAppVerifyController {
 
+  public static final String VERIFY_CODE_URL = MFA_VERIFY_URL + "/authenticator-app/code";
+  public static final String VERIFY_RECOVERY_CODE_URL =
+      MFA_VERIFY_URL + "/authenticator-app/recovery-code";
+
   private final AccountUtils accountUtils;
   private final CodeVerifier codeVerifier;
   private final AuthenticationEventPublisher eventPublisher;
@@ -87,7 +91,7 @@ private void authenticationFailureEvent(AuthenticationException exception,
   }
 
   @PreAuthorize("hasRole('PRE_AUTHENTICATED')")
-  @RequestMapping(method = RequestMethod.POST, path = MFA_VERIFY_URL + "/authenticator-app/code")
+  @RequestMapping(method = RequestMethod.POST, path = VERIFY_CODE_URL)
   public String verifyCode(@ModelAttribute @Valid CodeDTO code, BindingResult validationResult,
       Authentication authentication, RedirectAttributes redirectAttributes) {
     if (validationResult.hasErrors()) {
@@ -123,8 +127,7 @@ public String verifyCode(@ModelAttribute @Valid CodeDTO code, BindingResult vali
   }
 
   @PreAuthorize("hasRole('PRE_AUTHENTICATED')")
-  @RequestMapping(method = RequestMethod.POST,
-      path = MFA_VERIFY_URL + "/authenticator-app/recovery-code")
+  @RequestMapping(method = RequestMethod.POST, path = VERIFY_RECOVERY_CODE_URL)
   public String verifyRecoveryCode(@ModelAttribute @Valid RecoveryCodeDTO recoveryCode,
       BindingResult validationResult, Authentication authentication,
       RedirectAttributes redirectAttributes) {
diff --git a/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/MfaVerifyControllerTests.java b/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/MfaVerifyControllerTests.java
new file mode 100644
index 000000000..e27cec09a
--- /dev/null
+++ b/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/MfaVerifyControllerTests.java
@@ -0,0 +1,85 @@
+package it.infn.mw.iam.test.multi_factor_authentication;
+
+import static org.mockito.Mockito.reset;
+import static org.mockito.Mockito.when;
+import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.model;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
+import static org.springframework.security.test.web.servlet.setup.SecurityMockMvcConfigurers.springSecurity;
+import static org.springframework.test.web.servlet.result.MockMvcResultHandlers.log;
+
+import java.util.Optional;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.InjectMocks;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.test.mock.mockito.MockBean;
+import org.springframework.security.test.context.support.WithMockUser;
+import org.springframework.test.context.junit4.SpringRunner;
+import org.springframework.test.web.servlet.MockMvc;
+import org.springframework.test.web.servlet.setup.MockMvcBuilders;
+import org.springframework.web.context.WebApplicationContext;
+
+import it.infn.mw.iam.authn.multi_factor_authentication.MfaVerifyController;
+import it.infn.mw.iam.persistence.repository.IamAccountRepository;
+import it.infn.mw.iam.test.util.WithAnonymousUser;
+import it.infn.mw.iam.test.util.WithMockPreAuthenticatedUser;
+import it.infn.mw.iam.test.util.annotation.IamMockMvcIntegrationTest;
+
+@RunWith(SpringRunner.class)
+@IamMockMvcIntegrationTest
+public class MfaVerifyControllerTests extends MultiFactorTestSupport {
+
+  private MockMvc mvc;
+
+  @Autowired
+  private WebApplicationContext context;
+
+  @MockBean
+  private IamAccountRepository accountRepo;
+
+  @InjectMocks
+  MfaVerifyController controller;
+
+  @Before
+  public void setup() {
+    when(accountRepo.findByUsername(TEST_USERNAME)).thenReturn(Optional.of(TEST_ACCOUNT));
+
+    mvc =
+        MockMvcBuilders.webAppContextSetup(context).apply(springSecurity()).alwaysDo(log()).build();
+  }
+
+  @After
+  public void tearDown() {
+    reset(accountRepo);
+  }
+
+  @Test
+  @WithMockPreAuthenticatedUser(username = TEST_USERNAME)
+  public void testGetMfaVerifyView() throws Exception {
+    mvc.perform(get(MfaVerifyController.MFA_VERIFY_URL))
+      .andExpect(status().isOk())
+      .andExpect(model().attributeExists("factors"));
+  }
+
+  @Test
+  @WithAnonymousUser
+  public void testGetMfaVerifyViewNoAuthenticationIsUnauthorized() throws Exception {
+    mvc.perform(get(MfaVerifyController.MFA_VERIFY_URL)).andExpect(status().isUnauthorized());
+  }
+
+  @Test
+  @WithMockUser(username = "test", authorities = {"USER"})
+  public void testGetMfaVerifyViewWithFullAuthenticationIsForbidden() throws Exception {
+    mvc.perform(get(MfaVerifyController.MFA_VERIFY_URL)).andExpect(status().isForbidden());
+  }
+
+  @Test
+  @WithMockPreAuthenticatedUser(username = "bad_user")
+  public void testGetMfaVerifyViewWhenUserNotFoundIsBadRequest() throws Exception {
+    mvc.perform(get(MfaVerifyController.MFA_VERIFY_URL)).andExpect(status().isBadRequest());
+  }
+}
diff --git a/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/MultiFactorTestSupport.java b/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/MultiFactorTestSupport.java
new file mode 100644
index 000000000..af065fc13
--- /dev/null
+++ b/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/MultiFactorTestSupport.java
@@ -0,0 +1,65 @@
+package it.infn.mw.iam.test.multi_factor_authentication;
+
+import java.util.Arrays;
+import java.util.HashSet;
+
+import it.infn.mw.iam.persistence.model.IamAccount;
+import it.infn.mw.iam.persistence.model.IamTotpMfa;
+import it.infn.mw.iam.persistence.model.IamTotpRecoveryCode;
+
+public class MultiFactorTestSupport {
+  public static final String TEST_USERNAME = "test-pre-authenticated-user";
+  public static final String TEST_UUID = "ceb173b4-28e3-43ad-aaf7-15d3730e2b90";
+  public static final String TEST_EMAIL = "test@example.org";
+  public static final String TEST_GIVEN_NAME = "Test";
+  public static final String TEST_FAMILY_NAME = "User";
+  public static final String TOTP_MFA_SECRET = "secret";
+  public static final String TOTP_RECOVERY_CODE_STRING_1 = "code-1";
+  public static final String TOTP_RECOVERY_CODE_STRING_2 = "code-2";
+  public static final String TOTP_RECOVERY_CODE_STRING_3 = "code-3";
+  public static final String TOTP_RECOVERY_CODE_STRING_4 = "code-4";
+  public static final String TOTP_RECOVERY_CODE_STRING_5 = "code-5";
+  public static final String TOTP_RECOVERY_CODE_STRING_6 = "code-6";
+
+  protected final IamAccount TEST_ACCOUNT;
+  protected final IamTotpMfa TOTP_MFA;
+  protected final IamTotpRecoveryCode TOTP_RECOVERY_CODE_1;
+  protected final IamTotpRecoveryCode TOTP_RECOVERY_CODE_2;
+  protected final IamTotpRecoveryCode TOTP_RECOVERY_CODE_3;
+  protected final IamTotpRecoveryCode TOTP_RECOVERY_CODE_4;
+  protected final IamTotpRecoveryCode TOTP_RECOVERY_CODE_5;
+  protected final IamTotpRecoveryCode TOTP_RECOVERY_CODE_6;
+
+  public MultiFactorTestSupport() {
+    TOTP_MFA = new IamTotpMfa();
+    TOTP_MFA.setSecret(TOTP_MFA_SECRET);
+    TOTP_MFA.setActive(true);
+
+    TOTP_RECOVERY_CODE_1 = new IamTotpRecoveryCode(TOTP_MFA);
+    TOTP_RECOVERY_CODE_2 = new IamTotpRecoveryCode(TOTP_MFA);
+    TOTP_RECOVERY_CODE_3 = new IamTotpRecoveryCode(TOTP_MFA);
+    TOTP_RECOVERY_CODE_4 = new IamTotpRecoveryCode(TOTP_MFA);
+    TOTP_RECOVERY_CODE_5 = new IamTotpRecoveryCode(TOTP_MFA);
+    TOTP_RECOVERY_CODE_6 = new IamTotpRecoveryCode(TOTP_MFA);
+
+    TOTP_RECOVERY_CODE_1.setCode(TOTP_RECOVERY_CODE_STRING_1);
+    TOTP_RECOVERY_CODE_2.setCode(TOTP_RECOVERY_CODE_STRING_2);
+    TOTP_RECOVERY_CODE_3.setCode(TOTP_RECOVERY_CODE_STRING_3);
+    TOTP_RECOVERY_CODE_4.setCode(TOTP_RECOVERY_CODE_STRING_4);
+    TOTP_RECOVERY_CODE_5.setCode(TOTP_RECOVERY_CODE_STRING_5);
+    TOTP_RECOVERY_CODE_6.setCode(TOTP_RECOVERY_CODE_STRING_6);
+
+    TOTP_MFA
+      .setRecoveryCodes(new HashSet<>(Arrays.asList(TOTP_RECOVERY_CODE_1, TOTP_RECOVERY_CODE_2,
+          TOTP_RECOVERY_CODE_3, TOTP_RECOVERY_CODE_4, TOTP_RECOVERY_CODE_5, TOTP_RECOVERY_CODE_6)));
+    TEST_ACCOUNT = IamAccount.newAccount();
+    TEST_ACCOUNT.setUsername(TEST_USERNAME);
+    TEST_ACCOUNT.setUuid(TEST_UUID);
+    TEST_ACCOUNT.getUserInfo().setEmail(TEST_EMAIL);
+    TEST_ACCOUNT.getUserInfo().setGivenName(TEST_GIVEN_NAME);
+    TEST_ACCOUNT.getUserInfo().setFamilyName(TEST_FAMILY_NAME);
+    TEST_ACCOUNT.setTotpMfa(TOTP_MFA);
+
+    TEST_ACCOUNT.touch();
+  }
+}
diff --git a/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/authenticator_app/AuthenticatorAppVerifyControllerTests.java b/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/authenticator_app/AuthenticatorAppVerifyControllerTests.java
new file mode 100644
index 000000000..ab080c26c
--- /dev/null
+++ b/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/authenticator_app/AuthenticatorAppVerifyControllerTests.java
@@ -0,0 +1,202 @@
+package it.infn.mw.iam.test.multi_factor_authentication.authenticator_app;
+
+import static it.infn.mw.iam.authn.multi_factor_authentication.authenticator_app.AuthenticatorAppVerifyController.VERIFY_CODE_URL;
+import static it.infn.mw.iam.authn.multi_factor_authentication.authenticator_app.AuthenticatorAppVerifyController.VERIFY_RECOVERY_CODE_URL;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.instanceOf;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.Mockito.reset;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+import static org.springframework.security.test.web.servlet.setup.SecurityMockMvcConfigurers.springSecurity;
+import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
+import static org.springframework.test.web.servlet.result.MockMvcResultHandlers.log;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
+
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Optional;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.ArgumentCaptor;
+import org.mockito.Captor;
+import org.mockito.InjectMocks;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.test.mock.mockito.MockBean;
+import org.springframework.http.MediaType;
+import org.springframework.security.authentication.AuthenticationEventPublisher;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.AuthenticationException;
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.authority.SimpleGrantedAuthority;
+import org.springframework.test.context.junit4.SpringRunner;
+import org.springframework.test.web.servlet.MockMvc;
+import org.springframework.test.web.servlet.setup.MockMvcBuilders;
+import org.springframework.web.context.WebApplicationContext;
+
+import dev.samstevens.totp.code.CodeVerifier;
+import it.infn.mw.iam.api.account.AccountUtils;
+import it.infn.mw.iam.authn.multi_factor_authentication.authenticator_app.AuthenticatorAppVerifyController;
+import it.infn.mw.iam.authn.multi_factor_authentication.error.MultiFactorAuthenticationError;
+import it.infn.mw.iam.core.user.DefaultIamAccountService;
+import it.infn.mw.iam.test.multi_factor_authentication.MultiFactorTestSupport;
+import it.infn.mw.iam.test.util.WithAnonymousUser;
+import it.infn.mw.iam.test.util.WithMockPreAuthenticatedUser;
+import it.infn.mw.iam.test.util.annotation.IamMockMvcIntegrationTest;
+
+@RunWith(SpringRunner.class)
+@IamMockMvcIntegrationTest
+public class AuthenticatorAppVerifyControllerTests extends MultiFactorTestSupport {
+
+  private MockMvc mvc;
+
+  @Autowired
+  private WebApplicationContext context;
+
+  @MockBean
+  private AccountUtils accountUtils;
+
+  @MockBean
+  private CodeVerifier codeVerifier;
+
+  @MockBean
+  private DefaultIamAccountService service;
+
+  @MockBean
+  private AuthenticationEventPublisher eventPublisher;
+
+  @Captor
+  private ArgumentCaptor authEventCaptor;
+
+  @Captor
+  private ArgumentCaptor authExceptionCaptor;
+
+  @InjectMocks
+  private AuthenticatorAppVerifyController controller;
+
+  @Before
+  public void setup() {
+    when(accountUtils.getAuthenticatedUserAccount()).thenReturn(Optional.of(TEST_ACCOUNT));
+    when(codeVerifier.isValidCode(anyString(), anyString())).thenReturn(true);
+
+    mvc =
+        MockMvcBuilders.webAppContextSetup(context).apply(springSecurity()).alwaysDo(log()).build();
+  }
+
+  @After
+  public void tearDown() {
+    reset(accountUtils);
+    reset(codeVerifier);
+  }
+
+  @Test
+  @WithMockPreAuthenticatedUser(username = TEST_USERNAME)
+  public void testVerifyCodeValidCode() throws Exception {
+    mvc
+      .perform(post(VERIFY_CODE_URL).param("code", "123456")
+        .contentType(MediaType.APPLICATION_FORM_URLENCODED))
+      .andExpect(status().is3xxRedirection());
+
+    verify(eventPublisher).publishAuthenticationSuccess(authEventCaptor.capture());
+    Authentication newAuth = authEventCaptor.getValue();
+    List authorities = new ArrayList<>(newAuth.getAuthorities());
+    assertTrue(authorities.contains(new SimpleGrantedAuthority("ROLE_USER")));
+  }
+
+  @Test
+  @WithMockPreAuthenticatedUser(username = TEST_USERNAME)
+  public void testVerifyCodeWrongCodeFails() throws Exception {
+    when(codeVerifier.isValidCode(anyString(), anyString())).thenReturn(false);
+
+    mvc
+      .perform(post(VERIFY_CODE_URL).param("code", "123456")
+        .contentType(MediaType.APPLICATION_FORM_URLENCODED))
+      .andExpect(status().is3xxRedirection());
+
+    verify(eventPublisher).publishAuthenticationFailure(authExceptionCaptor.capture(), any());
+    AuthenticationException e = authExceptionCaptor.getValue();
+    assertThat(e, instanceOf(MultiFactorAuthenticationError.class));
+    assertEquals(e.getMessage(), "Bad MFA code");
+  }
+
+  @Test
+  @WithMockPreAuthenticatedUser(username = TEST_USERNAME)
+  public void testVerifyCodeInvalidCodeFormatFails() throws Exception {
+    mvc
+      .perform(post(VERIFY_CODE_URL).param("code", "invalid-code")
+        .contentType(MediaType.APPLICATION_FORM_URLENCODED))
+      .andExpect(status().is3xxRedirection());
+
+    verify(eventPublisher).publishAuthenticationFailure(authExceptionCaptor.capture(), any());
+    AuthenticationException e = authExceptionCaptor.getValue();
+    assertThat(e, instanceOf(MultiFactorAuthenticationError.class));
+    assertEquals(e.getMessage(), "Bad MFA code");
+  }
+
+  @Test
+  @WithAnonymousUser
+  public void testVerifyCodeNoPreAuthenticationFails() throws Exception {
+    mvc
+      .perform(post(VERIFY_CODE_URL).param("code", "123456")
+        .contentType(MediaType.APPLICATION_FORM_URLENCODED))
+      .andExpect(status().is4xxClientError());
+  }
+
+  @Test
+  @WithMockPreAuthenticatedUser(username = TEST_USERNAME)
+  public void testVerifyRecoveryCodeValidRecoveryCode() throws Exception {
+    mvc
+      .perform(post(VERIFY_RECOVERY_CODE_URL).param("recoveryCode", TOTP_RECOVERY_CODE_1.getCode())
+        .contentType(MediaType.APPLICATION_FORM_URLENCODED))
+      .andExpect(status().is3xxRedirection());
+
+    verify(eventPublisher).publishAuthenticationSuccess(authEventCaptor.capture());
+    Authentication newAuth = authEventCaptor.getValue();
+    List authorities = new ArrayList<>(newAuth.getAuthorities());
+    assertTrue(authorities.contains(new SimpleGrantedAuthority("ROLE_USER")));
+  }
+
+  @Test
+  @WithMockPreAuthenticatedUser(username = TEST_USERNAME)
+  public void testVerifyRecoveryCodeEmptyRecoveryCodeFails() throws Exception {
+    mvc
+      .perform(post(VERIFY_RECOVERY_CODE_URL).param("recoveryCode", "")
+        .contentType(MediaType.APPLICATION_FORM_URLENCODED))
+      .andExpect(status().is3xxRedirection());
+
+    verify(eventPublisher).publishAuthenticationFailure(authExceptionCaptor.capture(), any());
+    AuthenticationException e = authExceptionCaptor.getValue();
+    assertThat(e, instanceOf(MultiFactorAuthenticationError.class));
+    assertEquals(e.getMessage(), "Bad recovery code");
+  }
+
+  @Test
+  @WithMockPreAuthenticatedUser(username = TEST_USERNAME)
+  public void testVerifyRecoveryCodeWrongRecoveryCodeFails() throws Exception {
+    mvc
+      .perform(post(VERIFY_RECOVERY_CODE_URL).param("recoveryCode", "wrong-code")
+        .contentType(MediaType.APPLICATION_FORM_URLENCODED))
+      .andExpect(status().is3xxRedirection());
+
+    verify(eventPublisher).publishAuthenticationFailure(authExceptionCaptor.capture(), any());
+    AuthenticationException e = authExceptionCaptor.getValue();
+    assertThat(e, instanceOf(MultiFactorAuthenticationError.class));
+    assertEquals(e.getMessage(), "Bad recovery code");
+  }
+
+  @Test
+  @WithAnonymousUser
+  public void testVerifyRecoveryCodeNoPreAuthenticationFails() throws Exception {
+    mvc
+      .perform(post(VERIFY_RECOVERY_CODE_URL).param("recoveryCode", TOTP_RECOVERY_CODE_1.getCode())
+        .contentType(MediaType.APPLICATION_FORM_URLENCODED))
+      .andExpect(status().is4xxClientError());
+  }
+}

From ffa735af1381d128b12f507e939dcd3249641391 Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Thu, 16 Dec 2021 16:13:56 +0000
Subject: [PATCH 50/76] Adding licence header

---
 .../MfaVerifyControllerTests.java                 | 15 +++++++++++++++
 .../MultiFactorTestSupport.java                   | 15 +++++++++++++++
 .../AuthenticatorAppVerifyControllerTests.java    | 15 +++++++++++++++
 3 files changed, 45 insertions(+)

diff --git a/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/MfaVerifyControllerTests.java b/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/MfaVerifyControllerTests.java
index e27cec09a..137fe2262 100644
--- a/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/MfaVerifyControllerTests.java
+++ b/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/MfaVerifyControllerTests.java
@@ -1,3 +1,18 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 package it.infn.mw.iam.test.multi_factor_authentication;
 
 import static org.mockito.Mockito.reset;
diff --git a/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/MultiFactorTestSupport.java b/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/MultiFactorTestSupport.java
index af065fc13..3a9c7c398 100644
--- a/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/MultiFactorTestSupport.java
+++ b/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/MultiFactorTestSupport.java
@@ -1,3 +1,18 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 package it.infn.mw.iam.test.multi_factor_authentication;
 
 import java.util.Arrays;
diff --git a/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/authenticator_app/AuthenticatorAppVerifyControllerTests.java b/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/authenticator_app/AuthenticatorAppVerifyControllerTests.java
index ab080c26c..a043e24c5 100644
--- a/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/authenticator_app/AuthenticatorAppVerifyControllerTests.java
+++ b/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/authenticator_app/AuthenticatorAppVerifyControllerTests.java
@@ -1,3 +1,18 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 package it.infn.mw.iam.test.multi_factor_authentication.authenticator_app;
 
 import static it.infn.mw.iam.authn.multi_factor_authentication.authenticator_app.AuthenticatorAppVerifyController.VERIFY_CODE_URL;

From 4741225cd4507c5987b5297c03222ba6a8e3a741 Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Fri, 17 Dec 2021 14:31:17 +0000
Subject: [PATCH 51/76] Adding tests for recovery code management controller
 endpoints

These are tests for anything concerned with viewing, fetching or resetting account recovery codes.
---
 .../RecoveryCodesResetEvent.java              |  37 +++
 .../AuthenticatorAppVerifyController.java     |  75 +-----
 .../RecoveryCodeManagementController.java     | 129 +++++++++
 .../MultiFactorTestSupport.java               |  91 ++++++-
 ...AuthenticatorAppVerifyControllerTests.java |   5 +-
 ...RecoveryCodeManagementControllerTests.java | 252 ++++++++++++++++++
 6 files changed, 515 insertions(+), 74 deletions(-)
 create mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/RecoveryCodesResetEvent.java
 create mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/RecoveryCodeManagementController.java
 create mode 100644 iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/authenticator_app/RecoveryCodeManagementControllerTests.java

diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/RecoveryCodesResetEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/RecoveryCodesResetEvent.java
new file mode 100644
index 000000000..77cee772f
--- /dev/null
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/RecoveryCodesResetEvent.java
@@ -0,0 +1,37 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.infn.mw.iam.audit.events.account.multi_factor_authentication;
+
+import it.infn.mw.iam.persistence.model.IamAccount;
+
+public class RecoveryCodesResetEvent extends MultiFactorEvent {
+
+  public static final String TEMPLATE = "MFA recovery codes reset on account '%s'";
+
+  // TODO add this in
+  // private static final long serialVersionUID = 3213253939764135733L;
+
+  private final IamAccount account;
+
+  public RecoveryCodesResetEvent(Object source, IamAccount account) {
+    super(source, account, String.format(TEMPLATE, account.getUsername()));
+    this.account = account;
+  }
+
+  public IamAccount getAccount() {
+    return account;
+  }
+}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/AuthenticatorAppVerifyController.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/AuthenticatorAppVerifyController.java
index a32f19678..f5d7b05de 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/AuthenticatorAppVerifyController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/AuthenticatorAppVerifyController.java
@@ -26,7 +26,6 @@
 
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.http.HttpStatus;
-import org.springframework.http.ResponseEntity;
 import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.security.authentication.AuthenticationEventPublisher;
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
@@ -37,7 +36,6 @@
 import org.springframework.security.core.context.SecurityContext;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.stereotype.Controller;
-import org.springframework.ui.ModelMap;
 import org.springframework.validation.BindingResult;
 import org.springframework.web.bind.annotation.ExceptionHandler;
 import org.springframework.web.bind.annotation.ModelAttribute;
@@ -52,7 +50,6 @@
 import it.infn.mw.iam.api.account.multi_factor_authentication.authenticator_app.CodeDTO;
 import it.infn.mw.iam.api.common.ErrorDTO;
 import it.infn.mw.iam.authn.multi_factor_authentication.error.MultiFactorAuthenticationError;
-import it.infn.mw.iam.core.user.IamAccountService;
 import it.infn.mw.iam.persistence.model.IamAccount;
 import it.infn.mw.iam.persistence.model.IamTotpRecoveryCode;
 
@@ -66,7 +63,6 @@ public class AuthenticatorAppVerifyController {
   private final AccountUtils accountUtils;
   private final CodeVerifier codeVerifier;
   private final AuthenticationEventPublisher eventPublisher;
-  final IamAccountService service;
 
   // TODO - step up authentication page can't read SPRING_SECURITY_LAST_EXCEPTION.message to display
   // "Bad code" error. Fix this and use
@@ -74,11 +70,10 @@ public class AuthenticatorAppVerifyController {
 
   @Autowired
   public AuthenticatorAppVerifyController(AccountUtils accountUtils, CodeVerifier codeVerifier,
-      AuthenticationEventPublisher eventPublisher, IamAccountService service) {
+      AuthenticationEventPublisher eventPublisher) {
     this.accountUtils = accountUtils;
     this.codeVerifier = codeVerifier;
     this.eventPublisher = eventPublisher;
-    this.service = service;
   }
 
   private void authenticationSuccessEvent(Authentication authentication) {
@@ -166,6 +161,13 @@ public String verifyRecoveryCode(@ModelAttribute @Valid RecoveryCodeDTO recovery
     return "redirect:/iam/authenticator-app/recovery-code/reset";
   }
 
+  @ResponseStatus(code = HttpStatus.BAD_REQUEST)
+  @ExceptionHandler(MultiFactorAuthenticationError.class)
+  @ResponseBody
+  public ErrorDTO handleMultiFactorAuthenticationError(MultiFactorAuthenticationError e) {
+    return ErrorDTO.fromString(e.getMessage());
+  }
+
   private boolean isValidRecoveryCode(Set accountRecoveryCodes,
       String inputRecoveryCode) {
     for (IamTotpRecoveryCode recoveryCodeObject : accountRecoveryCodes) {
@@ -177,65 +179,4 @@ private boolean isValidRecoveryCode(Set accountRecoveryCode
 
     return false;
   }
-
-  // TODO if the resetting of recovery codes after use is a requirement, we need to prevent the user
-  // from accessing IAM webpages after authenticating. This may require an additional ROLE for
-  // handling this. Should also try and tie this in with a generic page for resetting recovery codes
-  // for anyone who is logged in
-
-  @PreAuthorize("hasRole('USER')")
-  @RequestMapping(method = RequestMethod.GET, path = "/iam/authenticator-app/recovery-code/reset")
-  public String getResetRecoveryCodesResetView() {
-    return "/iam/authenticator-app/recovery-code/reset";
-  }
-
-  @PreAuthorize("hasRole('USER')")
-  @RequestMapping(method = RequestMethod.POST, path = "/iam/authenticator-app/recovery-code/reset")
-  public String resetRecoveryCodesAndView() {
-    resetRecoveryCodes();
-
-    return "redirect:/iam/authenticator-app/recovery-code/view";
-  }
-
-  @PreAuthorize("hasRole('USER')")
-  @RequestMapping(method = RequestMethod.PUT, path = "/iam/authenticator-app/recovery-code/reset")
-  public ResponseEntity resetRecoveryCodes() {
-    IamAccount account = accountUtils.getAuthenticatedUserAccount()
-      .orElseThrow(() -> new MultiFactorAuthenticationError("Account not found"));
-    account = service.addTotpMfaRecoveryCodes(account);
-    service.saveAccount(account);
-
-    return ResponseEntity.ok().build();
-  }
-
-  @PreAuthorize("hasRole('USER')")
-  @RequestMapping(method = RequestMethod.GET, path = "/iam/authenticator-app/recovery-code/view")
-  public String viewRecoveryCodes(ModelMap model) {
-    String[] codes = getRecoveryCodes();
-    model.addAttribute("recoveryCodes", codes);
-    return "/iam/authenticator-app/recovery-code/view";
-  }
-
-  @PreAuthorize("hasRole('USER')")
-  @RequestMapping(method = RequestMethod.GET, path = "/iam/authenticator-app/recovery-code/get")
-  public @ResponseBody String[] getRecoveryCodes() {
-    IamAccount account = accountUtils.getAuthenticatedUserAccount()
-      .orElseThrow(() -> new MultiFactorAuthenticationError("Account not found"));
-
-    List recs = new ArrayList<>(account.getTotpMfa().getRecoveryCodes());
-    String[] codes = new String[recs.size()];
-
-    for (int i = 0; i < recs.size(); i++) {
-      codes[i] = recs.get(i).getCode();
-    }
-
-    return codes;
-  }
-
-  @ResponseStatus(code = HttpStatus.BAD_REQUEST)
-  @ExceptionHandler(MultiFactorAuthenticationError.class)
-  @ResponseBody
-  public ErrorDTO handleMultiFactorAuthenticationError(MultiFactorAuthenticationError e) {
-    return ErrorDTO.fromString(e.getMessage());
-  }
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/RecoveryCodeManagementController.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/RecoveryCodeManagementController.java
new file mode 100644
index 000000000..17b3c245f
--- /dev/null
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/RecoveryCodeManagementController.java
@@ -0,0 +1,129 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.infn.mw.iam.authn.multi_factor_authentication.authenticator_app;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.ApplicationEventPublisher;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.ResponseEntity;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.stereotype.Controller;
+import org.springframework.ui.ModelMap;
+import org.springframework.web.bind.annotation.ExceptionHandler;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
+import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.ResponseStatus;
+
+import it.infn.mw.iam.api.account.AccountUtils;
+import it.infn.mw.iam.api.common.ErrorDTO;
+import it.infn.mw.iam.audit.events.account.multi_factor_authentication.RecoveryCodesResetEvent;
+import it.infn.mw.iam.authn.multi_factor_authentication.error.MultiFactorAuthenticationError;
+import it.infn.mw.iam.core.user.IamAccountService;
+import it.infn.mw.iam.persistence.model.IamAccount;
+import it.infn.mw.iam.persistence.model.IamTotpRecoveryCode;
+
+// TODO if the resetting of recovery codes after use is a requirement, we need to prevent the user
+// from accessing IAM webpages after authenticating. This may require an additional ROLE for
+// handling this. Should also try and tie this in with a generic page for resetting recovery codes
+// for anyone who is logged in
+
+@Controller
+public class RecoveryCodeManagementController {
+
+  public static final String AUTHENTICATOR_APP_URL = "/iam/authenticator-app";
+  public static final String RECOVERY_CODE_URL = AUTHENTICATOR_APP_URL + "/recovery-code";
+  public static final String RESET_URL = RECOVERY_CODE_URL + "/reset";
+  public static final String GET_URL = RECOVERY_CODE_URL + "/get";
+  public static final String VIEW_URL = RECOVERY_CODE_URL + "/view";
+
+  private final AccountUtils accountUtils;
+  private final IamAccountService service;
+  private ApplicationEventPublisher eventPublisher;
+
+  @Autowired
+  public RecoveryCodeManagementController(AccountUtils accountUtils, IamAccountService service,
+      ApplicationEventPublisher eventPublisher) {
+    this.accountUtils = accountUtils;
+    this.service = service;
+    this.eventPublisher = eventPublisher;
+  }
+
+  private void recoveryCodesResetEvent(IamAccount account) {
+    eventPublisher.publishEvent(new RecoveryCodesResetEvent(this, account));
+  }
+
+  @PreAuthorize("hasRole('USER')")
+  @RequestMapping(method = RequestMethod.GET, path = RESET_URL)
+  public String getResetRecoveryCodesResetView() {
+    return "/iam/authenticator-app/recovery-code/reset";
+  }
+
+  @PreAuthorize("hasRole('USER')")
+  @RequestMapping(method = RequestMethod.POST, path = RESET_URL)
+  public String resetRecoveryCodesAndView() {
+    resetRecoveryCodes();
+
+    return "redirect:/iam/authenticator-app/recovery-code/view";
+  }
+
+  @PreAuthorize("hasRole('USER')")
+  @RequestMapping(method = RequestMethod.PUT, path = RESET_URL)
+  public ResponseEntity resetRecoveryCodes() {
+    IamAccount account = accountUtils.getAuthenticatedUserAccount()
+      .orElseThrow(() -> new MultiFactorAuthenticationError("Account not found"));
+    account = service.addTotpMfaRecoveryCodes(account);
+    account = service.saveAccount(account);
+
+    recoveryCodesResetEvent(account);
+
+    return ResponseEntity.ok().build();
+  }
+
+  @PreAuthorize("hasRole('USER')")
+  @RequestMapping(method = RequestMethod.GET, path = VIEW_URL)
+  public String viewRecoveryCodes(ModelMap model) {
+    String[] codes = getRecoveryCodes();
+    model.addAttribute("recoveryCodes", codes);
+    return "/iam/authenticator-app/recovery-code/view";
+  }
+
+  @PreAuthorize("hasRole('USER')")
+  @RequestMapping(method = RequestMethod.GET, path = GET_URL)
+  public @ResponseBody String[] getRecoveryCodes() {
+    IamAccount account = accountUtils.getAuthenticatedUserAccount()
+      .orElseThrow(() -> new MultiFactorAuthenticationError("Account not found"));
+
+    List recs = new ArrayList<>(account.getTotpMfa().getRecoveryCodes());
+    String[] codes = new String[recs.size()];
+
+    for (int i = 0; i < recs.size(); i++) {
+      codes[i] = recs.get(i).getCode();
+    }
+
+    return codes;
+  }
+
+  @ResponseStatus(code = HttpStatus.BAD_REQUEST)
+  @ExceptionHandler(MultiFactorAuthenticationError.class)
+  @ResponseBody
+  public ErrorDTO handleMultiFactorAuthenticationError(MultiFactorAuthenticationError e) {
+    return ErrorDTO.fromString(e.getMessage());
+  }
+}
diff --git a/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/MultiFactorTestSupport.java b/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/MultiFactorTestSupport.java
index 3a9c7c398..5ed278cc8 100644
--- a/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/MultiFactorTestSupport.java
+++ b/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/MultiFactorTestSupport.java
@@ -17,6 +17,7 @@
 
 import java.util.Arrays;
 import java.util.HashSet;
+import java.util.Set;
 
 import it.infn.mw.iam.persistence.model.IamAccount;
 import it.infn.mw.iam.persistence.model.IamTotpMfa;
@@ -35,6 +36,12 @@ public class MultiFactorTestSupport {
   public static final String TOTP_RECOVERY_CODE_STRING_4 = "code-4";
   public static final String TOTP_RECOVERY_CODE_STRING_5 = "code-5";
   public static final String TOTP_RECOVERY_CODE_STRING_6 = "code-6";
+  public static final String TOTP_RECOVERY_CODE_STRING_7 = "code-7";
+  public static final String TOTP_RECOVERY_CODE_STRING_8 = "code-8";
+  public static final String TOTP_RECOVERY_CODE_STRING_9 = "code-9";
+  public static final String TOTP_RECOVERY_CODE_STRING_10 = "code-10";
+  public static final String TOTP_RECOVERY_CODE_STRING_11 = "code-11";
+  public static final String TOTP_RECOVERY_CODE_STRING_12 = "code-12";
 
   protected final IamAccount TEST_ACCOUNT;
   protected final IamTotpMfa TOTP_MFA;
@@ -44,6 +51,15 @@ public class MultiFactorTestSupport {
   protected final IamTotpRecoveryCode TOTP_RECOVERY_CODE_4;
   protected final IamTotpRecoveryCode TOTP_RECOVERY_CODE_5;
   protected final IamTotpRecoveryCode TOTP_RECOVERY_CODE_6;
+  protected final IamTotpRecoveryCode TOTP_RECOVERY_CODE_7;
+  protected final IamTotpRecoveryCode TOTP_RECOVERY_CODE_8;
+  protected final IamTotpRecoveryCode TOTP_RECOVERY_CODE_9;
+  protected final IamTotpRecoveryCode TOTP_RECOVERY_CODE_10;
+  protected final IamTotpRecoveryCode TOTP_RECOVERY_CODE_11;
+  protected final IamTotpRecoveryCode TOTP_RECOVERY_CODE_12;
+
+  protected final Set RECOVERY_CODE_SET_FIRST;
+  protected final Set RECOVERY_CODE_SET_SECOND;
 
   public MultiFactorTestSupport() {
     TOTP_MFA = new IamTotpMfa();
@@ -56,6 +72,12 @@ public MultiFactorTestSupport() {
     TOTP_RECOVERY_CODE_4 = new IamTotpRecoveryCode(TOTP_MFA);
     TOTP_RECOVERY_CODE_5 = new IamTotpRecoveryCode(TOTP_MFA);
     TOTP_RECOVERY_CODE_6 = new IamTotpRecoveryCode(TOTP_MFA);
+    TOTP_RECOVERY_CODE_7 = new IamTotpRecoveryCode(TOTP_MFA);
+    TOTP_RECOVERY_CODE_8 = new IamTotpRecoveryCode(TOTP_MFA);
+    TOTP_RECOVERY_CODE_9 = new IamTotpRecoveryCode(TOTP_MFA);
+    TOTP_RECOVERY_CODE_10 = new IamTotpRecoveryCode(TOTP_MFA);
+    TOTP_RECOVERY_CODE_11 = new IamTotpRecoveryCode(TOTP_MFA);
+    TOTP_RECOVERY_CODE_12 = new IamTotpRecoveryCode(TOTP_MFA);
 
     TOTP_RECOVERY_CODE_1.setCode(TOTP_RECOVERY_CODE_STRING_1);
     TOTP_RECOVERY_CODE_2.setCode(TOTP_RECOVERY_CODE_STRING_2);
@@ -63,10 +85,21 @@ public MultiFactorTestSupport() {
     TOTP_RECOVERY_CODE_4.setCode(TOTP_RECOVERY_CODE_STRING_4);
     TOTP_RECOVERY_CODE_5.setCode(TOTP_RECOVERY_CODE_STRING_5);
     TOTP_RECOVERY_CODE_6.setCode(TOTP_RECOVERY_CODE_STRING_6);
+    TOTP_RECOVERY_CODE_7.setCode(TOTP_RECOVERY_CODE_STRING_7);
+    TOTP_RECOVERY_CODE_8.setCode(TOTP_RECOVERY_CODE_STRING_8);
+    TOTP_RECOVERY_CODE_9.setCode(TOTP_RECOVERY_CODE_STRING_9);
+    TOTP_RECOVERY_CODE_10.setCode(TOTP_RECOVERY_CODE_STRING_10);
+    TOTP_RECOVERY_CODE_11.setCode(TOTP_RECOVERY_CODE_STRING_11);
+    TOTP_RECOVERY_CODE_12.setCode(TOTP_RECOVERY_CODE_STRING_12);
+
+    RECOVERY_CODE_SET_FIRST = new HashSet<>(
+        Arrays.asList(TOTP_RECOVERY_CODE_1, TOTP_RECOVERY_CODE_2, TOTP_RECOVERY_CODE_3,
+            TOTP_RECOVERY_CODE_4, TOTP_RECOVERY_CODE_5, TOTP_RECOVERY_CODE_6));
+    RECOVERY_CODE_SET_SECOND = new HashSet<>(
+        Arrays.asList(TOTP_RECOVERY_CODE_7, TOTP_RECOVERY_CODE_8, TOTP_RECOVERY_CODE_9,
+            TOTP_RECOVERY_CODE_10, TOTP_RECOVERY_CODE_11, TOTP_RECOVERY_CODE_12));
 
-    TOTP_MFA
-      .setRecoveryCodes(new HashSet<>(Arrays.asList(TOTP_RECOVERY_CODE_1, TOTP_RECOVERY_CODE_2,
-          TOTP_RECOVERY_CODE_3, TOTP_RECOVERY_CODE_4, TOTP_RECOVERY_CODE_5, TOTP_RECOVERY_CODE_6)));
+    TOTP_MFA.setRecoveryCodes(RECOVERY_CODE_SET_FIRST);
     TEST_ACCOUNT = IamAccount.newAccount();
     TEST_ACCOUNT.setUsername(TEST_USERNAME);
     TEST_ACCOUNT.setUuid(TEST_UUID);
@@ -77,4 +110,56 @@ public MultiFactorTestSupport() {
 
     TEST_ACCOUNT.touch();
   }
+
+  protected void resetTestAccount() {
+    TOTP_MFA.setSecret(TOTP_MFA_SECRET);
+    TOTP_MFA.setActive(true);
+
+    TOTP_RECOVERY_CODE_1.setCode(TOTP_RECOVERY_CODE_STRING_1);
+    TOTP_RECOVERY_CODE_2.setCode(TOTP_RECOVERY_CODE_STRING_2);
+    TOTP_RECOVERY_CODE_3.setCode(TOTP_RECOVERY_CODE_STRING_3);
+    TOTP_RECOVERY_CODE_4.setCode(TOTP_RECOVERY_CODE_STRING_4);
+    TOTP_RECOVERY_CODE_5.setCode(TOTP_RECOVERY_CODE_STRING_5);
+    TOTP_RECOVERY_CODE_6.setCode(TOTP_RECOVERY_CODE_STRING_6);
+    TOTP_RECOVERY_CODE_7.setCode(TOTP_RECOVERY_CODE_STRING_7);
+    TOTP_RECOVERY_CODE_8.setCode(TOTP_RECOVERY_CODE_STRING_8);
+    TOTP_RECOVERY_CODE_9.setCode(TOTP_RECOVERY_CODE_STRING_9);
+    TOTP_RECOVERY_CODE_10.setCode(TOTP_RECOVERY_CODE_STRING_10);
+    TOTP_RECOVERY_CODE_11.setCode(TOTP_RECOVERY_CODE_STRING_11);
+    TOTP_RECOVERY_CODE_12.setCode(TOTP_RECOVERY_CODE_STRING_12);
+
+    TOTP_MFA.setRecoveryCodes(RECOVERY_CODE_SET_FIRST);
+
+    TEST_ACCOUNT.setUsername(TEST_USERNAME);
+    TEST_ACCOUNT.setUuid(TEST_UUID);
+    TEST_ACCOUNT.getUserInfo().setEmail(TEST_EMAIL);
+    TEST_ACCOUNT.getUserInfo().setGivenName(TEST_GIVEN_NAME);
+    TEST_ACCOUNT.getUserInfo().setFamilyName(TEST_FAMILY_NAME);
+    TEST_ACCOUNT.setTotpMfa(TOTP_MFA);
+
+    TEST_ACCOUNT.touch();
+  }
+
+  protected IamAccount cloneAccount(IamAccount account) {
+    IamAccount newAccount = IamAccount.newAccount();
+    newAccount.setUuid(account.getUuid());
+    newAccount.setUsername(account.getUsername());
+    newAccount.getUserInfo().setEmail(account.getUserInfo().getEmail());
+    newAccount.getUserInfo().setGivenName(account.getUserInfo().getGivenName());
+    newAccount.getUserInfo().setFamilyName(account.getUserInfo().getFamilyName());
+
+    IamTotpMfa totpMfa = new IamTotpMfa();
+    Set newCodes = new HashSet<>();
+    for (IamTotpRecoveryCode recoveryCode : account.getTotpMfa().getRecoveryCodes()) {
+      IamTotpRecoveryCode newCode = new IamTotpRecoveryCode(totpMfa);
+      newCode.setCode(recoveryCode.getCode());
+      newCodes.add(newCode);
+    }
+    totpMfa.setRecoveryCodes(newCodes);
+    newAccount.setTotpMfa(totpMfa);
+
+    newAccount.touch();
+
+    return newAccount;
+  }
 }
diff --git a/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/authenticator_app/AuthenticatorAppVerifyControllerTests.java b/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/authenticator_app/AuthenticatorAppVerifyControllerTests.java
index a043e24c5..ab8bf8bd2 100644
--- a/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/authenticator_app/AuthenticatorAppVerifyControllerTests.java
+++ b/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/authenticator_app/AuthenticatorAppVerifyControllerTests.java
@@ -60,7 +60,6 @@
 import it.infn.mw.iam.api.account.AccountUtils;
 import it.infn.mw.iam.authn.multi_factor_authentication.authenticator_app.AuthenticatorAppVerifyController;
 import it.infn.mw.iam.authn.multi_factor_authentication.error.MultiFactorAuthenticationError;
-import it.infn.mw.iam.core.user.DefaultIamAccountService;
 import it.infn.mw.iam.test.multi_factor_authentication.MultiFactorTestSupport;
 import it.infn.mw.iam.test.util.WithAnonymousUser;
 import it.infn.mw.iam.test.util.WithMockPreAuthenticatedUser;
@@ -81,9 +80,6 @@ public class AuthenticatorAppVerifyControllerTests extends MultiFactorTestSuppor
   @MockBean
   private CodeVerifier codeVerifier;
 
-  @MockBean
-  private DefaultIamAccountService service;
-
   @MockBean
   private AuthenticationEventPublisher eventPublisher;
 
@@ -109,6 +105,7 @@ public void setup() {
   public void tearDown() {
     reset(accountUtils);
     reset(codeVerifier);
+    reset(eventPublisher);
   }
 
   @Test
diff --git a/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/authenticator_app/RecoveryCodeManagementControllerTests.java b/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/authenticator_app/RecoveryCodeManagementControllerTests.java
new file mode 100644
index 000000000..6678d81d7
--- /dev/null
+++ b/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/authenticator_app/RecoveryCodeManagementControllerTests.java
@@ -0,0 +1,252 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.infn.mw.iam.test.multi_factor_authentication.authenticator_app;
+
+import static it.infn.mw.iam.authn.multi_factor_authentication.authenticator_app.RecoveryCodeManagementController.GET_URL;
+import static it.infn.mw.iam.authn.multi_factor_authentication.authenticator_app.RecoveryCodeManagementController.RESET_URL;
+import static it.infn.mw.iam.authn.multi_factor_authentication.authenticator_app.RecoveryCodeManagementController.VIEW_URL;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.instanceOf;
+import static org.hamcrest.Matchers.not;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.reset;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+import static org.springframework.security.test.web.servlet.setup.SecurityMockMvcConfigurers.springSecurity;
+import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
+import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
+import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.put;
+import static org.springframework.test.web.servlet.result.MockMvcResultHandlers.log;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.model;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
+
+import java.util.ArrayList;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Optional;
+import java.util.Set;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.ArgumentCaptor;
+import org.mockito.Captor;
+import org.mockito.InjectMocks;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.test.mock.mockito.MockBean;
+import org.springframework.context.ApplicationEvent;
+import org.springframework.context.ApplicationEventPublisher;
+import org.springframework.security.core.AuthenticationException;
+import org.springframework.security.test.context.support.WithMockUser;
+import org.springframework.test.context.junit4.SpringRunner;
+import org.springframework.test.web.servlet.MockMvc;
+import org.springframework.test.web.servlet.MvcResult;
+import org.springframework.test.web.servlet.setup.MockMvcBuilders;
+import org.springframework.web.context.WebApplicationContext;
+
+import it.infn.mw.iam.api.account.AccountUtils;
+import it.infn.mw.iam.audit.events.account.multi_factor_authentication.RecoveryCodesResetEvent;
+import it.infn.mw.iam.authn.multi_factor_authentication.authenticator_app.AuthenticatorAppVerifyController;
+import it.infn.mw.iam.core.user.IamAccountService;
+import it.infn.mw.iam.persistence.model.IamAccount;
+import it.infn.mw.iam.persistence.model.IamTotpRecoveryCode;
+import it.infn.mw.iam.test.multi_factor_authentication.MultiFactorTestSupport;
+import it.infn.mw.iam.test.util.WithAnonymousUser;
+import it.infn.mw.iam.test.util.WithMockPreAuthenticatedUser;
+import it.infn.mw.iam.test.util.annotation.IamMockMvcIntegrationTest;
+
+@RunWith(SpringRunner.class)
+@IamMockMvcIntegrationTest
+public class RecoveryCodeManagementControllerTests extends MultiFactorTestSupport {
+
+  private MockMvc mvc;
+
+  @Autowired
+  private WebApplicationContext context;
+
+  @MockBean
+  private AccountUtils accountUtils;
+
+  @MockBean
+  private IamAccountService service;
+
+  @MockBean
+  private ApplicationEventPublisher eventPublisher;
+
+  @Captor
+  private ArgumentCaptor authEventCaptor;
+
+  @Captor
+  private ArgumentCaptor authExceptionCaptor;
+
+  @InjectMocks
+  private AuthenticatorAppVerifyController controller;
+
+  @Before
+  public void setup() {
+    when(accountUtils.getAuthenticatedUserAccount()).thenReturn(Optional.of(TEST_ACCOUNT));
+    when(service.addTotpMfaRecoveryCodes(TEST_ACCOUNT)).thenAnswer(i -> i.getArguments()[0]);
+    when(service.saveAccount(TEST_ACCOUNT)).thenAnswer(i -> i.getArguments()[0]);
+
+    mvc =
+        MockMvcBuilders.webAppContextSetup(context).apply(springSecurity()).alwaysDo(log()).build();
+  }
+
+  @After
+  public void tearDown() {
+    reset(accountUtils);
+    reset(service);
+    reset(eventPublisher);
+
+    resetTestAccount();
+  }
+
+  @Test
+  @WithMockUser
+  public void testGetResetView() throws Exception {
+    mvc.perform(get(RESET_URL)).andExpect(status().isOk());
+  }
+
+  @Test
+  @WithAnonymousUser
+  public void testGetResetViewNoAuthenticationFails() throws Exception {
+    mvc.perform(get(RESET_URL)).andExpect(status().isUnauthorized());
+  }
+
+  @Test
+  @WithMockPreAuthenticatedUser
+  public void testGetResetViewWithPreAuthenticationFails() throws Exception {
+    mvc.perform(get(RESET_URL)).andExpect(status().isForbidden());
+  }
+
+  @Test
+  @WithMockUser(username = TEST_USERNAME)
+  public void testPostResetRedirectsAndAddsNewCodes() throws Exception {
+    TEST_ACCOUNT.getTotpMfa().setRecoveryCodes(RECOVERY_CODE_SET_SECOND);
+    mvc.perform(post(RESET_URL)).andExpect(status().is3xxRedirection());
+
+    verify(eventPublisher).publishEvent(authEventCaptor.capture());
+    ApplicationEvent e = authEventCaptor.getValue();
+    assertThat(e, instanceOf(RecoveryCodesResetEvent.class));
+  }
+
+  @Test
+  @WithAnonymousUser
+  public void testPostResetNoAuthenticationFails() throws Exception {
+    mvc.perform(post(RESET_URL)).andExpect(status().isUnauthorized());
+  }
+
+  @Test
+  @WithMockPreAuthenticatedUser
+  public void testPostResetWithPreAuthenticationFails() throws Exception {
+    mvc.perform(post(RESET_URL)).andExpect(status().isForbidden());
+  }
+
+  @Test
+  @WithMockUser(username = TEST_USERNAME)
+  public void testPutResetAddsNewCodes() throws Exception {
+
+    // Duplicate original recovery codes for comparison later on
+    Set originalSet = new HashSet<>(RECOVERY_CODE_SET_FIRST);
+
+    // Duplicate original account to be returned from authentication
+    IamAccount originalAccount = cloneAccount(TEST_ACCOUNT);
+    when(accountUtils.getAuthenticatedUserAccount()).thenReturn(Optional.of(originalAccount));
+
+    // An account with new codes is returned. This demonstrates the generation of new codes
+    TEST_ACCOUNT.getTotpMfa().setRecoveryCodes(RECOVERY_CODE_SET_SECOND);
+    when(service.addTotpMfaRecoveryCodes(any())).thenReturn(TEST_ACCOUNT);
+    when(service.saveAccount(any())).thenReturn(TEST_ACCOUNT);
+
+    mvc.perform(put(RESET_URL)).andExpect(status().isOk());
+
+    verify(eventPublisher).publishEvent(authEventCaptor.capture());
+    ApplicationEvent e = authEventCaptor.getValue();
+    assertThat(e, instanceOf(RecoveryCodesResetEvent.class));
+
+    RecoveryCodesResetEvent recoveryCodeEvent = (RecoveryCodesResetEvent) e;
+    Set recoveryCodes =
+        recoveryCodeEvent.getAccount().getTotpMfa().getRecoveryCodes();
+    assertThat(recoveryCodes.toArray(), not(equalTo(originalSet.toArray())));
+  }
+
+  @Test
+  @WithAnonymousUser
+  public void testPutResetNoAuthenticationFails() throws Exception {
+    mvc.perform(post(RESET_URL)).andExpect(status().isUnauthorized());
+  }
+
+  @Test
+  @WithMockPreAuthenticatedUser
+  public void testPutResetWithPreAuthenticationFails() throws Exception {
+    mvc.perform(post(RESET_URL)).andExpect(status().isForbidden());
+  }
+
+  @Test
+  @WithMockUser
+  public void testViewRecoveryCodes() throws Exception {
+    mvc.perform(get(VIEW_URL))
+      .andExpect(status().isOk())
+      .andExpect(model().attributeExists("recoveryCodes"));
+  }
+
+  @Test
+  @WithAnonymousUser
+  public void testViewRecoveryCodesNoAuthenticationFails() throws Exception {
+    mvc.perform(get(VIEW_URL)).andExpect(status().isUnauthorized());
+  }
+
+  @Test
+  @WithMockPreAuthenticatedUser
+  public void testViewRecoveryCodesWithPreAuthenticationFails() throws Exception {
+    mvc.perform(get(VIEW_URL)).andExpect(status().isForbidden());
+  }
+
+  @Test
+  @WithMockUser
+  public void testGetRecoveryCodes() throws Exception {
+    MvcResult result = mvc.perform(get(GET_URL)).andExpect(status().isOk()).andReturn();
+
+    String content = result.getResponse().getContentAsString();
+    content = content.substring(1, content.length() - 1);
+    String[] arr = content.split(",");
+
+    String[] err = new String[RECOVERY_CODE_SET_FIRST.size()];
+    List recoveryCodes = new ArrayList<>(RECOVERY_CODE_SET_FIRST);
+    for (int i = 0; i < recoveryCodes.size(); i++) {
+      err[i] = recoveryCodes.get(i).getCode();
+
+      // This is here because the string.split() method adds backslashed quotes around the separated
+      // strings. So this is a hacky method to remove them to allow for the comparison to succeed.
+      arr[i] = arr[i].substring(1, arr[i].length() - 1);
+    }
+    assertThat(err, equalTo(arr));
+  }
+
+  @Test
+  @WithAnonymousUser
+  public void testGetRecoveryCodesNoAuthenticationFails() throws Exception {
+    mvc.perform(get(GET_URL)).andExpect(status().isUnauthorized());
+  }
+
+  @Test
+  @WithMockPreAuthenticatedUser
+  public void testGetRecoveryCodesWithPreAuthenticationFails() throws Exception {
+    mvc.perform(get(GET_URL)).andExpect(status().isForbidden());
+  }
+}

From 7c997a02cec99291fe977af6fc510fd77360b5c4 Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Fri, 17 Dec 2021 15:05:22 +0000
Subject: [PATCH 52/76] Adding tests on account service for adding recovery
 codes, fixing clone account method for cloning MFA secrets

---
 .../MultiFactorTestSupport.java               | 24 ++++++----
 .../service/IamAccountServiceTestSupport.java | 26 ++++++++++-
 .../test/service/IamAccountServiceTests.java  | 44 ++++++++++++++++---
 3 files changed, 80 insertions(+), 14 deletions(-)

diff --git a/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/MultiFactorTestSupport.java b/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/MultiFactorTestSupport.java
index 5ed278cc8..fd9d238c1 100644
--- a/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/MultiFactorTestSupport.java
+++ b/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/MultiFactorTestSupport.java
@@ -148,15 +148,23 @@ protected IamAccount cloneAccount(IamAccount account) {
     newAccount.getUserInfo().setGivenName(account.getUserInfo().getGivenName());
     newAccount.getUserInfo().setFamilyName(account.getUserInfo().getFamilyName());
 
-    IamTotpMfa totpMfa = new IamTotpMfa();
-    Set newCodes = new HashSet<>();
-    for (IamTotpRecoveryCode recoveryCode : account.getTotpMfa().getRecoveryCodes()) {
-      IamTotpRecoveryCode newCode = new IamTotpRecoveryCode(totpMfa);
-      newCode.setCode(recoveryCode.getCode());
-      newCodes.add(newCode);
+    if (account.getTotpMfa() != null) {
+      IamTotpMfa totpMfa = new IamTotpMfa();
+      totpMfa.setSecret(account.getTotpMfa().getSecret());
+      totpMfa.setActive(account.getTotpMfa().isActive());
+
+      if (account.getTotpMfa().getRecoveryCodes() != null) {
+        Set newCodes = new HashSet<>();
+        for (IamTotpRecoveryCode recoveryCode : account.getTotpMfa().getRecoveryCodes()) {
+          IamTotpRecoveryCode newCode = new IamTotpRecoveryCode(totpMfa);
+          newCode.setCode(recoveryCode.getCode());
+          newCodes.add(newCode);
+        }
+        totpMfa.setRecoveryCodes(newCodes);
+      }
+
+      newAccount.setTotpMfa(totpMfa);
     }
-    totpMfa.setRecoveryCodes(newCodes);
-    newAccount.setTotpMfa(totpMfa);
 
     newAccount.touch();
 
diff --git a/iam-login-service/src/test/java/it/infn/mw/iam/test/service/IamAccountServiceTestSupport.java b/iam-login-service/src/test/java/it/infn/mw/iam/test/service/IamAccountServiceTestSupport.java
index e3a6c94c8..2dd5e1eca 100644
--- a/iam-login-service/src/test/java/it/infn/mw/iam/test/service/IamAccountServiceTestSupport.java
+++ b/iam-login-service/src/test/java/it/infn/mw/iam/test/service/IamAccountServiceTestSupport.java
@@ -17,6 +17,7 @@
 
 import java.util.Arrays;
 import java.util.HashSet;
+import java.util.Set;
 
 import it.infn.mw.iam.persistence.model.IamAccount;
 import it.infn.mw.iam.persistence.model.IamAuthority;
@@ -77,6 +78,12 @@ public class IamAccountServiceTestSupport {
   public static final String TOTP_RECOVERY_CODE_STRING_4 = "code-4";
   public static final String TOTP_RECOVERY_CODE_STRING_5 = "code-5";
   public static final String TOTP_RECOVERY_CODE_STRING_6 = "code-6";
+  public static final String TOTP_RECOVERY_CODE_STRING_7 = "code-7";
+  public static final String TOTP_RECOVERY_CODE_STRING_8 = "code-8";
+  public static final String TOTP_RECOVERY_CODE_STRING_9 = "code-9";
+  public static final String TOTP_RECOVERY_CODE_STRING_10 = "code-10";
+  public static final String TOTP_RECOVERY_CODE_STRING_11 = "code-11";
+  public static final String TOTP_RECOVERY_CODE_STRING_12 = "code-12";
 
 
   protected final IamAccount TEST_ACCOUNT;
@@ -179,7 +186,24 @@ public IamAccount cloneAccount(IamAccount account) {
     newAccount.getUserInfo().setEmail(account.getUserInfo().getEmail());
     newAccount.getUserInfo().setGivenName(account.getUserInfo().getGivenName());
     newAccount.getUserInfo().setFamilyName(account.getUserInfo().getFamilyName());
-    newAccount.setTotpMfa(account.getTotpMfa());
+
+    if (account.getTotpMfa() != null) {
+      IamTotpMfa totpMfa = new IamTotpMfa();
+      totpMfa.setSecret(account.getTotpMfa().getSecret());
+      totpMfa.setActive(account.getTotpMfa().isActive());
+
+      if (account.getTotpMfa().getRecoveryCodes() != null) {
+        Set newCodes = new HashSet<>();
+        for (IamTotpRecoveryCode recoveryCode : account.getTotpMfa().getRecoveryCodes()) {
+          IamTotpRecoveryCode newCode = new IamTotpRecoveryCode(totpMfa);
+          newCode.setCode(recoveryCode.getCode());
+          newCodes.add(newCode);
+        }
+        totpMfa.setRecoveryCodes(newCodes);
+      }
+
+      newAccount.setTotpMfa(totpMfa);
+    }
 
     return newAccount;
   }
diff --git a/iam-login-service/src/test/java/it/infn/mw/iam/test/service/IamAccountServiceTests.java b/iam-login-service/src/test/java/it/infn/mw/iam/test/service/IamAccountServiceTests.java
index 830d4aaaa..0391b0288 100644
--- a/iam-login-service/src/test/java/it/infn/mw/iam/test/service/IamAccountServiceTests.java
+++ b/iam-login-service/src/test/java/it/infn/mw/iam/test/service/IamAccountServiceTests.java
@@ -23,6 +23,7 @@
 import static org.hamcrest.CoreMatchers.nullValue;
 import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.not;
 import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.assertTrue;
@@ -40,7 +41,11 @@
 import java.util.Arrays;
 import java.util.Calendar;
 import java.util.Date;
+import java.util.HashSet;
 import java.util.Optional;
+import java.util.Set;
+
+import com.google.common.collect.Sets;
 
 import org.junit.Before;
 import org.junit.Test;
@@ -59,9 +64,6 @@
 
 import dev.samstevens.totp.recovery.RecoveryCodeGenerator;
 import dev.samstevens.totp.secret.SecretGenerator;
-
-import com.google.common.collect.Sets;
-
 import it.infn.mw.iam.audit.events.account.AccountEndTimeUpdatedEvent;
 import it.infn.mw.iam.audit.events.account.multi_factor_authentication.AuthenticatorAppDisabledEvent;
 import it.infn.mw.iam.audit.events.account.multi_factor_authentication.AuthenticatorAppEnabledEvent;
@@ -78,6 +80,7 @@
 import it.infn.mw.iam.persistence.model.IamSamlId;
 import it.infn.mw.iam.persistence.model.IamSshKey;
 import it.infn.mw.iam.persistence.model.IamTotpMfa;
+import it.infn.mw.iam.persistence.model.IamTotpRecoveryCode;
 import it.infn.mw.iam.persistence.model.IamX509Certificate;
 import it.infn.mw.iam.persistence.repository.IamAccountRepository;
 import it.infn.mw.iam.persistence.repository.IamAuthoritiesRepository;
@@ -141,7 +144,9 @@ public void setup() {
     when(passwordEncoder.encode(any())).thenReturn(PASSWORD);
     when(secretGenerator.generate()).thenReturn("test_secret");
 
-    String[] testArray = {"test_code"};
+    String[] testArray = {TOTP_RECOVERY_CODE_STRING_7, TOTP_RECOVERY_CODE_STRING_8,
+        TOTP_RECOVERY_CODE_STRING_9, TOTP_RECOVERY_CODE_STRING_10, TOTP_RECOVERY_CODE_STRING_11,
+        TOTP_RECOVERY_CODE_STRING_12};
     when(recoveryCodeGenerator.generateCodes(anyInt())).thenReturn(testArray);
 
     accountService = new DefaultIamAccountService(clock, accountRepo, groupRepo, authoritiesRepo,
@@ -868,7 +873,8 @@ public void testAssignsTotpMfaToAccount() {
     verify(secretGenerator, times(1)).generate();
     verify(recoveryCodeGenerator, times(1)).generateCodes(anyInt());
 
-    assertNotNull(account.getTotpMfa());
+    assertNotNull(account.getTotpMfa().getSecret());
+    assertFalse(account.getTotpMfa().isActive());
   }
 
   @Test(expected = MfaSecretAlreadyBoundException.class)
@@ -884,6 +890,34 @@ public void testAddMfaSecret_whenMfaSecretAssignedFails() {
     }
   }
 
+  @Test
+  public void testAddsMfaRecoveryCodesToAccount() {
+    IamAccount account = cloneAccount(TOTP_MFA_ACCOUNT);
+    Set originalCodes = new HashSet<>(account.getTotpMfa().getRecoveryCodes());
+
+    try {
+      account = accountService.addTotpMfaRecoveryCodes(account);
+    } catch (MfaSecretNotFoundException e) {
+      assertThat(e.getMessage(), equalTo("No multi-factor secret is attached to this account"));
+      throw e;
+    }
+
+    Set newCodes = account.getTotpMfa().getRecoveryCodes();
+    assertThat(originalCodes.toArray(), not(equalTo(newCodes.toArray())));
+  }
+
+  @Test(expected = MfaSecretNotFoundException.class)
+  public void testAddsMfaRecoveryCode_whenNoMfaSecretAssignedFails() {
+    IamAccount account = cloneAccount(TEST_ACCOUNT);
+
+    try {
+      accountService.addTotpMfaRecoveryCodes(account);
+    } catch (MfaSecretNotFoundException e) {
+      assertThat(e.getMessage(), equalTo("No multi-factor secret is attached to this account"));
+      throw e;
+    }
+  }
+
   @Test
   public void testEnablesTotpMfa() {
     IamAccount account = cloneAccount(TEST_ACCOUNT);

From 48b89c232761300187ac72c9c29f710f4a124e63 Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Thu, 6 Jan 2022 13:12:01 +0000
Subject: [PATCH 53/76] Fixing submit button bug on dashboard modals

This was preventing the user from clicking submit after a failed code entry
---
 .../authenticator-app.controller.js           | 47 ++++++++++++-------
 .../controllers/user-mfa.controller.js        |  9 ----
 .../home/disable-authenticator-app.html       |  2 +-
 .../home/enable-authenticator-app.html        |  2 +-
 4 files changed, 32 insertions(+), 28 deletions(-)

diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/authenticator-app.controller.js b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/authenticator-app.controller.js
index 50434a4a0..616ead54e 100644
--- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/authenticator-app.controller.js
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/authenticator-app.controller.js
@@ -47,7 +47,11 @@
   function EnableAuthenticatorAppController(
     $scope, $uibModalInstance, Utils, AuthenticatorAppService, user) {
     var authAppCtrl = this;
-    authAppCtrl.disabled = false;
+
+    authAppCtrl.user = {
+      ...user,
+      code: ''
+    };
 
     authAppCtrl.$onInit = function () {
       AuthenticatorAppService.addMfaSecretToUser().then(function (response) {
@@ -56,8 +60,8 @@
       });
     }
 
-    authAppCtrl.userToEdit = user;
     authAppCtrl.codeMinlength = 6;
+    authAppCtrl.requestPending = false;
 
     authAppCtrl.dismiss = dismiss;
     authAppCtrl.reset = reset;
@@ -65,13 +69,13 @@
     function reset() {
       console.log('reset form');
 
-      authAppCtrl.user = {
-        code: ''
-      };
+      authAppCtrl.user.code = '';
 
       if ($scope.authenticatorAppForm) {
         $scope.authenticatorAppForm.$setPristine();
       }
+
+      authAppCtrl.requestPending = false;
     }
 
     authAppCtrl.reset();
@@ -81,16 +85,18 @@
     authAppCtrl.message = '';
 
     authAppCtrl.submitEnable = function () {
-      authAppCtrl.disabled = true;
+      authAppCtrl.requestPending = true;
       AuthenticatorAppService
         .enableAuthenticatorApp(
           authAppCtrl.user.code)
         .then(function () {
-          authAppCtrl.disabled = false;
+          authAppCtrl.requestPending = false;
           return $uibModalInstance.close('Authenticator app enabled');
         })
         .catch(function (error) {
+          authAppCtrl.requestPending = false;
           $scope.operationResult = Utils.buildErrorResult(error.data.error);
+          authAppCtrl.reset();
         });
     };
   }
@@ -98,10 +104,14 @@
   function DisableAuthenticatorAppController(
     $scope, $uibModalInstance, Utils, AuthenticatorAppService, user) {
     var authAppCtrl = this;
-    authAppCtrl.disabled = false;
 
-    authAppCtrl.userToEdit = user;
+    authAppCtrl.user = {
+      ...user,
+      code: ''
+    };
+
     authAppCtrl.codeMinlength = 6;
+    authAppCtrl.requestPending = false;
 
     authAppCtrl.dismiss = dismiss;
     authAppCtrl.reset = reset;
@@ -109,13 +119,13 @@
     function reset() {
       console.log('reset form');
 
-      authAppCtrl.user = {
-        code: ''
-      };
+      authAppCtrl.user.code = '';
 
       if ($scope.authenticatorAppForm) {
         $scope.authenticatorAppForm.$setPristine();
       }
+
+      authAppCtrl.requestPending = false;
     }
 
     authAppCtrl.reset();
@@ -125,16 +135,18 @@
     authAppCtrl.message = '';
 
     authAppCtrl.submitDisable = function () {
-      authAppCtrl.disabled = true;
+      authAppCtrl.requestPending = true;
       AuthenticatorAppService
         .disableAuthenticatorApp(
           authAppCtrl.user.code)
         .then(function () {
-          authAppCtrl.disabled = false;
+          authAppCtrl.requestPending = false;
           return $uibModalInstance.close('Authenticator app disabled');
         })
         .catch(function (error) {
+          authAppCtrl.requestPending = false;
           $scope.operationResult = Utils.buildErrorResult(error.data.error);
+          authAppCtrl.reset();
         });
     };
   }
@@ -186,18 +198,19 @@
     var authAppCtrl = this;
     authAppCtrl.dismiss = dismiss;
     authAppCtrl.resetRecoveryCodes = resetRecoveryCodes;
-    authAppCtrl.disabled = false;
+    authAppCtrl.requestPending = false;
 
     function dismiss() { return $uibModalInstance.dismiss('Back'); }
 
     function resetRecoveryCodes() {
-      authAppCtrl.disabled = true;
+      authAppCtrl.requestPending = true;
       AuthenticatorAppService.resetRecoveryCodes()
         .then(function () {
-          authAppCtrl.disabled = false;
+          authAppCtrl.requestPending = false;
           $uibModalInstance.close('Recovery codes updated');
         })
         .catch(function (error) {
+          authAppCtrl.requestPending = false;
           $scope.operationResult = Utils.buildErrorResult(error.data);
         });
     }
diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/user-mfa.controller.js b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/user-mfa.controller.js
index 096e2d235..e1dc7e280 100644
--- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/user-mfa.controller.js
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/user-mfa.controller.js
@@ -115,14 +115,5 @@ function UserMfaController(
 
   userMfaCtrl.submit = function () {
     return $uibModalInstance.close('Updated settings');
-    // ResetPasswordService
-    //     .updatePassword(
-    //         userMfaCtrl.user.currentPassword,
-    //         userMfaCtrl.user.password)
-    //     .then(function() { return $uibModalInstance.close('Password updated'); })
-    //     .catch(function(error) {
-    //       console.error(error);
-    //       $scope.operationResult = Utils.buildErrorResult(error.data);
-    //     });
   };
 }
\ No newline at end of file
diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/disable-authenticator-app.html b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/disable-authenticator-app.html
index 12b4c3759..a37eca5d6 100644
--- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/disable-authenticator-app.html
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/disable-authenticator-app.html
@@ -42,7 +42,7 @@ 
Disable MFA through authenticator app

   
 
   

-    
+    
     
     
   

diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/enable-authenticator-app.html b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/enable-authenticator-app.html
index 1244cd5e2..d9e31113f 100644
--- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/enable-authenticator-app.html
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/enable-authenticator-app.html
@@ -43,7 +43,7 @@ 
Enable authenticator app

   
 
   

-    
+    
     
     
   


From b018fe36771492734f3dc8b7f0c3350ff2b31196 Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Thu, 6 Jan 2022 17:56:27 +0000
Subject: [PATCH 54/76] Recovery codes display to the user on MFA enabling

Previously, the user would be unaware of their recovery codes until they viewed them manually. This ensures they are automatically presented with them.
---
 .../RecoveryCodesResetEvent.java              |  7 -------
 .../authenticator-app.controller.js           | 21 ++++++++++++++++---
 2 files changed, 18 insertions(+), 10 deletions(-)

diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/RecoveryCodesResetEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/RecoveryCodesResetEvent.java
index 77cee772f..dc4c409ef 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/RecoveryCodesResetEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/RecoveryCodesResetEvent.java
@@ -24,14 +24,7 @@ public class RecoveryCodesResetEvent extends MultiFactorEvent {
   // TODO add this in
   // private static final long serialVersionUID = 3213253939764135733L;
 
-  private final IamAccount account;
-
   public RecoveryCodesResetEvent(Object source, IamAccount account) {
     super(source, account, String.format(TEMPLATE, account.getUsername()));
-    this.account = account;
-  }
-
-  public IamAccount getAccount() {
-    return account;
   }
 }
diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/authenticator-app.controller.js b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/authenticator-app.controller.js
index 616ead54e..60a7d4a3a 100644
--- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/authenticator-app.controller.js
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/authenticator-app.controller.js
@@ -29,7 +29,7 @@
     .controller('ResetRecoveryCodesController', ResetRecoveryCodesController);
 
   EnableAuthenticatorAppController.$inject = [
-    '$scope', '$uibModalInstance', 'Utils', 'AuthenticatorAppService', 'user'
+    '$scope', '$uibModalInstance', 'Utils', 'AuthenticatorAppService', 'user', '$uibModal'
   ];
 
   DisableAuthenticatorAppController.$inject = [
@@ -45,7 +45,7 @@
   ];
 
   function EnableAuthenticatorAppController(
-    $scope, $uibModalInstance, Utils, AuthenticatorAppService, user) {
+    $scope, $uibModalInstance, Utils, AuthenticatorAppService, user, $uibModal) {
     var authAppCtrl = this;
 
     authAppCtrl.user = {
@@ -65,6 +65,7 @@
 
     authAppCtrl.dismiss = dismiss;
     authAppCtrl.reset = reset;
+    authAppCtrl.viewRecoveryCodes = viewRecoveryCodes;
 
     function reset() {
       console.log('reset form');
@@ -82,6 +83,19 @@
 
     function dismiss() { return $uibModalInstance.dismiss('Cancel'); }
 
+    function viewRecoveryCodes() {
+      var modalInstance = $uibModal.open({
+        templateUrl: '/resources/iam/apps/dashboard-app/templates/home/view-recovery-codes.html',
+        controller: 'ViewRecoveryCodesController',
+        controllerAs: 'authAppCtrl',
+        resolve: { user: function () { return self.user; } }
+      });
+
+      modalInstance.result.then(function (msg) {
+        return $uibModalInstance.close(msg);
+      });
+    }
+
     authAppCtrl.message = '';
 
     authAppCtrl.submitEnable = function () {
@@ -91,7 +105,8 @@
           authAppCtrl.user.code)
         .then(function () {
           authAppCtrl.requestPending = false;
-          return $uibModalInstance.close('Authenticator app enabled');
+          authAppCtrl.viewRecoveryCodes();
+          $uibModalInstance.close('Authenticator app enabled');
         })
         .catch(function (error) {
           authAppCtrl.requestPending = false;

From 8a33dc8a2e3c8c61b6a364b8231b13f28e379b40 Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Mon, 17 Jan 2022 16:42:48 +0000
Subject: [PATCH 55/76] Adding amr claim in OIDC id_token

The amr claim is an optional id_token claim specified in rfc8176 (https://datatracker.ietf.org/doc/html/rfc8176). It stands for authentication method reference and specifies the exact methods of authentication used to verify a user. A client can subsequently access this information from the returned id_token and make use of it if they wish. For example, if a client wishes to ensure that a user authenticates with more than one factor of authentication, they can check the length of the amr claim. If it is greater than or equal to 2, then they know that multiple factors were used. The exact factors are also specified, for example pwd for username and password and otp for one-time password.

Currently, only two values can be present in the amr claim: pwd and otp. At present, this is enough to cover all methods of authentication that are currently available, as the only additional method of authentication available so far is an authenticator app, denoted by "otp".

MFA users currently can't authenticate to use a client, as they always get redirected to the IAM dashboard (this was for demo purposes but is now outdated). This will be fixed in a commit shortly following this one.

This commit also includes an additional migration to the database. It adds a table to store the last authentication method references used by an account when they last signed in. This isn't ideal, as this information should only be temporary and as such stored in an authentication object. However, I could not find a way to implement this (by extending either of the authentication or user details objects) but may figure this out later on. On the plus side, this is a working solution.
---
 .../MultiFactorAuthenticationProvider.java    |  21 +++-
 .../config/security/IamWebSecurityConfig.java |   2 +-
 .../core/IamLocalAuthenticationProvider.java  |  24 +++-
 .../iam/IamJWTProfileIdTokenCustomizer.java   |  11 +-
 .../mw/iam/persistence/model/IamAccount.java  |  17 +++
 .../IamAuthenticationMethodReference.java     | 110 ++++++++++++++++++
 ...V71___authentication_method_references.sql |   3 +
 ...V71___authentication_method_references.sql |   4 +
 8 files changed, 185 insertions(+), 7 deletions(-)
 create mode 100644 iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAuthenticationMethodReference.java
 create mode 100644 iam-persistence/src/main/resources/db/migration/h2/V71___authentication_method_references.sql
 create mode 100644 iam-persistence/src/main/resources/db/migration/mysql/V71___authentication_method_references.sql

diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorAuthenticationProvider.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorAuthenticationProvider.java
index 1607bba44..9b428a0e2 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorAuthenticationProvider.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorAuthenticationProvider.java
@@ -17,7 +17,9 @@
 
 import java.util.ArrayList;
 import java.util.Arrays;
+import java.util.HashSet;
 import java.util.List;
+import java.util.Set;
 
 import org.springframework.security.authentication.AuthenticationProvider;
 import org.springframework.security.authentication.BadCredentialsException;
@@ -29,6 +31,7 @@
 import org.springframework.security.crypto.password.PasswordEncoder;
 
 import it.infn.mw.iam.persistence.model.IamAccount;
+import it.infn.mw.iam.persistence.model.IamAuthenticationMethodReference;
 import it.infn.mw.iam.persistence.repository.IamAccountRepository;
 
 public class MultiFactorAuthenticationProvider implements AuthenticationProvider {
@@ -55,8 +58,22 @@ public Authentication authenticate(Authentication authentication) throws Authent
       List updatedAuthorities =
           new ArrayList<>(Arrays.asList(new SimpleGrantedAuthority("ROLE_PRE_AUTHENTICATED")));
 
-      return new UsernamePasswordAuthenticationToken(authentication.getPrincipal(),
-          authentication.getCredentials(), updatedAuthorities);
+      // Used multi-factor authentication, so add pwd and otp as methods of
+      // authentication. This ensures the amr flag is properly set in an id_token, if OIDC used. otp
+      // refers to one-time-password (this authentication provider is for authenticator apps, which
+      // use OTPs)
+      IamAuthenticationMethodReference pwd = new IamAuthenticationMethodReference();
+      IamAuthenticationMethodReference otp = new IamAuthenticationMethodReference();
+      pwd.setAccount(account);
+      pwd.setName("pwd");
+      otp.setAccount(account);
+      otp.setName("mfa");
+      Set refs = new HashSet<>(Arrays.asList(pwd, otp));
+      account.setAuthenticationMethodReferences(refs);
+      accountRepo.save(account);
+
+      return new UsernamePasswordAuthenticationToken(account, authentication.getCredentials(),
+          updatedAuthorities);
     }
 
     return null;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java
index 9794d407d..3421c124a 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java
@@ -124,7 +124,7 @@ public static class UserLoginConfig extends WebSecurityConfigurerAdapter {
     public void configureGlobal(final AuthenticationManagerBuilder auth) throws Exception {
       // @formatter:off
       auth.authenticationProvider(new MultiFactorAuthenticationProvider(accountRepo, passwordEncoder));
-      auth.authenticationProvider(new IamLocalAuthenticationProvider(iamProperties, iamUserDetailsService, passwordEncoder));
+      auth.authenticationProvider(new IamLocalAuthenticationProvider(iamProperties, iamUserDetailsService, passwordEncoder, accountRepo));
       // @formatter:on
     }
 
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/IamLocalAuthenticationProvider.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/IamLocalAuthenticationProvider.java
index 7f03bad7a..50adcedd5 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/IamLocalAuthenticationProvider.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/IamLocalAuthenticationProvider.java
@@ -15,10 +15,14 @@
  */
 package it.infn.mw.iam.core;
 
+import java.util.Arrays;
+import java.util.HashSet;
+import java.util.Set;
 import java.util.function.Predicate;
 
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
+import org.springframework.security.authentication.BadCredentialsException;
 import org.springframework.security.authentication.DisabledException;
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
 import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
@@ -29,6 +33,9 @@
 
 import it.infn.mw.iam.config.IamProperties;
 import it.infn.mw.iam.config.IamProperties.LocalAuthenticationAllowedUsers;
+import it.infn.mw.iam.persistence.model.IamAccount;
+import it.infn.mw.iam.persistence.model.IamAuthenticationMethodReference;
+import it.infn.mw.iam.persistence.repository.IamAccountRepository;
 
 public class IamLocalAuthenticationProvider extends DaoAuthenticationProvider {
 
@@ -41,11 +48,14 @@ public class IamLocalAuthenticationProvider extends DaoAuthenticationProvider {
   private static final Predicate ADMIN_MATCHER =
       a -> a.getAuthority().equals("ROLE_ADMIN");
 
+  private final IamAccountRepository accountRepo;
+
   public IamLocalAuthenticationProvider(IamProperties properties, UserDetailsService uds,
-      PasswordEncoder passwordEncoder) {
+      PasswordEncoder passwordEncoder, IamAccountRepository accountRepo) {
     this.allowedUsers = properties.getLocalAuthn().getEnabledFor();
     setUserDetailsService(uds);
     setPasswordEncoder(passwordEncoder);
+    this.accountRepo = accountRepo;
   }
 
   @Override
@@ -58,6 +68,16 @@ protected void additionalAuthenticationChecks(UserDetails userDetails,
             && userDetails.getAuthorities().stream().noneMatch(ADMIN_MATCHER))) {
       throw new DisabledException(DISABLED_AUTH_MESSAGE);
     }
-  }
 
+    // Used local authentication (username and password) only, so add pwd as method of
+    // authentication. This ensures the amr flag is properly set in an id_token, if OIDC used
+    IamAccount account = accountRepo.findByUsername(authentication.getName())
+      .orElseThrow(() -> new BadCredentialsException("Invalid login details"));
+    IamAuthenticationMethodReference pwd = new IamAuthenticationMethodReference();
+    pwd.setAccount(account);
+    pwd.setName("pwd");
+    Set refs = new HashSet<>(Arrays.asList(pwd));
+    account.setAuthenticationMethodReferences(refs);
+    accountRepo.save(account);
+  }
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/iam/IamJWTProfileIdTokenCustomizer.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/iam/IamJWTProfileIdTokenCustomizer.java
index 1a753c901..e6cd7a73e 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/iam/IamJWTProfileIdTokenCustomizer.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/iam/IamJWTProfileIdTokenCustomizer.java
@@ -19,16 +19,17 @@
 
 import java.util.Set;
 
+import com.nimbusds.jwt.JWTClaimsSet.Builder;
+
 import org.mitre.oauth2.model.ClientDetailsEntity;
 import org.mitre.oauth2.model.OAuth2AccessTokenEntity;
 import org.mitre.openid.connect.service.ScopeClaimTranslationService;
 import org.springframework.security.oauth2.provider.OAuth2Request;
 
-import com.nimbusds.jwt.JWTClaimsSet.Builder;
-
 import it.infn.mw.iam.config.IamProperties;
 import it.infn.mw.iam.core.oauth.profile.common.BaseIdTokenCustomizer;
 import it.infn.mw.iam.persistence.model.IamAccount;
+import it.infn.mw.iam.persistence.model.IamAuthenticationMethodReference;
 import it.infn.mw.iam.persistence.model.IamUserInfo;
 import it.infn.mw.iam.persistence.repository.IamAccountRepository;
 
@@ -55,6 +56,12 @@ public void customizeIdTokenClaims(Builder idClaims, ClientDetailsEntity client,
 
     Set requiredClaims = scopeClaimConverter.getClaimsForScopeSet(request.getScope());
 
+    // Add the methods of authentication to the id_token
+    Set refs = account.getAuthenticationMethodReferences();
+    String[] amr =
+        refs.stream().map(IamAuthenticationMethodReference::getName).toArray(String[]::new);
+    idClaims.claim("amr", amr);
+
     requiredClaims.stream()
       .filter(ADDITIONAL_CLAIMS::contains)
       .forEach(c -> idClaims.claim(c, claimValueHelper.getClaimValueFromUserInfo(c, info)));
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAccount.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAccount.java
index eb3aa7e3f..d3272cd40 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAccount.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAccount.java
@@ -154,6 +154,9 @@ public class IamAccount implements Serializable {
       name = "iam_account_labels", joinColumns = @JoinColumn(name = "account_id"))
   private Set labels = new HashSet<>();
 
+  @OneToMany(mappedBy = "account", cascade = CascadeType.REMOVE)
+  private Set authenticationMethodReferences = new HashSet<>();
+
   public IamAccount() {
     // empty constructor
   }
@@ -609,4 +612,18 @@ public Date getEndTime() {
   public void setEndTime(Date endTime) {
     this.endTime = endTime;
   }
+
+  public Set getAuthenticationMethodReferences() {
+    return authenticationMethodReferences;
+  }
+
+  public void setAuthenticationMethodReferences(
+      Set authenticationMethodReferences) {
+    if (this.authenticationMethodReferences.isEmpty()) {
+      this.authenticationMethodReferences = authenticationMethodReferences;
+    } else {
+      this.authenticationMethodReferences.clear();
+      this.authenticationMethodReferences.addAll(authenticationMethodReferences);
+    }
+  }
 }
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAuthenticationMethodReference.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAuthenticationMethodReference.java
new file mode 100644
index 000000000..c0bd9b470
--- /dev/null
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAuthenticationMethodReference.java
@@ -0,0 +1,110 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.infn.mw.iam.persistence.model;
+
+import java.io.Serializable;
+
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.GeneratedValue;
+import javax.persistence.GenerationType;
+import javax.persistence.Id;
+import javax.persistence.JoinColumn;
+import javax.persistence.OneToOne;
+import javax.persistence.Table;
+
+@Entity
+@Table(name = "iam_authentication_method_reference")
+public class IamAuthenticationMethodReference implements Serializable {
+
+  private static final long serialVersionUID = 1L;
+
+  @Id
+  @GeneratedValue(strategy = GenerationType.IDENTITY)
+  private Long id;
+
+  @OneToOne
+  @JoinColumn(name = "account_id")
+  private IamAccount account;
+
+
+  @Column(nullable = false)
+  private String name;
+
+  public IamAuthenticationMethodReference() {
+
+  }
+
+  public IamAuthenticationMethodReference(String name, IamAccount account) {
+    this.name = name;
+    this.account = account;
+  }
+
+  public Long getId() {
+    return id;
+  }
+
+  public void setId(final Long id) {
+    this.id = id;
+  }
+
+  public IamAccount getAccount() {
+    return account;
+  }
+
+  public void setAccount(final IamAccount account) {
+    this.account = account;
+  }
+
+  public String getName() {
+    return name;
+  }
+
+  public void setName(String name) {
+    this.name = name;
+  }
+
+  @Override
+  public int hashCode() {
+    final int prime = 31;
+    int result = 1;
+    result = prime * result + ((id == null) ? 0 : id.hashCode());
+    return result;
+  }
+
+  @Override
+  public String toString() {
+    return "IamAuthenticationMethodReference [account=" + account + ", id=" + id + ", name=" + name
+        + "]";
+  }
+
+  @Override
+  public boolean equals(Object obj) {
+    if (this == obj)
+      return true;
+    if (obj == null)
+      return false;
+    if (getClass() != obj.getClass())
+      return false;
+    IamAuthenticationMethodReference other = (IamAuthenticationMethodReference) obj;
+    if (id == null) {
+      if (other.id != null)
+        return false;
+    } else if (!id.equals(other.id))
+      return false;
+    return true;
+  }
+}
diff --git a/iam-persistence/src/main/resources/db/migration/h2/V71___authentication_method_references.sql b/iam-persistence/src/main/resources/db/migration/h2/V71___authentication_method_references.sql
new file mode 100644
index 000000000..d03d9fcdb
--- /dev/null
+++ b/iam-persistence/src/main/resources/db/migration/h2/V71___authentication_method_references.sql
@@ -0,0 +1,3 @@
+CREATE TABLE iam_authentication_method_reference (ID BIGINT IDENTITY NOT NULL, NAME VARCHAR(64) NOT NULL, account_id BIGINT, PRIMARY KEY (ID));
+CREATE INDEX INDEX_iam_authentication_method_reference_name ON iam_authentication_method_reference (name);
+ALTER TABLE iam_authentication_method_reference ADD CONSTRAINT FK_iam_authentication_method_reference_account_id FOREIGN KEY (account_id) REFERENCES iam_account (ID);
\ No newline at end of file
diff --git a/iam-persistence/src/main/resources/db/migration/mysql/V71___authentication_method_references.sql b/iam-persistence/src/main/resources/db/migration/mysql/V71___authentication_method_references.sql
new file mode 100644
index 000000000..e3e7b1bfc
--- /dev/null
+++ b/iam-persistence/src/main/resources/db/migration/mysql/V71___authentication_method_references.sql
@@ -0,0 +1,4 @@
+CREATE TABLE iam_authentication_method_reference (ID BIGINT AUTO_INCREMENT NOT NULL, NAME VARCHAR(64) NOT NULL, account_id BIGINT, PRIMARY KEY (ID));
+CREATE INDEX INDEX_iam_authentication_method_reference_name ON iam_authentication_method_reference (name);
+ALTER TABLE iam_authentication_method_reference 
+  ADD CONSTRAINT FK_iam_authentication_method_reference_account_id FOREIGN KEY (account_id) REFERENCES iam_account (ID);
\ No newline at end of file

From 4efb9602cdce65c806e3ec360f7baa3aaf9641ee Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Thu, 20 Jan 2022 16:51:35 +0000
Subject: [PATCH 56/76] Removing unnecessary database migrations, extending
 authentication object to contain amr details

The old method of storing details about the user's authentication methods used didn't work, as the information wasn't flushed to the database properly. This was also poor coding practice in that it involved writing temporary authentication data to the database.

This has been improved by extending the UsernamePasswordAuthenticationToken to include a field which has this information. This will become the new expected authentication object whenever the user is authenticating through username and password. Through this, amr details can then be read and added to the id_token returned through OIDC later
---
 .../IamAuthenticationMethodReference.java     |  47 ++++++++
 .../MfaAuthenticationFilter.java              |  65 +++++++++++
 .../MultiFactorAuthenticationProvider.java    |  16 ++-
 .../config/security/IamWebSecurityConfig.java |   5 +-
 .../core/IamLocalAuthenticationProvider.java  |  49 ++++----
 .../mw/iam/core/MfaAuthenticationToken.java   |  95 +++++++++++++++
 .../iam/IamJWTProfileIdTokenCustomizer.java   |  16 ++-
 .../mw/iam/persistence/model/IamAccount.java  |  17 ---
 .../IamAuthenticationMethodReference.java     | 110 ------------------
 ...V71___authentication_method_references.sql |   3 -
 ...V71___authentication_method_references.sql |   4 -
 11 files changed, 258 insertions(+), 169 deletions(-)
 create mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/IamAuthenticationMethodReference.java
 create mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MfaAuthenticationFilter.java
 create mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/core/MfaAuthenticationToken.java
 delete mode 100644 iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAuthenticationMethodReference.java
 delete mode 100644 iam-persistence/src/main/resources/db/migration/h2/V71___authentication_method_references.sql
 delete mode 100644 iam-persistence/src/main/resources/db/migration/mysql/V71___authentication_method_references.sql

diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/IamAuthenticationMethodReference.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/IamAuthenticationMethodReference.java
new file mode 100644
index 000000000..fa29df723
--- /dev/null
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/IamAuthenticationMethodReference.java
@@ -0,0 +1,47 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.infn.mw.iam.authn.multi_factor_authentication;
+
+public class IamAuthenticationMethodReference {
+
+  public enum AuthenticationMethodReferenceValues {
+    PASSWORD("pwd"), ONE_TIME_PASSWORD("otp"), HARDWARE_KEY("hwk");
+
+    private final String value;
+
+    private AuthenticationMethodReferenceValues(String value) {
+      this.value = value;
+    }
+
+    public String getValue() {
+      return value;
+    }
+  }
+
+  private String name;
+
+  public IamAuthenticationMethodReference(String name) {
+    this.name = name;
+  }
+
+  public String getName() {
+    return name;
+  }
+
+  public void setName(String name) {
+    this.name = name;
+  }
+}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MfaAuthenticationFilter.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MfaAuthenticationFilter.java
new file mode 100644
index 000000000..766c46d20
--- /dev/null
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MfaAuthenticationFilter.java
@@ -0,0 +1,65 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.infn.mw.iam.authn.multi_factor_authentication;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.security.authentication.AuthenticationManager;
+import org.springframework.security.authentication.AuthenticationServiceException;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.AuthenticationException;
+import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
+
+import it.infn.mw.iam.core.MfaAuthenticationToken;
+
+public class MfaAuthenticationFilter extends UsernamePasswordAuthenticationFilter {
+
+  public static final Logger LOG = LoggerFactory.getLogger(MfaAuthenticationFilter.class);
+
+  private boolean postOnly = true;
+  private AuthenticationManager authenticationManager;
+
+  public MfaAuthenticationFilter(AuthenticationManager authenticationManager) {
+    this.authenticationManager = authenticationManager;
+  }
+
+  @Override
+  public Authentication attemptAuthentication(HttpServletRequest request,
+      HttpServletResponse response) throws AuthenticationException {
+
+    if (this.postOnly && !request.getMethod().equals("POST")) {
+      throw new AuthenticationServiceException(
+          "Authentication method not supported: " + request.getMethod());
+    }
+    String username = obtainUsername(request);
+    username = (username != null) ? username : "";
+    username = username.trim();
+    String password = obtainPassword(request);
+    password = (password != null) ? password : "";
+
+    MfaAuthenticationToken authRequest = new MfaAuthenticationToken(username, password);
+    // Allow subclasses to set the "details" property
+    setDetails(request, authRequest);
+    return this.authenticationManager.authenticate(authRequest);
+  }
+
+  private void setDetails(HttpServletRequest request, MfaAuthenticationToken authRequest) {
+    authRequest.setDetails(this.authenticationDetailsSource.buildDetails(request));
+  }
+}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorAuthenticationProvider.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorAuthenticationProvider.java
index 9b428a0e2..49199ff3f 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorAuthenticationProvider.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorAuthenticationProvider.java
@@ -15,6 +15,9 @@
  */
 package it.infn.mw.iam.authn.multi_factor_authentication;
 
+import static it.infn.mw.iam.authn.multi_factor_authentication.IamAuthenticationMethodReference.AuthenticationMethodReferenceValues.ONE_TIME_PASSWORD;
+import static it.infn.mw.iam.authn.multi_factor_authentication.IamAuthenticationMethodReference.AuthenticationMethodReferenceValues.PASSWORD;
+
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.HashSet;
@@ -31,7 +34,6 @@
 import org.springframework.security.crypto.password.PasswordEncoder;
 
 import it.infn.mw.iam.persistence.model.IamAccount;
-import it.infn.mw.iam.persistence.model.IamAuthenticationMethodReference;
 import it.infn.mw.iam.persistence.repository.IamAccountRepository;
 
 public class MultiFactorAuthenticationProvider implements AuthenticationProvider {
@@ -62,15 +64,11 @@ public Authentication authenticate(Authentication authentication) throws Authent
       // authentication. This ensures the amr flag is properly set in an id_token, if OIDC used. otp
       // refers to one-time-password (this authentication provider is for authenticator apps, which
       // use OTPs)
-      IamAuthenticationMethodReference pwd = new IamAuthenticationMethodReference();
-      IamAuthenticationMethodReference otp = new IamAuthenticationMethodReference();
-      pwd.setAccount(account);
-      pwd.setName("pwd");
-      otp.setAccount(account);
-      otp.setName("mfa");
+      IamAuthenticationMethodReference pwd =
+          new IamAuthenticationMethodReference(PASSWORD.getValue());
+      IamAuthenticationMethodReference otp =
+          new IamAuthenticationMethodReference(ONE_TIME_PASSWORD.getValue());
       Set refs = new HashSet<>(Arrays.asList(pwd, otp));
-      account.setAuthenticationMethodReferences(refs);
-      accountRepo.save(account);
 
       return new UsernamePasswordAuthenticationToken(account, authentication.getCredentials(),
           updatedAuthorities);
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java
index 3421c124a..e3dd262de 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java
@@ -43,6 +43,7 @@
 import org.springframework.security.web.access.AccessDeniedHandler;
 import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
 import org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint;
+import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
 import org.springframework.security.web.context.SecurityContextPersistenceFilter;
 import org.springframework.security.web.savedrequest.HttpSessionRequestCache;
 import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
@@ -55,6 +56,7 @@
 import it.infn.mw.iam.authn.HintAwareAuthenticationEntryPoint;
 import it.infn.mw.iam.authn.MultiFactorAuthenticationSuccessHandler;
 import it.infn.mw.iam.authn.RootIsDashboardSuccessHandler;
+import it.infn.mw.iam.authn.multi_factor_authentication.MfaAuthenticationFilter;
 import it.infn.mw.iam.authn.multi_factor_authentication.MultiFactorAuthenticationProvider;
 import it.infn.mw.iam.authn.oidc.OidcAuthenticationProvider;
 import it.infn.mw.iam.authn.oidc.OidcClientFilter;
@@ -124,7 +126,7 @@ public static class UserLoginConfig extends WebSecurityConfigurerAdapter {
     public void configureGlobal(final AuthenticationManagerBuilder auth) throws Exception {
       // @formatter:off
       auth.authenticationProvider(new MultiFactorAuthenticationProvider(accountRepo, passwordEncoder));
-      auth.authenticationProvider(new IamLocalAuthenticationProvider(iamProperties, iamUserDetailsService, passwordEncoder, accountRepo));
+      auth.authenticationProvider(new IamLocalAuthenticationProvider(iamProperties, iamUserDetailsService, passwordEncoder));
       // @formatter:on
     }
 
@@ -177,6 +179,7 @@ protected void configure(final HttpSecurity http) throws Exception {
           .exceptionHandling()
             .authenticationEntryPoint(entryPoint())
         .and()
+          .addFilterAt(new MfaAuthenticationFilter(this.authenticationManager()), UsernamePasswordAuthenticationFilter.class)
           .addFilterBefore(authorizationRequestFilter, SecurityContextPersistenceFilter.class)
         .logout()
           .logoutUrl("/logout")
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/IamLocalAuthenticationProvider.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/IamLocalAuthenticationProvider.java
index 50adcedd5..aa64d61b2 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/IamLocalAuthenticationProvider.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/IamLocalAuthenticationProvider.java
@@ -15,32 +15,28 @@
  */
 package it.infn.mw.iam.core;
 
-import java.util.Arrays;
+import static it.infn.mw.iam.authn.multi_factor_authentication.IamAuthenticationMethodReference.AuthenticationMethodReferenceValues.PASSWORD;
+
 import java.util.HashSet;
 import java.util.Set;
 import java.util.function.Predicate;
 
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import org.springframework.security.authentication.BadCredentialsException;
 import org.springframework.security.authentication.DisabledException;
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
 import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.AuthenticationException;
 import org.springframework.security.core.GrantedAuthority;
 import org.springframework.security.core.userdetails.UserDetails;
 import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.crypto.password.PasswordEncoder;
 
+import it.infn.mw.iam.authn.multi_factor_authentication.IamAuthenticationMethodReference;
 import it.infn.mw.iam.config.IamProperties;
 import it.infn.mw.iam.config.IamProperties.LocalAuthenticationAllowedUsers;
-import it.infn.mw.iam.persistence.model.IamAccount;
-import it.infn.mw.iam.persistence.model.IamAuthenticationMethodReference;
-import it.infn.mw.iam.persistence.repository.IamAccountRepository;
 
 public class IamLocalAuthenticationProvider extends DaoAuthenticationProvider {
 
-  public static final Logger LOG = LoggerFactory.getLogger(IamLocalAuthenticationProvider.class);
-
   public static final String DISABLED_AUTH_MESSAGE = "Local authentication is disabled";
 
   private final LocalAuthenticationAllowedUsers allowedUsers;
@@ -48,14 +44,27 @@ public class IamLocalAuthenticationProvider extends DaoAuthenticationProvider {
   private static final Predicate ADMIN_MATCHER =
       a -> a.getAuthority().equals("ROLE_ADMIN");
 
-  private final IamAccountRepository accountRepo;
-
   public IamLocalAuthenticationProvider(IamProperties properties, UserDetailsService uds,
-      PasswordEncoder passwordEncoder, IamAccountRepository accountRepo) {
+      PasswordEncoder passwordEncoder) {
     this.allowedUsers = properties.getLocalAuthn().getEnabledFor();
     setUserDetailsService(uds);
     setPasswordEncoder(passwordEncoder);
-    this.accountRepo = accountRepo;
+  }
+
+  @Override
+  public Authentication authenticate(Authentication authentication) throws AuthenticationException {
+    UsernamePasswordAuthenticationToken userpasstoken = new UsernamePasswordAuthenticationToken(
+        authentication.getPrincipal(), authentication.getCredentials());
+    authentication = super.authenticate(userpasstoken);
+
+    IamAuthenticationMethodReference pwd =
+        new IamAuthenticationMethodReference(PASSWORD.getValue());
+    Set refs = new HashSet<>();
+    refs.add(pwd);
+
+    MfaAuthenticationToken token = new MfaAuthenticationToken(authentication.getPrincipal(),
+        authentication.getCredentials(), authentication.getAuthorities(), refs);
+    return token;
   }
 
   @Override
@@ -68,16 +77,10 @@ protected void additionalAuthenticationChecks(UserDetails userDetails,
             && userDetails.getAuthorities().stream().noneMatch(ADMIN_MATCHER))) {
       throw new DisabledException(DISABLED_AUTH_MESSAGE);
     }
+  }
 
-    // Used local authentication (username and password) only, so add pwd as method of
-    // authentication. This ensures the amr flag is properly set in an id_token, if OIDC used
-    IamAccount account = accountRepo.findByUsername(authentication.getName())
-      .orElseThrow(() -> new BadCredentialsException("Invalid login details"));
-    IamAuthenticationMethodReference pwd = new IamAuthenticationMethodReference();
-    pwd.setAccount(account);
-    pwd.setName("pwd");
-    Set refs = new HashSet<>(Arrays.asList(pwd));
-    account.setAuthenticationMethodReferences(refs);
-    accountRepo.save(account);
+  @Override
+  public boolean supports(Class authentication) {
+    return (MfaAuthenticationToken.class.isAssignableFrom(authentication));
   }
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/MfaAuthenticationToken.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/MfaAuthenticationToken.java
new file mode 100644
index 000000000..59a81b9d7
--- /dev/null
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/MfaAuthenticationToken.java
@@ -0,0 +1,95 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.infn.mw.iam.core;
+
+import java.util.Collection;
+import java.util.HashSet;
+import java.util.Set;
+
+import org.springframework.security.authentication.AbstractAuthenticationToken;
+import org.springframework.security.core.GrantedAuthority;
+
+import it.infn.mw.iam.authn.multi_factor_authentication.IamAuthenticationMethodReference;
+
+public class MfaAuthenticationToken extends AbstractAuthenticationToken {
+
+  private final Object principal;
+  private Object credentials;
+  private Set authenticationMethodReferences = new HashSet<>();
+
+  public MfaAuthenticationToken(Object principal, Object credentials) {
+    super(null);
+    this.principal = principal;
+    this.credentials = credentials;
+  }
+
+  public MfaAuthenticationToken(Object principal, Object credentials,
+      Collection authorities) {
+    super(authorities);
+    this.principal = principal;
+    this.credentials = credentials;
+  }
+
+  public MfaAuthenticationToken(Object principal, Object credentials,
+      Set authenticationMethodReferences) {
+    super(null);
+    this.principal = principal;
+    this.credentials = credentials;
+    this.authenticationMethodReferences = authenticationMethodReferences;
+  }
+
+  public MfaAuthenticationToken(Object principal, Object credentials,
+      Collection authorities,
+      Set authenticationMethodReferences) {
+    super(authorities);
+    this.principal = principal;
+    this.credentials = credentials;
+    this.authenticationMethodReferences = authenticationMethodReferences;
+  }
+
+  public Set getAuthenticationMethodReferences() {
+    return authenticationMethodReferences;
+  }
+
+  public void setAuthenticationMethodReferences(
+      Set authenticationMethodReferences) {
+    this.authenticationMethodReferences = authenticationMethodReferences;
+  }
+
+  @Override
+  public Object getCredentials() {
+    return this.credentials;
+  }
+
+  @Override
+  public Object getPrincipal() {
+    return this.principal;
+  }
+
+  @Override
+  public String toString() {
+    StringBuilder sb = new StringBuilder();
+    sb.append(getClass().getSimpleName()).append(" [");
+    sb.append("Principal=").append(getPrincipal()).append(", ");
+    sb.append("Credentials=[PROTECTED], ");
+    sb.append("Authenticated=").append(isAuthenticated()).append(", ");
+    sb.append("Details=").append(getDetails()).append(", ");
+    sb.append("Granted Authorities=").append(this.getAuthorities()).append(", ");
+    sb.append("Authentication Method References=").append(this.getAuthenticationMethodReferences());
+    sb.append("]");
+    return sb.toString();
+  }
+}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/iam/IamJWTProfileIdTokenCustomizer.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/iam/IamJWTProfileIdTokenCustomizer.java
index e6cd7a73e..d895733b4 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/iam/IamJWTProfileIdTokenCustomizer.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/iam/IamJWTProfileIdTokenCustomizer.java
@@ -24,12 +24,16 @@
 import org.mitre.oauth2.model.ClientDetailsEntity;
 import org.mitre.oauth2.model.OAuth2AccessTokenEntity;
 import org.mitre.openid.connect.service.ScopeClaimTranslationService;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.security.oauth2.provider.OAuth2Request;
 
+import it.infn.mw.iam.authn.multi_factor_authentication.IamAuthenticationMethodReference;
 import it.infn.mw.iam.config.IamProperties;
+import it.infn.mw.iam.core.MfaAuthenticationToken;
 import it.infn.mw.iam.core.oauth.profile.common.BaseIdTokenCustomizer;
 import it.infn.mw.iam.persistence.model.IamAccount;
-import it.infn.mw.iam.persistence.model.IamAuthenticationMethodReference;
 import it.infn.mw.iam.persistence.model.IamUserInfo;
 import it.infn.mw.iam.persistence.repository.IamAccountRepository;
 
@@ -39,6 +43,8 @@ public class IamJWTProfileIdTokenCustomizer extends BaseIdTokenCustomizer {
   protected final ScopeClaimTranslationService scopeClaimConverter;
   protected final ClaimValueHelper claimValueHelper;
 
+  public static final Logger LOG = LoggerFactory.getLogger(IamJWTProfileIdTokenCustomizer.class);
+
   public IamJWTProfileIdTokenCustomizer(IamAccountRepository accountRepo,
       ScopeClaimTranslationService scopeClaimConverter, ClaimValueHelper claimValueHelper,
       IamProperties properties) {
@@ -54,12 +60,18 @@ public void customizeIdTokenClaims(Builder idClaims, ClientDetailsEntity client,
 
     IamUserInfo info = account.getUserInfo();
 
+    MfaAuthenticationToken token =
+        (MfaAuthenticationToken) SecurityContextHolder.getContext().getAuthentication();
+    LOG.error("With token, we have " + token.getAuthenticationMethodReferences());
+    Set refs = token.getAuthenticationMethodReferences();
+
     Set requiredClaims = scopeClaimConverter.getClaimsForScopeSet(request.getScope());
 
     // Add the methods of authentication to the id_token
-    Set refs = account.getAuthenticationMethodReferences();
+    LOG.error("Over here with " + refs);
     String[] amr =
         refs.stream().map(IamAuthenticationMethodReference::getName).toArray(String[]::new);
+    LOG.error("amr is " + amr);
     idClaims.claim("amr", amr);
 
     requiredClaims.stream()
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAccount.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAccount.java
index d3272cd40..eb3aa7e3f 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAccount.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAccount.java
@@ -154,9 +154,6 @@ public class IamAccount implements Serializable {
       name = "iam_account_labels", joinColumns = @JoinColumn(name = "account_id"))
   private Set labels = new HashSet<>();
 
-  @OneToMany(mappedBy = "account", cascade = CascadeType.REMOVE)
-  private Set authenticationMethodReferences = new HashSet<>();
-
   public IamAccount() {
     // empty constructor
   }
@@ -612,18 +609,4 @@ public Date getEndTime() {
   public void setEndTime(Date endTime) {
     this.endTime = endTime;
   }
-
-  public Set getAuthenticationMethodReferences() {
-    return authenticationMethodReferences;
-  }
-
-  public void setAuthenticationMethodReferences(
-      Set authenticationMethodReferences) {
-    if (this.authenticationMethodReferences.isEmpty()) {
-      this.authenticationMethodReferences = authenticationMethodReferences;
-    } else {
-      this.authenticationMethodReferences.clear();
-      this.authenticationMethodReferences.addAll(authenticationMethodReferences);
-    }
-  }
 }
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAuthenticationMethodReference.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAuthenticationMethodReference.java
deleted file mode 100644
index c0bd9b470..000000000
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAuthenticationMethodReference.java
+++ /dev/null
@@ -1,110 +0,0 @@
-/**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package it.infn.mw.iam.persistence.model;
-
-import java.io.Serializable;
-
-import javax.persistence.Column;
-import javax.persistence.Entity;
-import javax.persistence.GeneratedValue;
-import javax.persistence.GenerationType;
-import javax.persistence.Id;
-import javax.persistence.JoinColumn;
-import javax.persistence.OneToOne;
-import javax.persistence.Table;
-
-@Entity
-@Table(name = "iam_authentication_method_reference")
-public class IamAuthenticationMethodReference implements Serializable {
-
-  private static final long serialVersionUID = 1L;
-
-  @Id
-  @GeneratedValue(strategy = GenerationType.IDENTITY)
-  private Long id;
-
-  @OneToOne
-  @JoinColumn(name = "account_id")
-  private IamAccount account;
-
-
-  @Column(nullable = false)
-  private String name;
-
-  public IamAuthenticationMethodReference() {
-
-  }
-
-  public IamAuthenticationMethodReference(String name, IamAccount account) {
-    this.name = name;
-    this.account = account;
-  }
-
-  public Long getId() {
-    return id;
-  }
-
-  public void setId(final Long id) {
-    this.id = id;
-  }
-
-  public IamAccount getAccount() {
-    return account;
-  }
-
-  public void setAccount(final IamAccount account) {
-    this.account = account;
-  }
-
-  public String getName() {
-    return name;
-  }
-
-  public void setName(String name) {
-    this.name = name;
-  }
-
-  @Override
-  public int hashCode() {
-    final int prime = 31;
-    int result = 1;
-    result = prime * result + ((id == null) ? 0 : id.hashCode());
-    return result;
-  }
-
-  @Override
-  public String toString() {
-    return "IamAuthenticationMethodReference [account=" + account + ", id=" + id + ", name=" + name
-        + "]";
-  }
-
-  @Override
-  public boolean equals(Object obj) {
-    if (this == obj)
-      return true;
-    if (obj == null)
-      return false;
-    if (getClass() != obj.getClass())
-      return false;
-    IamAuthenticationMethodReference other = (IamAuthenticationMethodReference) obj;
-    if (id == null) {
-      if (other.id != null)
-        return false;
-    } else if (!id.equals(other.id))
-      return false;
-    return true;
-  }
-}
diff --git a/iam-persistence/src/main/resources/db/migration/h2/V71___authentication_method_references.sql b/iam-persistence/src/main/resources/db/migration/h2/V71___authentication_method_references.sql
deleted file mode 100644
index d03d9fcdb..000000000
--- a/iam-persistence/src/main/resources/db/migration/h2/V71___authentication_method_references.sql
+++ /dev/null
@@ -1,3 +0,0 @@
-CREATE TABLE iam_authentication_method_reference (ID BIGINT IDENTITY NOT NULL, NAME VARCHAR(64) NOT NULL, account_id BIGINT, PRIMARY KEY (ID));
-CREATE INDEX INDEX_iam_authentication_method_reference_name ON iam_authentication_method_reference (name);
-ALTER TABLE iam_authentication_method_reference ADD CONSTRAINT FK_iam_authentication_method_reference_account_id FOREIGN KEY (account_id) REFERENCES iam_account (ID);
\ No newline at end of file
diff --git a/iam-persistence/src/main/resources/db/migration/mysql/V71___authentication_method_references.sql b/iam-persistence/src/main/resources/db/migration/mysql/V71___authentication_method_references.sql
deleted file mode 100644
index e3e7b1bfc..000000000
--- a/iam-persistence/src/main/resources/db/migration/mysql/V71___authentication_method_references.sql
+++ /dev/null
@@ -1,4 +0,0 @@
-CREATE TABLE iam_authentication_method_reference (ID BIGINT AUTO_INCREMENT NOT NULL, NAME VARCHAR(64) NOT NULL, account_id BIGINT, PRIMARY KEY (ID));
-CREATE INDEX INDEX_iam_authentication_method_reference_name ON iam_authentication_method_reference (name);
-ALTER TABLE iam_authentication_method_reference 
-  ADD CONSTRAINT FK_iam_authentication_method_reference_account_id FOREIGN KEY (account_id) REFERENCES iam_account (ID);
\ No newline at end of file

From 6ac8b54c2b4a231de46cea754e781616853f693b Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Fri, 21 Jan 2022 16:34:47 +0000
Subject: [PATCH 57/76] Fixing login bugs with MfaAuthenticationToken,
 extending authentication for mfa login

Bugs with the authentication success handler meant that the new authentication token was not being handled correctly. This meant authenticated users weren't being properly redirected and mfa users could not sign in at all. These problems are being fixed here.
---
 .../MfaAuthenticationFilter.java              |  4 ++-
 .../MultiFactorAuthenticationProvider.java    | 26 +++++++++++------
 .../AuthenticatorAppVerifyController.java     | 28 ++++++++++++++-----
 .../config/security/IamWebSecurityConfig.java |  2 +-
 .../core/IamLocalAuthenticationProvider.java  |  5 ++--
 ...ClientCredentialsAuthenticationFilter.java |  6 ++--
 6 files changed, 49 insertions(+), 22 deletions(-)

diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MfaAuthenticationFilter.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MfaAuthenticationFilter.java
index 766c46d20..15d36bbf5 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MfaAuthenticationFilter.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MfaAuthenticationFilter.java
@@ -24,6 +24,7 @@
 import org.springframework.security.authentication.AuthenticationServiceException;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.AuthenticationException;
+import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
 import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
 
 import it.infn.mw.iam.core.MfaAuthenticationToken;
@@ -35,8 +36,9 @@ public class MfaAuthenticationFilter extends UsernamePasswordAuthenticationFilte
   private boolean postOnly = true;
   private AuthenticationManager authenticationManager;
 
-  public MfaAuthenticationFilter(AuthenticationManager authenticationManager) {
+  public MfaAuthenticationFilter(AuthenticationManager authenticationManager, AuthenticationSuccessHandler successHandler) {
     this.authenticationManager = authenticationManager;
+    this.setAuthenticationSuccessHandler(successHandler);
   }
 
   @Override
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorAuthenticationProvider.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorAuthenticationProvider.java
index 49199ff3f..7afe6fa70 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorAuthenticationProvider.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorAuthenticationProvider.java
@@ -19,20 +19,19 @@
 import static it.infn.mw.iam.authn.multi_factor_authentication.IamAuthenticationMethodReference.AuthenticationMethodReferenceValues.PASSWORD;
 
 import java.util.ArrayList;
-import java.util.Arrays;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Set;
 
 import org.springframework.security.authentication.AuthenticationProvider;
 import org.springframework.security.authentication.BadCredentialsException;
-import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.AuthenticationException;
 import org.springframework.security.core.GrantedAuthority;
 import org.springframework.security.core.authority.SimpleGrantedAuthority;
 import org.springframework.security.crypto.password.PasswordEncoder;
 
+import it.infn.mw.iam.core.MfaAuthenticationToken;
 import it.infn.mw.iam.persistence.model.IamAccount;
 import it.infn.mw.iam.persistence.repository.IamAccountRepository;
 
@@ -49,6 +48,10 @@ public MultiFactorAuthenticationProvider(IamAccountRepository accountRepo,
 
   @Override
   public Authentication authenticate(Authentication authentication) throws AuthenticationException {
+    if (authentication.isAuthenticated()) {
+      return authentication;
+    }
+
     IamAccount account = accountRepo.findByUsername(authentication.getName())
       .orElseThrow(() -> new BadCredentialsException("Invalid login details"));
     String password = authentication.getCredentials().toString();
@@ -57,8 +60,11 @@ public Authentication authenticate(Authentication authentication) throws Authent
     }
 
     if (account.getTotpMfa() != null && account.getTotpMfa().isActive()) {
-      List updatedAuthorities =
-          new ArrayList<>(Arrays.asList(new SimpleGrantedAuthority("ROLE_PRE_AUTHENTICATED")));
+      List currentAuthorities = new ArrayList<>();
+      for (GrantedAuthority authority : authentication.getAuthorities()) {
+        currentAuthorities.add(new SimpleGrantedAuthority(authority.getAuthority()));
+      }
+      currentAuthorities.add(new SimpleGrantedAuthority("ROLE_PRE_AUTHENTICATED"));
 
       // Used multi-factor authentication, so add pwd and otp as methods of
       // authentication. This ensures the amr flag is properly set in an id_token, if OIDC used. otp
@@ -68,10 +74,14 @@ public Authentication authenticate(Authentication authentication) throws Authent
           new IamAuthenticationMethodReference(PASSWORD.getValue());
       IamAuthenticationMethodReference otp =
           new IamAuthenticationMethodReference(ONE_TIME_PASSWORD.getValue());
-      Set refs = new HashSet<>(Arrays.asList(pwd, otp));
+      Set refs = new HashSet<>();
+      refs.add(pwd);
+      refs.add(otp);
 
-      return new UsernamePasswordAuthenticationToken(account, authentication.getCredentials(),
-          updatedAuthorities);
+      MfaAuthenticationToken token = new MfaAuthenticationToken(authentication.getPrincipal(),
+          authentication.getCredentials(), currentAuthorities, refs);
+      token.setAuthenticated(false);
+      return token;
     }
 
     return null;
@@ -79,6 +89,6 @@ public Authentication authenticate(Authentication authentication) throws Authent
 
   @Override
   public boolean supports(Class authentication) {
-    return authentication.equals(UsernamePasswordAuthenticationToken.class);
+    return authentication.equals(MfaAuthenticationToken.class);
   }
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/AuthenticatorAppVerifyController.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/AuthenticatorAppVerifyController.java
index f5d7b05de..17502a98b 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/AuthenticatorAppVerifyController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/AuthenticatorAppVerifyController.java
@@ -28,7 +28,6 @@
 import org.springframework.http.HttpStatus;
 import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.security.authentication.AuthenticationEventPublisher;
-import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.AuthenticationException;
 import org.springframework.security.core.GrantedAuthority;
@@ -50,6 +49,7 @@
 import it.infn.mw.iam.api.account.multi_factor_authentication.authenticator_app.CodeDTO;
 import it.infn.mw.iam.api.common.ErrorDTO;
 import it.infn.mw.iam.authn.multi_factor_authentication.error.MultiFactorAuthenticationError;
+import it.infn.mw.iam.core.MfaAuthenticationToken;
 import it.infn.mw.iam.persistence.model.IamAccount;
 import it.infn.mw.iam.persistence.model.IamTotpRecoveryCode;
 
@@ -107,11 +107,23 @@ public String verifyCode(@ModelAttribute @Valid CodeDTO code, BindingResult vali
     }
 
     SecurityContext sc = SecurityContextHolder.getContext();
-    List updatedAuthorities =
-        new ArrayList<>(Arrays.asList(new SimpleGrantedAuthority("ROLE_USER")));
+    MfaAuthenticationToken currentAuth = (MfaAuthenticationToken) sc.getAuthentication();
+
+    List currentAuthorities = new ArrayList<>();
+    for (GrantedAuthority authority : authentication.getAuthorities()) {
+      currentAuthorities.add(new SimpleGrantedAuthority(authority.getAuthority()));
+    }
+    currentAuthorities.remove(new SimpleGrantedAuthority("ROLE_PRE_AUTHENTICATED"));
+
+    account.getAuthorities()
+      .stream()
+      .forEach(authority -> currentAuthorities
+        .add(new SimpleGrantedAuthority(authority.getAuthority())));
 
-    Authentication newAuth = new UsernamePasswordAuthenticationToken(authentication.getPrincipal(),
-        authentication.getCredentials(), updatedAuthorities);
+    MfaAuthenticationToken newAuth =
+        new MfaAuthenticationToken(currentAuth.getPrincipal(), currentAuth.getCredentials(),
+            currentAuthorities, currentAuth.getAuthenticationMethodReferences());
+    newAuth.setAuthenticated(true);
     sc.setAuthentication(newAuth);
 
     // TODO touch account, i.e. log the successful verification
@@ -147,11 +159,13 @@ public String verifyRecoveryCode(@ModelAttribute @Valid RecoveryCodeDTO recovery
     }
 
     SecurityContext sc = SecurityContextHolder.getContext();
+    MfaAuthenticationToken currentAuth = (MfaAuthenticationToken) sc.getAuthentication();
     List updatedAuthorities =
         new ArrayList<>(Arrays.asList(new SimpleGrantedAuthority("ROLE_USER")));
 
-    Authentication newAuth = new UsernamePasswordAuthenticationToken(authentication.getPrincipal(),
-        authentication.getCredentials(), updatedAuthorities);
+    MfaAuthenticationToken newAuth =
+        new MfaAuthenticationToken(currentAuth.getPrincipal(), currentAuth.getCredentials(),
+            updatedAuthorities, currentAuth.getAuthenticationMethodReferences());
     sc.setAuthentication(newAuth);
 
     // TODO touch account, i.e. log the successful verification
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java
index e3dd262de..494a6ad7a 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java
@@ -179,7 +179,7 @@ protected void configure(final HttpSecurity http) throws Exception {
           .exceptionHandling()
             .authenticationEntryPoint(entryPoint())
         .and()
-          .addFilterAt(new MfaAuthenticationFilter(this.authenticationManager()), UsernamePasswordAuthenticationFilter.class)
+          .addFilterAt(new MfaAuthenticationFilter(this.authenticationManager(), successHandler()), UsernamePasswordAuthenticationFilter.class)
           .addFilterBefore(authorizationRequestFilter, SecurityContextPersistenceFilter.class)
         .logout()
           .logoutUrl("/logout")
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/IamLocalAuthenticationProvider.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/IamLocalAuthenticationProvider.java
index aa64d61b2..1a219e98d 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/IamLocalAuthenticationProvider.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/IamLocalAuthenticationProvider.java
@@ -53,9 +53,9 @@ public IamLocalAuthenticationProvider(IamProperties properties, UserDetailsServi
 
   @Override
   public Authentication authenticate(Authentication authentication) throws AuthenticationException {
-    UsernamePasswordAuthenticationToken userpasstoken = new UsernamePasswordAuthenticationToken(
+    UsernamePasswordAuthenticationToken userpassToken = new UsernamePasswordAuthenticationToken(
         authentication.getPrincipal(), authentication.getCredentials());
-    authentication = super.authenticate(userpasstoken);
+    authentication = super.authenticate(userpassToken);
 
     IamAuthenticationMethodReference pwd =
         new IamAuthenticationMethodReference(PASSWORD.getValue());
@@ -64,6 +64,7 @@ public Authentication authenticate(Authentication authentication) throws Authent
 
     MfaAuthenticationToken token = new MfaAuthenticationToken(authentication.getPrincipal(),
         authentication.getCredentials(), authentication.getAuthorities(), refs);
+    token.setAuthenticated(true);
     return token;
   }
 
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/FormClientCredentialsAuthenticationFilter.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/FormClientCredentialsAuthenticationFilter.java
index 91f9e9c61..6413dc21e 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/FormClientCredentialsAuthenticationFilter.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/FormClientCredentialsAuthenticationFilter.java
@@ -24,13 +24,14 @@
 import javax.servlet.http.HttpServletResponse;
 
 import org.springframework.security.authentication.InsufficientAuthenticationException;
-import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.security.web.AuthenticationEntryPoint;
 import org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter;
 import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
 
+import it.infn.mw.iam.core.MfaAuthenticationToken;
+
 public class FormClientCredentialsAuthenticationFilter
     extends AbstractAuthenticationProcessingFilter {
 
@@ -61,8 +62,7 @@ public Authentication attemptAuthentication(HttpServletRequest request,
       throw new InsufficientAuthenticationException("No client credentials found in request");
     }
 
-    UsernamePasswordAuthenticationToken authRequest =
-        new UsernamePasswordAuthenticationToken(clientId.trim(), clientSecret);
+    MfaAuthenticationToken authRequest = new MfaAuthenticationToken(clientId.trim(), clientSecret);
 
     return this.getAuthenticationManager().authenticate(authRequest);
   }

From 54842ffcfd58c19b90d5c4addb813337f2e7f61e Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Fri, 21 Jan 2022 16:44:00 +0000
Subject: [PATCH 58/76] Renaming MfaAuthenticationToken to
 ExtendedAuthenticationToken

More descriptive, plus mfa isn't used in every authentication attempt
---
 .../MfaAuthenticationFilter.java                   |  9 +++++----
 .../MultiFactorAuthenticationProvider.java         |  8 ++++----
 .../AuthenticatorAppVerifyController.java          | 14 +++++++-------
 ...Token.java => ExtendedAuthenticationToken.java} | 10 +++++-----
 .../iam/core/IamLocalAuthenticationProvider.java   |  7 ++++---
 .../FormClientCredentialsAuthenticationFilter.java |  5 +++--
 .../iam/IamJWTProfileIdTokenCustomizer.java        |  6 +++---
 7 files changed, 31 insertions(+), 28 deletions(-)
 rename iam-login-service/src/main/java/it/infn/mw/iam/core/{MfaAuthenticationToken.java => ExtendedAuthenticationToken.java} (88%)

diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MfaAuthenticationFilter.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MfaAuthenticationFilter.java
index 15d36bbf5..d8afb0322 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MfaAuthenticationFilter.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MfaAuthenticationFilter.java
@@ -27,7 +27,7 @@
 import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
 import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
 
-import it.infn.mw.iam.core.MfaAuthenticationToken;
+import it.infn.mw.iam.core.ExtendedAuthenticationToken;
 
 public class MfaAuthenticationFilter extends UsernamePasswordAuthenticationFilter {
 
@@ -36,7 +36,8 @@ public class MfaAuthenticationFilter extends UsernamePasswordAuthenticationFilte
   private boolean postOnly = true;
   private AuthenticationManager authenticationManager;
 
-  public MfaAuthenticationFilter(AuthenticationManager authenticationManager, AuthenticationSuccessHandler successHandler) {
+  public MfaAuthenticationFilter(AuthenticationManager authenticationManager,
+      AuthenticationSuccessHandler successHandler) {
     this.authenticationManager = authenticationManager;
     this.setAuthenticationSuccessHandler(successHandler);
   }
@@ -55,13 +56,13 @@ public Authentication attemptAuthentication(HttpServletRequest request,
     String password = obtainPassword(request);
     password = (password != null) ? password : "";
 
-    MfaAuthenticationToken authRequest = new MfaAuthenticationToken(username, password);
+    ExtendedAuthenticationToken authRequest = new ExtendedAuthenticationToken(username, password);
     // Allow subclasses to set the "details" property
     setDetails(request, authRequest);
     return this.authenticationManager.authenticate(authRequest);
   }
 
-  private void setDetails(HttpServletRequest request, MfaAuthenticationToken authRequest) {
+  private void setDetails(HttpServletRequest request, ExtendedAuthenticationToken authRequest) {
     authRequest.setDetails(this.authenticationDetailsSource.buildDetails(request));
   }
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorAuthenticationProvider.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorAuthenticationProvider.java
index 7afe6fa70..789a9745d 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorAuthenticationProvider.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorAuthenticationProvider.java
@@ -31,7 +31,7 @@
 import org.springframework.security.core.authority.SimpleGrantedAuthority;
 import org.springframework.security.crypto.password.PasswordEncoder;
 
-import it.infn.mw.iam.core.MfaAuthenticationToken;
+import it.infn.mw.iam.core.ExtendedAuthenticationToken;
 import it.infn.mw.iam.persistence.model.IamAccount;
 import it.infn.mw.iam.persistence.repository.IamAccountRepository;
 
@@ -78,8 +78,8 @@ public Authentication authenticate(Authentication authentication) throws Authent
       refs.add(pwd);
       refs.add(otp);
 
-      MfaAuthenticationToken token = new MfaAuthenticationToken(authentication.getPrincipal(),
-          authentication.getCredentials(), currentAuthorities, refs);
+      ExtendedAuthenticationToken token = new ExtendedAuthenticationToken(
+          authentication.getPrincipal(), authentication.getCredentials(), currentAuthorities, refs);
       token.setAuthenticated(false);
       return token;
     }
@@ -89,6 +89,6 @@ public Authentication authenticate(Authentication authentication) throws Authent
 
   @Override
   public boolean supports(Class authentication) {
-    return authentication.equals(MfaAuthenticationToken.class);
+    return authentication.equals(ExtendedAuthenticationToken.class);
   }
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/AuthenticatorAppVerifyController.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/AuthenticatorAppVerifyController.java
index 17502a98b..cb2b82904 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/AuthenticatorAppVerifyController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/AuthenticatorAppVerifyController.java
@@ -49,7 +49,7 @@
 import it.infn.mw.iam.api.account.multi_factor_authentication.authenticator_app.CodeDTO;
 import it.infn.mw.iam.api.common.ErrorDTO;
 import it.infn.mw.iam.authn.multi_factor_authentication.error.MultiFactorAuthenticationError;
-import it.infn.mw.iam.core.MfaAuthenticationToken;
+import it.infn.mw.iam.core.ExtendedAuthenticationToken;
 import it.infn.mw.iam.persistence.model.IamAccount;
 import it.infn.mw.iam.persistence.model.IamTotpRecoveryCode;
 
@@ -107,7 +107,7 @@ public String verifyCode(@ModelAttribute @Valid CodeDTO code, BindingResult vali
     }
 
     SecurityContext sc = SecurityContextHolder.getContext();
-    MfaAuthenticationToken currentAuth = (MfaAuthenticationToken) sc.getAuthentication();
+    ExtendedAuthenticationToken currentAuth = (ExtendedAuthenticationToken) sc.getAuthentication();
 
     List currentAuthorities = new ArrayList<>();
     for (GrantedAuthority authority : authentication.getAuthorities()) {
@@ -120,8 +120,8 @@ public String verifyCode(@ModelAttribute @Valid CodeDTO code, BindingResult vali
       .forEach(authority -> currentAuthorities
         .add(new SimpleGrantedAuthority(authority.getAuthority())));
 
-    MfaAuthenticationToken newAuth =
-        new MfaAuthenticationToken(currentAuth.getPrincipal(), currentAuth.getCredentials(),
+    ExtendedAuthenticationToken newAuth =
+        new ExtendedAuthenticationToken(currentAuth.getPrincipal(), currentAuth.getCredentials(),
             currentAuthorities, currentAuth.getAuthenticationMethodReferences());
     newAuth.setAuthenticated(true);
     sc.setAuthentication(newAuth);
@@ -159,12 +159,12 @@ public String verifyRecoveryCode(@ModelAttribute @Valid RecoveryCodeDTO recovery
     }
 
     SecurityContext sc = SecurityContextHolder.getContext();
-    MfaAuthenticationToken currentAuth = (MfaAuthenticationToken) sc.getAuthentication();
+    ExtendedAuthenticationToken currentAuth = (ExtendedAuthenticationToken) sc.getAuthentication();
     List updatedAuthorities =
         new ArrayList<>(Arrays.asList(new SimpleGrantedAuthority("ROLE_USER")));
 
-    MfaAuthenticationToken newAuth =
-        new MfaAuthenticationToken(currentAuth.getPrincipal(), currentAuth.getCredentials(),
+    ExtendedAuthenticationToken newAuth =
+        new ExtendedAuthenticationToken(currentAuth.getPrincipal(), currentAuth.getCredentials(),
             updatedAuthorities, currentAuth.getAuthenticationMethodReferences());
     sc.setAuthentication(newAuth);
 
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/MfaAuthenticationToken.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/ExtendedAuthenticationToken.java
similarity index 88%
rename from iam-login-service/src/main/java/it/infn/mw/iam/core/MfaAuthenticationToken.java
rename to iam-login-service/src/main/java/it/infn/mw/iam/core/ExtendedAuthenticationToken.java
index 59a81b9d7..7601a63cc 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/MfaAuthenticationToken.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/ExtendedAuthenticationToken.java
@@ -24,26 +24,26 @@
 
 import it.infn.mw.iam.authn.multi_factor_authentication.IamAuthenticationMethodReference;
 
-public class MfaAuthenticationToken extends AbstractAuthenticationToken {
+public class ExtendedAuthenticationToken extends AbstractAuthenticationToken {
 
   private final Object principal;
   private Object credentials;
   private Set authenticationMethodReferences = new HashSet<>();
 
-  public MfaAuthenticationToken(Object principal, Object credentials) {
+  public ExtendedAuthenticationToken(Object principal, Object credentials) {
     super(null);
     this.principal = principal;
     this.credentials = credentials;
   }
 
-  public MfaAuthenticationToken(Object principal, Object credentials,
+  public ExtendedAuthenticationToken(Object principal, Object credentials,
       Collection authorities) {
     super(authorities);
     this.principal = principal;
     this.credentials = credentials;
   }
 
-  public MfaAuthenticationToken(Object principal, Object credentials,
+  public ExtendedAuthenticationToken(Object principal, Object credentials,
       Set authenticationMethodReferences) {
     super(null);
     this.principal = principal;
@@ -51,7 +51,7 @@ public MfaAuthenticationToken(Object principal, Object credentials,
     this.authenticationMethodReferences = authenticationMethodReferences;
   }
 
-  public MfaAuthenticationToken(Object principal, Object credentials,
+  public ExtendedAuthenticationToken(Object principal, Object credentials,
       Collection authorities,
       Set authenticationMethodReferences) {
     super(authorities);
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/IamLocalAuthenticationProvider.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/IamLocalAuthenticationProvider.java
index 1a219e98d..b6d36d412 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/IamLocalAuthenticationProvider.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/IamLocalAuthenticationProvider.java
@@ -62,8 +62,9 @@ public Authentication authenticate(Authentication authentication) throws Authent
     Set refs = new HashSet<>();
     refs.add(pwd);
 
-    MfaAuthenticationToken token = new MfaAuthenticationToken(authentication.getPrincipal(),
-        authentication.getCredentials(), authentication.getAuthorities(), refs);
+    ExtendedAuthenticationToken token =
+        new ExtendedAuthenticationToken(authentication.getPrincipal(),
+            authentication.getCredentials(), authentication.getAuthorities(), refs);
     token.setAuthenticated(true);
     return token;
   }
@@ -82,6 +83,6 @@ protected void additionalAuthenticationChecks(UserDetails userDetails,
 
   @Override
   public boolean supports(Class authentication) {
-    return (MfaAuthenticationToken.class.isAssignableFrom(authentication));
+    return (ExtendedAuthenticationToken.class.isAssignableFrom(authentication));
   }
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/FormClientCredentialsAuthenticationFilter.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/FormClientCredentialsAuthenticationFilter.java
index 6413dc21e..0f35c22ec 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/FormClientCredentialsAuthenticationFilter.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/FormClientCredentialsAuthenticationFilter.java
@@ -30,7 +30,7 @@
 import org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter;
 import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
 
-import it.infn.mw.iam.core.MfaAuthenticationToken;
+import it.infn.mw.iam.core.ExtendedAuthenticationToken;
 
 public class FormClientCredentialsAuthenticationFilter
     extends AbstractAuthenticationProcessingFilter {
@@ -62,7 +62,8 @@ public Authentication attemptAuthentication(HttpServletRequest request,
       throw new InsufficientAuthenticationException("No client credentials found in request");
     }
 
-    MfaAuthenticationToken authRequest = new MfaAuthenticationToken(clientId.trim(), clientSecret);
+    ExtendedAuthenticationToken authRequest =
+        new ExtendedAuthenticationToken(clientId.trim(), clientSecret);
 
     return this.getAuthenticationManager().authenticate(authRequest);
   }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/iam/IamJWTProfileIdTokenCustomizer.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/iam/IamJWTProfileIdTokenCustomizer.java
index d895733b4..1d5a46cee 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/iam/IamJWTProfileIdTokenCustomizer.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/iam/IamJWTProfileIdTokenCustomizer.java
@@ -31,7 +31,7 @@
 
 import it.infn.mw.iam.authn.multi_factor_authentication.IamAuthenticationMethodReference;
 import it.infn.mw.iam.config.IamProperties;
-import it.infn.mw.iam.core.MfaAuthenticationToken;
+import it.infn.mw.iam.core.ExtendedAuthenticationToken;
 import it.infn.mw.iam.core.oauth.profile.common.BaseIdTokenCustomizer;
 import it.infn.mw.iam.persistence.model.IamAccount;
 import it.infn.mw.iam.persistence.model.IamUserInfo;
@@ -60,8 +60,8 @@ public void customizeIdTokenClaims(Builder idClaims, ClientDetailsEntity client,
 
     IamUserInfo info = account.getUserInfo();
 
-    MfaAuthenticationToken token =
-        (MfaAuthenticationToken) SecurityContextHolder.getContext().getAuthentication();
+    ExtendedAuthenticationToken token =
+        (ExtendedAuthenticationToken) SecurityContextHolder.getContext().getAuthentication();
     LOG.error("With token, we have " + token.getAuthenticationMethodReferences());
     Set refs = token.getAuthenticationMethodReferences();
 

From 2a03fbb5cdfc266aac3472c6918e6382d148d1d9 Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Fri, 21 Jan 2022 17:02:28 +0000
Subject: [PATCH 59/76] Renaming MfaAuthenticationFilter to
 ExtendedAuthenticationFilter

Falls in line with naming scheme for ExtendedAuthenticationToken
---
 ...icationFilter.java => ExtendedAuthenticationFilter.java} | 6 +++---
 .../infn/mw/iam/config/security/IamWebSecurityConfig.java   | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)
 rename iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/{MfaAuthenticationFilter.java => ExtendedAuthenticationFilter.java} (90%)

diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MfaAuthenticationFilter.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/ExtendedAuthenticationFilter.java
similarity index 90%
rename from iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MfaAuthenticationFilter.java
rename to iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/ExtendedAuthenticationFilter.java
index d8afb0322..c54cfe060 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MfaAuthenticationFilter.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/ExtendedAuthenticationFilter.java
@@ -29,14 +29,14 @@
 
 import it.infn.mw.iam.core.ExtendedAuthenticationToken;
 
-public class MfaAuthenticationFilter extends UsernamePasswordAuthenticationFilter {
+public class ExtendedAuthenticationFilter extends UsernamePasswordAuthenticationFilter {
 
-  public static final Logger LOG = LoggerFactory.getLogger(MfaAuthenticationFilter.class);
+  public static final Logger LOG = LoggerFactory.getLogger(ExtendedAuthenticationFilter.class);
 
   private boolean postOnly = true;
   private AuthenticationManager authenticationManager;
 
-  public MfaAuthenticationFilter(AuthenticationManager authenticationManager,
+  public ExtendedAuthenticationFilter(AuthenticationManager authenticationManager,
       AuthenticationSuccessHandler successHandler) {
     this.authenticationManager = authenticationManager;
     this.setAuthenticationSuccessHandler(successHandler);
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java
index 494a6ad7a..c5b8e54d1 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java
@@ -56,7 +56,7 @@
 import it.infn.mw.iam.authn.HintAwareAuthenticationEntryPoint;
 import it.infn.mw.iam.authn.MultiFactorAuthenticationSuccessHandler;
 import it.infn.mw.iam.authn.RootIsDashboardSuccessHandler;
-import it.infn.mw.iam.authn.multi_factor_authentication.MfaAuthenticationFilter;
+import it.infn.mw.iam.authn.multi_factor_authentication.ExtendedAuthenticationFilter;
 import it.infn.mw.iam.authn.multi_factor_authentication.MultiFactorAuthenticationProvider;
 import it.infn.mw.iam.authn.oidc.OidcAuthenticationProvider;
 import it.infn.mw.iam.authn.oidc.OidcClientFilter;
@@ -179,7 +179,7 @@ protected void configure(final HttpSecurity http) throws Exception {
           .exceptionHandling()
             .authenticationEntryPoint(entryPoint())
         .and()
-          .addFilterAt(new MfaAuthenticationFilter(this.authenticationManager(), successHandler()), UsernamePasswordAuthenticationFilter.class)
+          .addFilterAt(new ExtendedAuthenticationFilter(this.authenticationManager(), successHandler()), UsernamePasswordAuthenticationFilter.class)
           .addFilterBefore(authorizationRequestFilter, SecurityContextPersistenceFilter.class)
         .logout()
           .logoutUrl("/logout")

From 2c946deb6d5b245af005ac783a997795f1eec41c Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Mon, 24 Jan 2022 10:45:52 +0000
Subject: [PATCH 60/76] Moving db migrations to correct directory

Migrations to add pre_authenticated authority were in wrong place
---
 .../{prod => h2}/V71___add_pre_authenticated_authority.sql        | 0
 .../V71___add_pre_authenticed_authority.sql}                      | 0
 2 files changed, 0 insertions(+), 0 deletions(-)
 rename iam-persistence/src/main/resources/db/migration/{prod => h2}/V71___add_pre_authenticated_authority.sql (100%)
 rename iam-persistence/src/main/resources/db/migration/{test/V72___add_pre_authenticed_authority.sql => mysql/V71___add_pre_authenticed_authority.sql} (100%)

diff --git a/iam-persistence/src/main/resources/db/migration/prod/V71___add_pre_authenticated_authority.sql b/iam-persistence/src/main/resources/db/migration/h2/V71___add_pre_authenticated_authority.sql
similarity index 100%
rename from iam-persistence/src/main/resources/db/migration/prod/V71___add_pre_authenticated_authority.sql
rename to iam-persistence/src/main/resources/db/migration/h2/V71___add_pre_authenticated_authority.sql
diff --git a/iam-persistence/src/main/resources/db/migration/test/V72___add_pre_authenticed_authority.sql b/iam-persistence/src/main/resources/db/migration/mysql/V71___add_pre_authenticed_authority.sql
similarity index 100%
rename from iam-persistence/src/main/resources/db/migration/test/V72___add_pre_authenticed_authority.sql
rename to iam-persistence/src/main/resources/db/migration/mysql/V71___add_pre_authenticed_authority.sql

From 98d3c73e422c7c182899b211f75c0c8efea3519f Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Mon, 24 Jan 2022 11:09:54 +0000
Subject: [PATCH 61/76] Removing unneeded method to regenerate recovery codes

This method is present in the IamTotpMfa class itself, when this can be handled by the IamAccount service instead. This then calls the setRecoveryCodes method on the IamTotpMfa object in question.
---
 .../java/it/infn/mw/iam/persistence/model/IamTotpMfa.java     | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpMfa.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpMfa.java
index 982613910..552a61cd8 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpMfa.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpMfa.java
@@ -106,10 +106,6 @@ public void setRecoveryCodes(final Set recoveryCodes) {
     }
   }
 
-  public void regenerateRecoveryCodes() {
-    // TODO
-  }
-
   @Override
   public String toString() {
     return "IamTotpMfa [active=" + active + ", id=" + id + ", secret=" + secret + "]";

From f095d719f47f4288c5c36cb7337c740becbd0cb9 Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Mon, 24 Jan 2022 11:59:34 +0000
Subject: [PATCH 62/76] Adding creation time and update time to IamTotpMfa

Allows for changes to be tracked more easily
---
 .../core/user/DefaultIamAccountService.java   |  1 +
 .../mw/iam/persistence/model/IamTotpMfa.java  | 36 +++++++++++++++++++
 2 files changed, 37 insertions(+)

diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/DefaultIamAccountService.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/DefaultIamAccountService.java
index 545366982..1f5b4e6a9 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/DefaultIamAccountService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/DefaultIamAccountService.java
@@ -633,6 +633,7 @@ public IamAccount addTotpMfaRecoveryCodes(IamAccount account) {
 
     // Attach to account
     totpMfa.setRecoveryCodes(recoveryCodes);
+    totpMfa.touch();
     return account;
   }
 
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpMfa.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpMfa.java
index 552a61cd8..4658d6b0e 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpMfa.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpMfa.java
@@ -16,6 +16,7 @@
 package it.infn.mw.iam.persistence.model;
 
 import java.io.Serializable;
+import java.util.Date;
 import java.util.HashSet;
 import java.util.Set;
 
@@ -29,6 +30,8 @@
 import javax.persistence.OneToMany;
 import javax.persistence.OneToOne;
 import javax.persistence.Table;
+import javax.persistence.Temporal;
+import javax.persistence.TemporalType;
 
 @Entity
 @Table(name = "iam_totp_mfa")
@@ -49,6 +52,14 @@ public class IamTotpMfa implements Serializable {
   @Column(name = "active", nullable = false)
   private boolean active;
 
+  @Temporal(TemporalType.TIMESTAMP)
+  @Column(name = "creationtime", nullable = false)
+  private Date creationTime;
+
+  @Temporal(TemporalType.TIMESTAMP)
+  @Column(name = "lastupdatetime", nullable = false)
+  private Date lastUpdateTime;
+
   @OneToMany(mappedBy = "totpMfa", cascade = CascadeType.ALL, fetch = FetchType.EAGER,
       orphanRemoval = true)
   private Set recoveryCodes = new HashSet<>();
@@ -93,6 +104,31 @@ public void setActive(final boolean active) {
     this.active = active;
   }
 
+  public Date getCreationTime() {
+
+    return creationTime;
+  }
+
+  public void setCreationTime(final Date creationTime) {
+
+    this.creationTime = creationTime;
+  }
+
+  public Date getLastUpdateTime() {
+
+    return lastUpdateTime;
+  }
+
+  public void setLastUpdateTime(final Date lastUpdateTime) {
+
+    this.lastUpdateTime = lastUpdateTime;
+  }
+
+  public void touch() {
+
+    setLastUpdateTime(new Date());
+  }
+
   public Set getRecoveryCodes() {
     return recoveryCodes;
   }

From f2af341e731423539ccc723b7fc80d9e7354cf1c Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Thu, 27 Jan 2022 16:22:30 +0000
Subject: [PATCH 63/76] Fixing migrations from IamTotpMfa creation and update
 time fields

This meant that queries on the table were breaking
---
 .../infn/mw/iam/persistence/model/IamTotpMfa.java   | 13 ++++++++++---
 .../resources/db/migration/h2/V70___totp_mfa.sql    |  2 +-
 .../resources/db/migration/mysql/V70___totp_mfa.sql |  2 +-
 3 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpMfa.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpMfa.java
index 4658d6b0e..e06967bed 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpMfa.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpMfa.java
@@ -53,21 +53,28 @@ public class IamTotpMfa implements Serializable {
   private boolean active;
 
   @Temporal(TemporalType.TIMESTAMP)
-  @Column(name = "creationtime", nullable = false)
+  @Column(name = "creation_time", nullable = false)
   private Date creationTime;
 
   @Temporal(TemporalType.TIMESTAMP)
-  @Column(name = "lastupdatetime", nullable = false)
+  @Column(name = "last_update_time", nullable = false)
   private Date lastUpdateTime;
 
   @OneToMany(mappedBy = "totpMfa", cascade = CascadeType.ALL, fetch = FetchType.EAGER,
       orphanRemoval = true)
   private Set recoveryCodes = new HashSet<>();
 
-  public IamTotpMfa() {}
+  public IamTotpMfa() {
+    Date now = new Date();
+    setCreationTime(now);
+    setLastUpdateTime(now);
+  }
 
   public IamTotpMfa(IamAccount account) {
     this.account = account;
+    Date now = new Date();
+    setCreationTime(now);
+    setLastUpdateTime(now);
   }
 
   public Long getId() {
diff --git a/iam-persistence/src/main/resources/db/migration/h2/V70___totp_mfa.sql b/iam-persistence/src/main/resources/db/migration/h2/V70___totp_mfa.sql
index 03d54f807..d16dd28eb 100644
--- a/iam-persistence/src/main/resources/db/migration/h2/V70___totp_mfa.sql
+++ b/iam-persistence/src/main/resources/db/migration/h2/V70___totp_mfa.sql
@@ -1,6 +1,6 @@
 -- TOTP MFA secrets
 
-CREATE TABLE iam_totp_mfa (ID BIGINT IDENTITY NOT NULL, active BOOLEAN NOT NULL, secret VARCHAR(256) NOT NULL, ACCOUNT_ID BIGINT, PRIMARY KEY (ID));
+CREATE TABLE iam_totp_mfa (ID BIGINT IDENTITY NOT NULL, active BOOLEAN NOT NULL, secret VARCHAR(256) NOT NULL, creation_time TIMESTAMP NOT NULL, last_update_time TIMESTAMP NOT NULL, ACCOUNT_ID BIGINT, PRIMARY KEY (ID));
 
 CREATE TABLE iam_totp_recovery_code (ID BIGINT IDENTITY NOT NULL, code VARCHAR(255) NOT NULL, totp_mfa_id BIGINT NOT NULL, PRIMARY KEY (ID));
 
diff --git a/iam-persistence/src/main/resources/db/migration/mysql/V70___totp_mfa.sql b/iam-persistence/src/main/resources/db/migration/mysql/V70___totp_mfa.sql
index 7ca1909d0..237819648 100644
--- a/iam-persistence/src/main/resources/db/migration/mysql/V70___totp_mfa.sql
+++ b/iam-persistence/src/main/resources/db/migration/mysql/V70___totp_mfa.sql
@@ -1,6 +1,6 @@
 -- TOTP MFA secrets
 
-CREATE TABLE iam_totp_mfa (ID BIGINT AUTO_INCREMENT NOT NULL, active TINYINT(1) default 0 NOT NULL, secret VARCHAR(256) NOT NULL, ACCOUNT_ID BIGINT, PRIMARY KEY (ID));
+CREATE TABLE iam_totp_mfa (ID BIGINT AUTO_INCREMENT NOT NULL, active TINYINT(1) default 0 NOT NULL, secret VARCHAR(256) NOT NULL, creation_time DATETIME NOT NULL, last_update_time DATETIME NOT NULL, ACCOUNT_ID BIGINT, PRIMARY KEY (ID));
 
 CREATE TABLE iam_totp_recovery_code (ID BIGINT AUTO_INCREMENT NOT NULL, code VARCHAR(255) NOT NULL, totp_mfa_id BIGINT NOT NULL, PRIMARY KEY (ID));
 

From a7098a6e5ee91c5bce0f3d44eb3d3a7725463789 Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Thu, 27 Jan 2022 16:23:12 +0000
Subject: [PATCH 64/76] Removing YubiKey option and all references in code

This was only a placeholder for if/when the functionality for YubiKey was ever implemented
---
 .../controllers/user-mfa.controller.js        | 11 ---
 .../templates/home/editmfasettings.html       | 76 -------------------
 2 files changed, 87 deletions(-)

diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/user-mfa.controller.js b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/user-mfa.controller.js
index e1dc7e280..673d0f422 100644
--- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/user-mfa.controller.js
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/controllers/user-mfa.controller.js
@@ -40,12 +40,9 @@ function UserMfaController(
 
   userMfaCtrl.userToEdit = user;
 
-  userMfaCtrl.yubiKeyActive = false;
   userMfaCtrl.enableAuthenticatorApp = enableAuthenticatorApp;
   userMfaCtrl.disableAuthenticatorApp = disableAuthenticatorApp;
   userMfaCtrl.viewRecoveryCodes = viewRecoveryCodes;
-  userMfaCtrl.enableYubiKey = enableYubiKey;
-  userMfaCtrl.disableYubiKey = disableYubiKey;
 
   function enableAuthenticatorApp() {
     var modalInstance = $uibModal.open({
@@ -86,14 +83,6 @@ function UserMfaController(
     });
   }
 
-  function enableYubiKey() {
-    return true;
-  }
-
-  function disableYubiKey() {
-    return true;
-  }
-
   userMfaCtrl.dismiss = dismiss;
   userMfaCtrl.reset = reset;
 
diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/editmfasettings.html b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/editmfasettings.html
index 4a26f42bb..c9a4f9543 100644
--- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/editmfasettings.html
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/editmfasettings.html
@@ -44,82 +44,6 @@ 
Edit multi-factor authentication settings for {{userMfaC
             
           
         
-
-        

-          
-          
-          
-              
-            
-               Enabled
-            
-            
-            
-               Disabled
-            
-            
-          
-        

-
-        
-
     
 
     


From 143dfe14d95b1061aa36e48375202047926af4f9 Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Thu, 3 Feb 2022 13:54:26 +0000
Subject: [PATCH 65/76] Demonstrating reading of amr from request parameters to
 /token

The TokenEndpoint class is responsible for calling createTokenRequest. It passes parameters from the request to that endpoint and stores them inside the OAuth2AccessToken itself in the request field. This request is passed throughout the rest of the OAuth procedure, including to the IdTokenCustomizer. Here, its parameters can be read and so the amr claim can be retrieved here.

This is much simpler than trying to extend or modify the authentication object present at this stage of the OAuth process. What we need to do from here is try and pass the amr set as part of the request parameters to the token endpoint from the authorize endpoint. At the authorize endpoint, we are still authenticated with the ExtendedAuthenticationToken, which contains the amr set which we will access.
---
 .../core/oauth/IamOAuth2RequestFactory.java   |  6 +++++
 .../iam/IamJWTProfileIdTokenCustomizer.java   | 22 ++++++-------------
 2 files changed, 13 insertions(+), 15 deletions(-)

diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/IamOAuth2RequestFactory.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/IamOAuth2RequestFactory.java
index 40c3dd1da..0e8be932f 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/IamOAuth2RequestFactory.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/IamOAuth2RequestFactory.java
@@ -147,6 +147,12 @@ public TokenRequest createTokenRequest(Map requestParameters,
       }
     }
 
+    // These should come from the incoming request anyway
+    // Ideally will come in application/x-www-form-urlencoded format ?amr=pwd&amr=otp
+    // Adding in here for demo purposes at the moment
+    // Need to figure out how to add this to the request from the /authorize endpoint
+    requestParameters.put("amr", "pwd,otp");
+
     String grantType = requestParameters.get(OAuth2Utils.GRANT_TYPE);
 
     Set scopes = OAuth2Utils.parseParameterList(requestParameters.get(OAuth2Utils.SCOPE));
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/iam/IamJWTProfileIdTokenCustomizer.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/iam/IamJWTProfileIdTokenCustomizer.java
index 1d5a46cee..591c5ef15 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/iam/IamJWTProfileIdTokenCustomizer.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/iam/IamJWTProfileIdTokenCustomizer.java
@@ -26,12 +26,9 @@
 import org.mitre.openid.connect.service.ScopeClaimTranslationService;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
-import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.security.oauth2.provider.OAuth2Request;
 
-import it.infn.mw.iam.authn.multi_factor_authentication.IamAuthenticationMethodReference;
 import it.infn.mw.iam.config.IamProperties;
-import it.infn.mw.iam.core.ExtendedAuthenticationToken;
 import it.infn.mw.iam.core.oauth.profile.common.BaseIdTokenCustomizer;
 import it.infn.mw.iam.persistence.model.IamAccount;
 import it.infn.mw.iam.persistence.model.IamUserInfo;
@@ -60,24 +57,19 @@ public void customizeIdTokenClaims(Builder idClaims, ClientDetailsEntity client,
 
     IamUserInfo info = account.getUserInfo();
 
-    ExtendedAuthenticationToken token =
-        (ExtendedAuthenticationToken) SecurityContextHolder.getContext().getAuthentication();
-    LOG.error("With token, we have " + token.getAuthenticationMethodReferences());
-    Set refs = token.getAuthenticationMethodReferences();
-
     Set requiredClaims = scopeClaimConverter.getClaimsForScopeSet(request.getScope());
 
-    // Add the methods of authentication to the id_token
-    LOG.error("Over here with " + refs);
-    String[] amr =
-        refs.stream().map(IamAuthenticationMethodReference::getName).toArray(String[]::new);
-    LOG.error("amr is " + amr);
-    idClaims.claim("amr", amr);
-
     requiredClaims.stream()
       .filter(ADDITIONAL_CLAIMS::contains)
       .forEach(c -> idClaims.claim(c, claimValueHelper.getClaimValueFromUserInfo(c, info)));
 
+    // Add the methods of authentication to the id_token
+    String amrParam = request.getRequestParameters().get("amr");
+    if (amrParam != null) {
+      String[] amrArr = amrParam.split(",");
+      idClaims.claim("amr", amrArr);
+    }
+
     includeLabelsInIdToken(idClaims, client, request, account, accessToken);
   }
 

From a062373751e56a2cede4af5b130991277b96ba2f Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Thu, 17 Feb 2022 11:19:20 +0000
Subject: [PATCH 66/76] Authentication method reference claim now successfully
 appears in id_token for non-MFA users

This required extending the HttpServletRequest to include additional information and a filter to determine when to do this. This filter has to execute after authentication has taken place so that the ExtendedAuthenticationToken can be retrieved from the security context.

This currently only works for non-MFA users, as the current implementation redirects all MFA users to the dashboard after authenticating (demo purposes).
---
 iam-login-service/pom.xml                     |   5 +
 .../ExtendedAuthenticationFilter.java         |  15 ++-
 .../ExtendedHttpServletRequest.java           | 122 ++++++++++++++++++
 .../ExtendedHttpServletRequestFilter.java     |  91 +++++++++++++
 .../IamAuthenticationMethodReference.java     |   8 +-
 .../config/security/IamWebSecurityConfig.java |   2 +
 .../core/oauth/IamOAuth2RequestFactory.java   |   6 -
 .../iam/IamJWTProfileIdTokenCustomizer.java   |   8 +-
 pom.xml                                       |   7 +
 9 files changed, 250 insertions(+), 14 deletions(-)
 create mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/ExtendedHttpServletRequest.java
 create mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/ExtendedHttpServletRequestFilter.java

diff --git a/iam-login-service/pom.xml b/iam-login-service/pom.xml
index 4be0a28be..a70efabac 100644
--- a/iam-login-service/pom.xml
+++ b/iam-login-service/pom.xml
@@ -189,6 +189,11 @@
       spring-security-oauth2
     
 
+    
+      org.springframework.security
+      spring-security-oauth2-client
+    
+
     
       org.springframework.security
       spring-security-test
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/ExtendedAuthenticationFilter.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/ExtendedAuthenticationFilter.java
index c54cfe060..9786074aa 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/ExtendedAuthenticationFilter.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/ExtendedAuthenticationFilter.java
@@ -18,8 +18,6 @@
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 import org.springframework.security.authentication.AuthenticationManager;
 import org.springframework.security.authentication.AuthenticationServiceException;
 import org.springframework.security.core.Authentication;
@@ -29,10 +27,19 @@
 
 import it.infn.mw.iam.core.ExtendedAuthenticationToken;
 
+/**
+ * This replaces the default {@code UsernamePasswordAuthenticationFilter}. It is used to store a new
+ * {@code ExtendedAuthenticationToken} into the security context instead of a
+ * {@code UsernamePasswordAuthenticationToken}.
+ * 
+ * 

+ * Ultimately, we want to store information about the methods of authentication used for every login
+ * attempt. This is useful for registered clients, who may wish to restrict access to certain users
+ * based on the type or quantity of authentication methods used. The authentication methods are
+ * passed to the OAuth2 authorization endpoint and stored in the id_token returned to the client.
+ */
 public class ExtendedAuthenticationFilter extends UsernamePasswordAuthenticationFilter {
 
-  public static final Logger LOG = LoggerFactory.getLogger(ExtendedAuthenticationFilter.class);
-
   private boolean postOnly = true;
   private AuthenticationManager authenticationManager;
 
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/ExtendedHttpServletRequest.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/ExtendedHttpServletRequest.java
new file mode 100644
index 000000000..5347f2cdf
--- /dev/null
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/ExtendedHttpServletRequest.java
@@ -0,0 +1,122 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.infn.mw.iam.authn.multi_factor_authentication;
+
+import static it.infn.mw.iam.authn.multi_factor_authentication.IamAuthenticationMethodReference.AUTHENTICATION_METHOD_REFERENCE_CLAIM_STRING;
+
+import java.io.IOException;
+import java.io.UnsupportedEncodingException;
+import java.net.URLEncoder;
+import java.nio.charset.Charset;
+import java.nio.charset.StandardCharsets;
+import java.util.Collections;
+import java.util.Enumeration;
+import java.util.LinkedHashMap;
+import java.util.Map;
+import java.util.Objects;
+import java.util.stream.Collectors;
+import java.util.stream.Stream;
+
+import javax.servlet.ServletInputStream;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletRequestWrapper;
+
+/**
+ * Represents an extended {@code HttpServletRequest} object. This is primarily used for including
+ * information in an OAuth2 authorization request about the authentication method(s) used by the
+ * user to sign in. These are ultimately passed to the token endpoint so they may be included in the
+ * id_token received by the client.
+ */
+public final class ExtendedHttpServletRequest extends HttpServletRequestWrapper {
+
+  private final Map queryParameterMap;
+  private final Charset requestEncoding;
+
+  public ExtendedHttpServletRequest(HttpServletRequest request, String amrClaim) {
+    super(request);
+    Map queryMap = getCommonQueryParamFromLegacy(request.getParameterMap());
+    queryMap.put(AUTHENTICATION_METHOD_REFERENCE_CLAIM_STRING, new String[] {amrClaim});
+    queryParameterMap = Collections.unmodifiableMap(queryMap);
+
+    String encoding = request.getCharacterEncoding();
+    requestEncoding = (encoding != null ? Charset.forName(encoding) : StandardCharsets.UTF_8);
+  }
+
+  private final Map getCommonQueryParamFromLegacy(
+      Map paramMap) {
+    Objects.requireNonNull(paramMap);
+
+    Map commonQueryParamMap = new LinkedHashMap<>(paramMap);
+
+    return commonQueryParamMap;
+  }
+
+  @Override
+  public String getParameter(String name) {
+    String[] params = queryParameterMap.get(name);
+    return params != null ? params[0] : null;
+  }
+
+  @Override
+  public String[] getParameterValues(String name) {
+    return queryParameterMap.get(name);
+  }
+
+  @Override
+  public Map getParameterMap() {
+    return queryParameterMap; // unmodifiable to uphold the interface contract.
+  }
+
+  @Override
+  public Enumeration getParameterNames() {
+    return Collections.enumeration(queryParameterMap.keySet());
+  }
+
+  @Override
+  public String getQueryString() {
+    // @see : https://stackoverflow.com/a/35831692/9869013
+    // return queryParameterMap.entrySet().stream().flatMap(entry ->
+    // Stream.of(entry.getValue()).map(value -> entry.getKey() + "=" +
+    // value)).collect(Collectors.joining("&")); // without encoding !!
+    return queryParameterMap.entrySet()
+      .stream()
+      .flatMap(entry -> encodeMultiParameter(entry.getKey(), entry.getValue(), requestEncoding))
+      .collect(Collectors.joining("&"));
+  }
+
+  private Stream encodeMultiParameter(String key, String[] values, Charset encoding) {
+    return Stream.of(values).map(value -> encodeSingleParameter(key, value, encoding));
+  }
+
+  private String encodeSingleParameter(String key, String value, Charset encoding) {
+    return urlEncode(key, encoding) + "=" + urlEncode(value, encoding);
+  }
+
+  private String urlEncode(String value, Charset encoding) {
+    try {
+      return URLEncoder.encode(value, encoding.name());
+    } catch (UnsupportedEncodingException e) {
+      throw new IllegalArgumentException("Cannot url encode " + value, e);
+    }
+  }
+
+  @Override
+  public ServletInputStream getInputStream() throws IOException {
+    throw new UnsupportedOperationException("getInputStream() is not implemented in this "
+        + HttpServletRequest.class.getSimpleName() + " wrapper");
+  }
+
+}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/ExtendedHttpServletRequestFilter.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/ExtendedHttpServletRequestFilter.java
new file mode 100644
index 000000000..6d9e623c5
--- /dev/null
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/ExtendedHttpServletRequestFilter.java
@@ -0,0 +1,91 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.infn.mw.iam.authn.multi_factor_authentication;
+
+import java.io.IOException;
+import java.util.Iterator;
+import java.util.Set;
+
+import javax.servlet.FilterChain;
+import javax.servlet.ServletException;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import javax.servlet.http.HttpServletRequest;
+
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.web.filter.GenericFilterBean;
+
+import it.infn.mw.iam.core.ExtendedAuthenticationToken;
+
+/**
+ * This filter is applied after authentication has taken place. It is used in the OAuth2 process to
+ * detect if a set of {@code IamAuthenticationMethodReference} objects are included in the current
+ * {@code Authentication} object. If so, these are passed to an {@code ExtendedHttpServletRequest}
+ * so they may be included in the authorization request and passed to OAuth2 clients.
+ */
+public class ExtendedHttpServletRequestFilter extends GenericFilterBean {
+
+  public static final String AUTHORIZATION_REQUEST_INCLUDES_AMR =
+      "AUTHORIZATION_REQUEST_INCLUDES_AMR";
+
+  @Override
+  public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
+      throws IOException, ServletException {
+
+    // We fetch the ExtendedAuthenticationToken from the security context. This contains the
+    // authentication method references we want to include in the authorization request
+    Authentication auth = SecurityContextHolder.getContext().getAuthentication();
+
+    // Checking to see if this filter has been applied already (if so, this attribute will have
+    // already been set)
+    Object amrAttribute = request.getAttribute(AUTHORIZATION_REQUEST_INCLUDES_AMR);
+
+    if (amrAttribute == null && auth instanceof ExtendedAuthenticationToken) {
+      Set amrSet =
+          ((ExtendedAuthenticationToken) auth).getAuthenticationMethodReferences();
+      String amrClaim = parseAuthenticationMethodReferences(amrSet);
+
+      ExtendedHttpServletRequest extendedRequest =
+          new ExtendedHttpServletRequest((HttpServletRequest) request, amrClaim);
+
+      extendedRequest.setAttribute(AUTHORIZATION_REQUEST_INCLUDES_AMR, Boolean.TRUE);
+      request = extendedRequest;
+    }
+
+    chain.doFilter(request, response);
+  }
+
+  /**
+   * Convert a set of authentication method references into a request parameter string Values are
+   * separated with a + symbol
+   * 
+   * @param amrSet the set of authentication method references
+   * @return the parsed string
+   */
+  private String parseAuthenticationMethodReferences(Set amrSet) {
+    String amrClaim = "";
+    Iterator it = amrSet.iterator();
+    while (it.hasNext()) {
+      IamAuthenticationMethodReference current = it.next();
+      amrClaim += current.getName() + "+";
+    }
+
+    // Remove trailing + symbol at end of string
+    amrClaim = amrClaim.substring(0, amrClaim.length() - 1);
+    return amrClaim;
+  }
+}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/IamAuthenticationMethodReference.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/IamAuthenticationMethodReference.java
index fa29df723..d45472117 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/IamAuthenticationMethodReference.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/IamAuthenticationMethodReference.java
@@ -17,8 +17,14 @@
 
 public class IamAuthenticationMethodReference {
 
+  public static final String AUTHENTICATION_METHOD_REFERENCE_CLAIM_STRING = "amr";
+
   public enum AuthenticationMethodReferenceValues {
-    PASSWORD("pwd"), ONE_TIME_PASSWORD("otp"), HARDWARE_KEY("hwk");
+    // Add additional values here if new authentication factors get added, e.g. HARDWARE_KEY("hwk")
+    // Consult here for standardised reference values -
+    // https://datatracker.ietf.org/doc/html/rfc8176
+
+    PASSWORD("pwd"), ONE_TIME_PASSWORD("otp");
 
     private final String value;
 
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java
index c5b8e54d1..f2c09804d 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java
@@ -57,6 +57,7 @@
 import it.infn.mw.iam.authn.MultiFactorAuthenticationSuccessHandler;
 import it.infn.mw.iam.authn.RootIsDashboardSuccessHandler;
 import it.infn.mw.iam.authn.multi_factor_authentication.ExtendedAuthenticationFilter;
+import it.infn.mw.iam.authn.multi_factor_authentication.ExtendedHttpServletRequestFilter;
 import it.infn.mw.iam.authn.multi_factor_authentication.MultiFactorAuthenticationProvider;
 import it.infn.mw.iam.authn.oidc.OidcAuthenticationProvider;
 import it.infn.mw.iam.authn.oidc.OidcClientFilter;
@@ -181,6 +182,7 @@ protected void configure(final HttpSecurity http) throws Exception {
         .and()
           .addFilterAt(new ExtendedAuthenticationFilter(this.authenticationManager(), successHandler()), UsernamePasswordAuthenticationFilter.class)
           .addFilterBefore(authorizationRequestFilter, SecurityContextPersistenceFilter.class)
+          .addFilterAfter(new ExtendedHttpServletRequestFilter(), UsernamePasswordAuthenticationFilter.class)
         .logout()
           .logoutUrl("/logout")
         .and().anonymous()
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/IamOAuth2RequestFactory.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/IamOAuth2RequestFactory.java
index 0e8be932f..40c3dd1da 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/IamOAuth2RequestFactory.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/IamOAuth2RequestFactory.java
@@ -147,12 +147,6 @@ public TokenRequest createTokenRequest(Map requestParameters,
       }
     }
 
-    // These should come from the incoming request anyway
-    // Ideally will come in application/x-www-form-urlencoded format ?amr=pwd&amr=otp
-    // Adding in here for demo purposes at the moment
-    // Need to figure out how to add this to the request from the /authorize endpoint
-    requestParameters.put("amr", "pwd,otp");
-
     String grantType = requestParameters.get(OAuth2Utils.GRANT_TYPE);
 
     Set scopes = OAuth2Utils.parseParameterList(requestParameters.get(OAuth2Utils.SCOPE));
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/iam/IamJWTProfileIdTokenCustomizer.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/iam/IamJWTProfileIdTokenCustomizer.java
index 591c5ef15..8730c06ed 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/iam/IamJWTProfileIdTokenCustomizer.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/iam/IamJWTProfileIdTokenCustomizer.java
@@ -16,6 +16,7 @@
 package it.infn.mw.iam.core.oauth.profile.iam;
 
 import static it.infn.mw.iam.core.oauth.profile.iam.ClaimValueHelper.ADDITIONAL_CLAIMS;
+import static it.infn.mw.iam.authn.multi_factor_authentication.IamAuthenticationMethodReference.AUTHENTICATION_METHOD_REFERENCE_CLAIM_STRING;
 
 import java.util.Set;
 
@@ -64,10 +65,11 @@ public void customizeIdTokenClaims(Builder idClaims, ClientDetailsEntity client,
       .forEach(c -> idClaims.claim(c, claimValueHelper.getClaimValueFromUserInfo(c, info)));
 
     // Add the methods of authentication to the id_token
-    String amrParam = request.getRequestParameters().get("amr");
+    String amrParam =
+        request.getRequestParameters().get(AUTHENTICATION_METHOD_REFERENCE_CLAIM_STRING);
     if (amrParam != null) {
-      String[] amrArr = amrParam.split(",");
-      idClaims.claim("amr", amrArr);
+      String[] amrArr = amrParam.split("\\+");
+      idClaims.claim(AUTHENTICATION_METHOD_REFERENCE_CLAIM_STRING, amrArr);
     }
 
     includeLabelsInIdToken(idClaims, client, request, account, accessToken);
diff --git a/pom.xml b/pom.xml
index 0cdab0c38..14d5c2583 100644
--- a/pom.xml
+++ b/pom.xml
@@ -31,6 +31,7 @@
 
     1.3.5.cnaf-spring-update-SNAPSHOT
     2.5.1.RELEASE
+    5.6.1
 
     3.3.2
     1.0.10.RELEASE
@@ -249,6 +250,12 @@
         ${jaxb-runtime.version}
       
 
+      
+        org.springframework.security
+        spring-security-oauth2-client
+        ${spring-security-oauth2-client.version}
+      
+
     
 
   

From 666037b4357781ca0cb373ed52d3348135efb28a Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Thu, 24 Feb 2022 15:19:24 +0000
Subject: [PATCH 67/76] OAuth2 client login flow now works for MFA users

This involved refactoring the way TOTPs were verified. Previously, this was done through the controller for the verification page itself. This logic is being moved into a dedicated authentication provider, executed by a dedicated authentication processing filter on a new authentication entry point.

Still to test failed TOTP entries and account for recovery codes as well
---
 .../MultiFactorAuthenticationProvider.java    |   4 -
 .../MultiFactorCodeCheckProvider.java         |  96 +++++++++
 .../MultiFactorVerificationFilter.java        | 122 +++++++++++
 .../AuthenticatorAppVerifyController.java     | 196 ------------------
 .../authenticator_app/RecoveryCodeDTO.java    |  44 ----
 .../infn/mw/iam/config/IamTotpMfaConfig.java  |  67 +++++-
 .../config/security/IamWebSecurityConfig.java |  39 +++-
 .../iam/core/ExtendedAuthenticationToken.java |  27 +++
 .../verify-authenticator-app-form.jsp         |   4 +-
 9 files changed, 347 insertions(+), 252 deletions(-)
 create mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorCodeCheckProvider.java
 create mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorVerificationFilter.java
 delete mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/AuthenticatorAppVerifyController.java
 delete mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/RecoveryCodeDTO.java

diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorAuthenticationProvider.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorAuthenticationProvider.java
index 789a9745d..c76c9c32b 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorAuthenticationProvider.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorAuthenticationProvider.java
@@ -15,7 +15,6 @@
  */
 package it.infn.mw.iam.authn.multi_factor_authentication;
 
-import static it.infn.mw.iam.authn.multi_factor_authentication.IamAuthenticationMethodReference.AuthenticationMethodReferenceValues.ONE_TIME_PASSWORD;
 import static it.infn.mw.iam.authn.multi_factor_authentication.IamAuthenticationMethodReference.AuthenticationMethodReferenceValues.PASSWORD;
 
 import java.util.ArrayList;
@@ -72,11 +71,8 @@ public Authentication authenticate(Authentication authentication) throws Authent
       // use OTPs)
       IamAuthenticationMethodReference pwd =
           new IamAuthenticationMethodReference(PASSWORD.getValue());
-      IamAuthenticationMethodReference otp =
-          new IamAuthenticationMethodReference(ONE_TIME_PASSWORD.getValue());
       Set refs = new HashSet<>();
       refs.add(pwd);
-      refs.add(otp);
 
       ExtendedAuthenticationToken token = new ExtendedAuthenticationToken(
           authentication.getPrincipal(), authentication.getCredentials(), currentAuthorities, refs);
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorCodeCheckProvider.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorCodeCheckProvider.java
new file mode 100644
index 000000000..5d9060c9c
--- /dev/null
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorCodeCheckProvider.java
@@ -0,0 +1,96 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.infn.mw.iam.authn.multi_factor_authentication;
+
+import static it.infn.mw.iam.authn.multi_factor_authentication.IamAuthenticationMethodReference.AuthenticationMethodReferenceValues.ONE_TIME_PASSWORD;
+
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Set;
+
+import org.springframework.security.authentication.AuthenticationProvider;
+import org.springframework.security.authentication.BadCredentialsException;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.AuthenticationException;
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.authority.SimpleGrantedAuthority;
+
+import dev.samstevens.totp.code.CodeVerifier;
+import it.infn.mw.iam.core.ExtendedAuthenticationToken;
+import it.infn.mw.iam.persistence.model.IamAccount;
+import it.infn.mw.iam.persistence.model.IamTotpMfa;
+import it.infn.mw.iam.persistence.repository.IamAccountRepository;
+
+public class MultiFactorCodeCheckProvider implements AuthenticationProvider {
+
+  private final IamAccountRepository accountRepo;
+  private final CodeVerifier codeVerifier;
+
+  public MultiFactorCodeCheckProvider(IamAccountRepository accountRepo, CodeVerifier codeVerifier) {
+    this.accountRepo = accountRepo;
+    this.codeVerifier = codeVerifier;
+  }
+
+  @Override
+  public Authentication authenticate(Authentication authentication) throws AuthenticationException {
+    if (authentication.isAuthenticated()) {
+      return authentication;
+    }
+
+    ExtendedAuthenticationToken token = (ExtendedAuthenticationToken) authentication;
+    String code = token.getCode();
+
+    IamAccount account = accountRepo.findByUsername(authentication.getName())
+      .orElseThrow(() -> new BadCredentialsException("Invalid login details"));
+
+    IamTotpMfa totpMfa = account.getTotpMfa();
+
+    if (code != null && totpMfa != null && totpMfa.isActive()) {
+      if (codeVerifier.isValidCode(totpMfa.getSecret(), code)) {
+        IamAuthenticationMethodReference otp =
+            new IamAuthenticationMethodReference(ONE_TIME_PASSWORD.getValue());
+        Set refs = token.getAuthenticationMethodReferences();
+        refs.add(otp);
+        token.setAuthenticationMethodReferences(refs);
+        token.setAuthenticated(true);
+
+        List authorities = new ArrayList<>();
+        for (GrantedAuthority authority : authentication.getAuthorities()) {
+          authorities.add(new SimpleGrantedAuthority(authority.getAuthority()));
+        }
+        authorities.remove(new SimpleGrantedAuthority("ROLE_PRE_AUTHENTICATED"));
+
+        account.getAuthorities()
+          .stream()
+          .forEach(
+              authority -> authorities.add(new SimpleGrantedAuthority(authority.getAuthority())));
+
+        ExtendedAuthenticationToken newToken = new ExtendedAuthenticationToken(token.getPrincipal(),
+            token.getCredentials(), authorities, token.getAuthenticationMethodReferences());
+        newToken.setAuthenticated(true);
+
+        return newToken;
+      }
+    }
+
+    return null;
+  }
+
+  @Override
+  public boolean supports(Class authentication) {
+    return authentication.equals(ExtendedAuthenticationToken.class);
+  }
+}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorVerificationFilter.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorVerificationFilter.java
new file mode 100644
index 000000000..6e84db688
--- /dev/null
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorVerificationFilter.java
@@ -0,0 +1,122 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.infn.mw.iam.authn.multi_factor_authentication;
+
+import java.io.IOException;
+import java.util.Collection;
+
+import javax.servlet.FilterChain;
+import javax.servlet.ServletException;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.springframework.security.authentication.AuthenticationManager;
+import org.springframework.security.authentication.AuthenticationServiceException;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.AuthenticationException;
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter;
+import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
+
+import it.infn.mw.iam.core.ExtendedAuthenticationToken;
+
+public class MultiFactorVerificationFilter extends AbstractAuthenticationProcessingFilter {
+
+  public static final String TOTP_MFA_CODE_KEY = "code";
+  public static final String MULTI_FACTOR_VERIFIED = "MULTI_FACTOR_VERIFIED";
+
+  private final boolean postOnly = true;
+  private AuthenticationManager authenticationManager;
+
+  private ExtendedAuthenticationToken token;
+  private String codeParameter = TOTP_MFA_CODE_KEY;
+  private AuthenticationSuccessHandler authenticationSuccessHandler;
+
+  public MultiFactorVerificationFilter(AuthenticationManager authenticationManager) {
+    super("/iam/verify", authenticationManager);
+    this.authenticationManager = authenticationManager;
+  }
+
+  public void setAuthenticationSuccessHandler(
+      AuthenticationSuccessHandler authenticationSuccessHandler) {
+    this.authenticationSuccessHandler = authenticationSuccessHandler;
+  }
+
+  @Override
+  public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
+      throws IOException, ServletException {
+    Object multiFactorVerifiedAttribute = request.getAttribute(MULTI_FACTOR_VERIFIED);
+
+    if (multiFactorVerifiedAttribute == null) {
+      HttpServletRequest httpServletRequest = (HttpServletRequest) request;
+      if (httpServletRequest.getMethod().equals("POST")
+          && httpServletRequest.getRequestURI().equals("/iam/verify")) {
+        Authentication auth = SecurityContextHolder.getContext().getAuthentication();
+
+        if (auth instanceof ExtendedAuthenticationToken && isMfaEnabled(auth)) {
+          token = (ExtendedAuthenticationToken) auth;
+          HttpServletResponse httpServletResponse = (HttpServletResponse) response;
+
+          Authentication newAuth = attemptAuthentication(httpServletRequest, httpServletResponse);
+          SecurityContextHolder.getContext().setAuthentication(newAuth);
+
+          request.setAttribute(MULTI_FACTOR_VERIFIED, Boolean.TRUE);
+          authenticationSuccessHandler.onAuthenticationSuccess(httpServletRequest,
+              httpServletResponse, newAuth);
+        }
+      }
+    }
+
+    chain.doFilter(request, response);
+  }
+
+  private boolean isMfaEnabled(final Authentication authentication) {
+    final Collection authorities = authentication.getAuthorities();
+    for (final GrantedAuthority grantedAuthority : authorities) {
+      String authorityName = grantedAuthority.getAuthority();
+      if (authorityName.equals("ROLE_PRE_AUTHENTICATED")) {
+        return true;
+      }
+    }
+
+    return false;
+  }
+
+  @Override
+  public Authentication attemptAuthentication(HttpServletRequest request,
+      HttpServletResponse response) throws AuthenticationException {
+    if (this.postOnly && !request.getMethod().equals("POST")) {
+      throw new AuthenticationServiceException(
+          "Authentication method not supported: " + request.getMethod());
+    }
+
+    if (this.token == null) {
+      return null;
+    }
+
+    String code = request.getParameter(this.codeParameter);
+    code = (code != null) ? code : "";
+    code = code.trim();
+
+    ExtendedAuthenticationToken authRequest = new ExtendedAuthenticationToken(this.token);
+    authRequest.setCode(code);
+
+    return this.authenticationManager.authenticate(authRequest);
+  }
+}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/AuthenticatorAppVerifyController.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/AuthenticatorAppVerifyController.java
deleted file mode 100644
index cb2b82904..000000000
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/AuthenticatorAppVerifyController.java
+++ /dev/null
@@ -1,196 +0,0 @@
-/**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package it.infn.mw.iam.authn.multi_factor_authentication.authenticator_app;
-
-import static it.infn.mw.iam.authn.multi_factor_authentication.MfaVerifyController.MFA_VERIFY_URL;
-
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.List;
-import java.util.Set;
-
-import javax.validation.Valid;
-
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.http.HttpStatus;
-import org.springframework.security.access.prepost.PreAuthorize;
-import org.springframework.security.authentication.AuthenticationEventPublisher;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.core.AuthenticationException;
-import org.springframework.security.core.GrantedAuthority;
-import org.springframework.security.core.authority.SimpleGrantedAuthority;
-import org.springframework.security.core.context.SecurityContext;
-import org.springframework.security.core.context.SecurityContextHolder;
-import org.springframework.stereotype.Controller;
-import org.springframework.validation.BindingResult;
-import org.springframework.web.bind.annotation.ExceptionHandler;
-import org.springframework.web.bind.annotation.ModelAttribute;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RequestMethod;
-import org.springframework.web.bind.annotation.ResponseBody;
-import org.springframework.web.bind.annotation.ResponseStatus;
-import org.springframework.web.servlet.mvc.support.RedirectAttributes;
-
-import dev.samstevens.totp.code.CodeVerifier;
-import it.infn.mw.iam.api.account.AccountUtils;
-import it.infn.mw.iam.api.account.multi_factor_authentication.authenticator_app.CodeDTO;
-import it.infn.mw.iam.api.common.ErrorDTO;
-import it.infn.mw.iam.authn.multi_factor_authentication.error.MultiFactorAuthenticationError;
-import it.infn.mw.iam.core.ExtendedAuthenticationToken;
-import it.infn.mw.iam.persistence.model.IamAccount;
-import it.infn.mw.iam.persistence.model.IamTotpRecoveryCode;
-
-@Controller
-public class AuthenticatorAppVerifyController {
-
-  public static final String VERIFY_CODE_URL = MFA_VERIFY_URL + "/authenticator-app/code";
-  public static final String VERIFY_RECOVERY_CODE_URL =
-      MFA_VERIFY_URL + "/authenticator-app/recovery-code";
-
-  private final AccountUtils accountUtils;
-  private final CodeVerifier codeVerifier;
-  private final AuthenticationEventPublisher eventPublisher;
-
-  // TODO - step up authentication page can't read SPRING_SECURITY_LAST_EXCEPTION.message to display
-  // "Bad code" error. Fix this and use
-  // ExternalAuthenticationHandlerSupport.saveAuthenticationErrorInSession() as a reference
-
-  @Autowired
-  public AuthenticatorAppVerifyController(AccountUtils accountUtils, CodeVerifier codeVerifier,
-      AuthenticationEventPublisher eventPublisher) {
-    this.accountUtils = accountUtils;
-    this.codeVerifier = codeVerifier;
-    this.eventPublisher = eventPublisher;
-  }
-
-  private void authenticationSuccessEvent(Authentication authentication) {
-    eventPublisher.publishAuthenticationSuccess(authentication);
-  }
-
-  private void authenticationFailureEvent(AuthenticationException exception,
-      Authentication authentication) {
-    eventPublisher.publishAuthenticationFailure(exception, authentication);
-  }
-
-  @PreAuthorize("hasRole('PRE_AUTHENTICATED')")
-  @RequestMapping(method = RequestMethod.POST, path = VERIFY_CODE_URL)
-  public String verifyCode(@ModelAttribute @Valid CodeDTO code, BindingResult validationResult,
-      Authentication authentication, RedirectAttributes redirectAttributes) {
-    if (validationResult.hasErrors()) {
-      MultiFactorAuthenticationError error = new MultiFactorAuthenticationError("Bad MFA code");
-      authenticationFailureEvent(error, authentication);
-      redirectAttributes.addAttribute("error", "failure");
-      return "redirect:/iam/verify";
-    }
-
-    IamAccount account = accountUtils.getAuthenticatedUserAccount()
-      .orElseThrow(() -> new MultiFactorAuthenticationError("Account not found"));
-
-    if (!codeVerifier.isValidCode(account.getTotpMfa().getSecret(), code.getCode())) {
-      MultiFactorAuthenticationError error = new MultiFactorAuthenticationError("Bad MFA code");
-      authenticationFailureEvent(error, authentication);
-      redirectAttributes.addAttribute("error", "failure");
-      return "redirect:/iam/verify";
-    }
-
-    SecurityContext sc = SecurityContextHolder.getContext();
-    ExtendedAuthenticationToken currentAuth = (ExtendedAuthenticationToken) sc.getAuthentication();
-
-    List currentAuthorities = new ArrayList<>();
-    for (GrantedAuthority authority : authentication.getAuthorities()) {
-      currentAuthorities.add(new SimpleGrantedAuthority(authority.getAuthority()));
-    }
-    currentAuthorities.remove(new SimpleGrantedAuthority("ROLE_PRE_AUTHENTICATED"));
-
-    account.getAuthorities()
-      .stream()
-      .forEach(authority -> currentAuthorities
-        .add(new SimpleGrantedAuthority(authority.getAuthority())));
-
-    ExtendedAuthenticationToken newAuth =
-        new ExtendedAuthenticationToken(currentAuth.getPrincipal(), currentAuth.getCredentials(),
-            currentAuthorities, currentAuth.getAuthenticationMethodReferences());
-    newAuth.setAuthenticated(true);
-    sc.setAuthentication(newAuth);
-
-    // TODO touch account, i.e. log the successful verification
-
-    authenticationSuccessEvent(newAuth);
-
-    return "redirect:/dashboard";
-  }
-
-  @PreAuthorize("hasRole('PRE_AUTHENTICATED')")
-  @RequestMapping(method = RequestMethod.POST, path = VERIFY_RECOVERY_CODE_URL)
-  public String verifyRecoveryCode(@ModelAttribute @Valid RecoveryCodeDTO recoveryCode,
-      BindingResult validationResult, Authentication authentication,
-      RedirectAttributes redirectAttributes) {
-    if (validationResult.hasErrors()) {
-      MultiFactorAuthenticationError error =
-          new MultiFactorAuthenticationError("Bad recovery code");
-      authenticationFailureEvent(error, authentication);
-      redirectAttributes.addAttribute("error", "failure");
-      return "redirect:/iam/verify";
-    }
-
-    IamAccount account = accountUtils.getAuthenticatedUserAccount()
-      .orElseThrow(() -> new MultiFactorAuthenticationError("Account not found"));
-
-    Set accountRecoveryCodes = account.getTotpMfa().getRecoveryCodes();
-    if (!isValidRecoveryCode(accountRecoveryCodes, recoveryCode.getRecoveryCode())) {
-      MultiFactorAuthenticationError error =
-          new MultiFactorAuthenticationError("Bad recovery code");
-      authenticationFailureEvent(error, authentication);
-      redirectAttributes.addAttribute("error", "failure");
-      return "redirect:/iam/verify";
-    }
-
-    SecurityContext sc = SecurityContextHolder.getContext();
-    ExtendedAuthenticationToken currentAuth = (ExtendedAuthenticationToken) sc.getAuthentication();
-    List updatedAuthorities =
-        new ArrayList<>(Arrays.asList(new SimpleGrantedAuthority("ROLE_USER")));
-
-    ExtendedAuthenticationToken newAuth =
-        new ExtendedAuthenticationToken(currentAuth.getPrincipal(), currentAuth.getCredentials(),
-            updatedAuthorities, currentAuth.getAuthenticationMethodReferences());
-    sc.setAuthentication(newAuth);
-
-    // TODO touch account, i.e. log the successful verification
-
-    authenticationSuccessEvent(newAuth);
-
-    return "redirect:/iam/authenticator-app/recovery-code/reset";
-  }
-
-  @ResponseStatus(code = HttpStatus.BAD_REQUEST)
-  @ExceptionHandler(MultiFactorAuthenticationError.class)
-  @ResponseBody
-  public ErrorDTO handleMultiFactorAuthenticationError(MultiFactorAuthenticationError e) {
-    return ErrorDTO.fromString(e.getMessage());
-  }
-
-  private boolean isValidRecoveryCode(Set accountRecoveryCodes,
-      String inputRecoveryCode) {
-    for (IamTotpRecoveryCode recoveryCodeObject : accountRecoveryCodes) {
-      String currentRecoveryCode = recoveryCodeObject.getCode();
-      if (currentRecoveryCode.equals(inputRecoveryCode)) {
-        return true;
-      }
-    }
-
-    return false;
-  }
-}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/RecoveryCodeDTO.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/RecoveryCodeDTO.java
deleted file mode 100644
index 46f5ee87e..000000000
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/RecoveryCodeDTO.java
+++ /dev/null
@@ -1,44 +0,0 @@
-/**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package it.infn.mw.iam.authn.multi_factor_authentication.authenticator_app;
-
-import javax.validation.constraints.NotEmpty;
-
-/**
- * DTO containing a recovery code for MFA secrets
- */
-public class RecoveryCodeDTO {
-
-  @NotEmpty(message = "Recovery code cannot be empty")
-  private String recoveryCode;
-
-
-  /**
-   * @return the recoveryCode
-   */
-  public String getRecoveryCode() {
-    return recoveryCode;
-  }
-
-
-  /**
-   * @param recoveryCode new recoveryCode
-   * @return nothing
-   */
-  public void setRecoveryCode(final String recoveryCode) {
-    this.recoveryCode = recoveryCode;
-  }
-}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/IamTotpMfaConfig.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/IamTotpMfaConfig.java
index 5d6533699..d01efe2fc 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/IamTotpMfaConfig.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/IamTotpMfaConfig.java
@@ -15,19 +15,34 @@
  */
 package it.infn.mw.iam.config;
 
+import java.util.Arrays;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Qualifier;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.authentication.AuthenticationManager;
+import org.springframework.security.authentication.ProviderManager;
+import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
+import org.springframework.security.web.savedrequest.HttpSessionRequestCache;
+
 import dev.samstevens.totp.code.CodeVerifier;
 import dev.samstevens.totp.code.DefaultCodeGenerator;
 import dev.samstevens.totp.code.DefaultCodeVerifier;
 import dev.samstevens.totp.qr.QrGenerator;
 import dev.samstevens.totp.qr.ZxingPngQrGenerator;
 import dev.samstevens.totp.recovery.RecoveryCodeGenerator;
-import dev.samstevens.totp.time.SystemTimeProvider;
-import org.springframework.beans.factory.annotation.Qualifier;
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-
 import dev.samstevens.totp.secret.DefaultSecretGenerator;
 import dev.samstevens.totp.secret.SecretGenerator;
+import dev.samstevens.totp.time.SystemTimeProvider;
+import it.infn.mw.iam.api.account.AccountUtils;
+import it.infn.mw.iam.api.aup.AUPSignatureCheckService;
+import it.infn.mw.iam.authn.EnforceAupSignatureSuccessHandler;
+import it.infn.mw.iam.authn.RootIsDashboardSuccessHandler;
+import it.infn.mw.iam.authn.multi_factor_authentication.MultiFactorCodeCheckProvider;
+import it.infn.mw.iam.authn.multi_factor_authentication.MultiFactorVerificationFilter;
+import it.infn.mw.iam.persistence.repository.IamAccountRepository;
 
 // TODO add admin config options from properties file
 
@@ -37,6 +52,17 @@
 @Configuration
 public class IamTotpMfaConfig {
 
+  @Value("${iam.baseUrl}")
+  private String iamBaseUrl;
+
+  @Autowired
+  private IamAccountRepository accountRepo;
+
+  @Autowired
+  private AUPSignatureCheckService aupSignatureCheckService;
+
+  @Autowired
+  private AccountUtils accountUtils;
 
   /**
    * Responsible for generating new TOTP secrets
@@ -85,4 +111,35 @@ public CodeVerifier codeVerifier() {
   public RecoveryCodeGenerator recoveryCodeGenerator() {
     return new RecoveryCodeGenerator();
   }
+
+  @Bean(name = "MultiFactorVerificationFilter")
+  public MultiFactorVerificationFilter multiFactorVerificationFilter(
+      @Qualifier("MultiFactorVerificationAuthenticationManager") AuthenticationManager authenticationManager,
+      @Qualifier("MultiFactorVerificationSuccessHandler") AuthenticationSuccessHandler authenticationSuccessHandler) {
+
+    MultiFactorVerificationFilter filter = new MultiFactorVerificationFilter(authenticationManager);
+    filter.setAuthenticationSuccessHandler(authenticationSuccessHandler);
+
+    return filter;
+  }
+
+  @Bean(name = "MultiFactorVerificationAuthenticationManager")
+  public AuthenticationManager authenticationManager(
+      MultiFactorCodeCheckProvider codeCheckProvider) {
+    return new ProviderManager(Arrays.asList(codeCheckProvider));
+  }
+
+  @Bean(name = "MultiFactorVerificationSuccessHandler")
+  public AuthenticationSuccessHandler successHandler() {
+    AuthenticationSuccessHandler delegate =
+        new RootIsDashboardSuccessHandler(iamBaseUrl, new HttpSessionRequestCache());
+
+    return new EnforceAupSignatureSuccessHandler(delegate, aupSignatureCheckService, accountUtils,
+        accountRepo);
+  }
+
+  @Bean
+  public MultiFactorCodeCheckProvider codeCheckProvider(CodeVerifier codeVerifier) {
+    return new MultiFactorCodeCheckProvider(accountRepo, codeVerifier);
+  }
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java
index f2c09804d..6298df676 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java
@@ -59,6 +59,7 @@
 import it.infn.mw.iam.authn.multi_factor_authentication.ExtendedAuthenticationFilter;
 import it.infn.mw.iam.authn.multi_factor_authentication.ExtendedHttpServletRequestFilter;
 import it.infn.mw.iam.authn.multi_factor_authentication.MultiFactorAuthenticationProvider;
+import it.infn.mw.iam.authn.multi_factor_authentication.MultiFactorVerificationFilter;
 import it.infn.mw.iam.authn.oidc.OidcAuthenticationProvider;
 import it.infn.mw.iam.authn.oidc.OidcClientFilter;
 import it.infn.mw.iam.authn.x509.IamX509AuthenticationProvider;
@@ -182,7 +183,7 @@ protected void configure(final HttpSecurity http) throws Exception {
         .and()
           .addFilterAt(new ExtendedAuthenticationFilter(this.authenticationManager(), successHandler()), UsernamePasswordAuthenticationFilter.class)
           .addFilterBefore(authorizationRequestFilter, SecurityContextPersistenceFilter.class)
-          .addFilterAfter(new ExtendedHttpServletRequestFilter(), UsernamePasswordAuthenticationFilter.class)
+          .addFilterAfter(extendedHttpServletRequestFilter(), UsernamePasswordAuthenticationFilter.class)
         .logout()
           .logoutUrl("/logout")
         .and().anonymous()
@@ -198,6 +199,11 @@ public OAuth2WebSecurityExpressionHandler oAuth2WebSecurityExpressionHandler() {
       return new OAuth2WebSecurityExpressionHandler();
     }
 
+    @Bean
+    public ExtendedHttpServletRequestFilter extendedHttpServletRequestFilter() {
+      return new ExtendedHttpServletRequestFilter();
+    }
+
     // TODO refactor this
     public AuthenticationSuccessHandler successHandler() {
       AuthenticationSuccessHandler delegate =
@@ -338,4 +344,35 @@ public void configure(final WebSecurity builder) throws Exception {
       builder.debug(true);
     }
   }
+
+  @Configuration
+  @Order(102)
+  public static class MultiFactorConfigurationAdapter extends WebSecurityConfigurerAdapter {
+
+    @Autowired
+    @Qualifier("MultiFactorVerificationFilter")
+    private MultiFactorVerificationFilter multiFactorVerificationFilter;
+
+    @Bean
+    public AuthenticationEntryPoint mfaAuthenticationEntryPoint() {
+      LoginUrlAuthenticationEntryPoint entryPoint =
+          new LoginUrlAuthenticationEntryPoint("/iam/verify");
+      return entryPoint;
+    }
+
+    @Override
+    protected void configure(HttpSecurity http) throws Exception {
+      http.antMatcher("/iam/verify**")
+        .authorizeRequests()
+        .anyRequest()
+        .hasRole("PRE_AUTHENTICATED")
+        .and()
+        .formLogin()
+        .and()
+        .exceptionHandling()
+        .authenticationEntryPoint(mfaAuthenticationEntryPoint())
+        .and()
+        .addFilterAt(multiFactorVerificationFilter, UsernamePasswordAuthenticationFilter.class);
+    }
+  }
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/ExtendedAuthenticationToken.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/ExtendedAuthenticationToken.java
index 7601a63cc..5f60ace6b 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/ExtendedAuthenticationToken.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/ExtendedAuthenticationToken.java
@@ -29,6 +29,7 @@ public class ExtendedAuthenticationToken extends AbstractAuthenticationToken {
   private final Object principal;
   private Object credentials;
   private Set authenticationMethodReferences = new HashSet<>();
+  private String code;
 
   public ExtendedAuthenticationToken(Object principal, Object credentials) {
     super(null);
@@ -60,6 +61,24 @@ public ExtendedAuthenticationToken(Object principal, Object credentials,
     this.authenticationMethodReferences = authenticationMethodReferences;
   }
 
+  public ExtendedAuthenticationToken(Object principal, Object credentials,
+      Collection authorities,
+      Set authenticationMethodReferences, String code) {
+    super(authorities);
+    this.principal = principal;
+    this.credentials = credentials;
+    this.authenticationMethodReferences = authenticationMethodReferences;
+    this.code = code;
+  }
+
+  public ExtendedAuthenticationToken(ExtendedAuthenticationToken other) {
+    super(other.getAuthorities());
+    this.principal = other.getPrincipal();
+    this.credentials = other.getCredentials();
+    this.authenticationMethodReferences = other.getAuthenticationMethodReferences();
+    this.code = other.getCode();
+  }
+
   public Set getAuthenticationMethodReferences() {
     return authenticationMethodReferences;
   }
@@ -69,6 +88,14 @@ public void setAuthenticationMethodReferences(
     this.authenticationMethodReferences = authenticationMethodReferences;
   }
 
+  public String getCode() {
+    return code;
+  }
+
+  public void setCode(String code) {
+    this.code = code;
+  }
+
   @Override
   public Object getCredentials() {
     return this.credentials;
diff --git a/iam-login-service/src/main/webapp/WEB-INF/views/iam/authenticator-app/verify-authenticator-app-form.jsp b/iam-login-service/src/main/webapp/WEB-INF/views/iam/authenticator-app/verify-authenticator-app-form.jsp
index fc6a3ee25..a93a3e773 100644
--- a/iam-login-service/src/main/webapp/WEB-INF/views/iam/authenticator-app/verify-authenticator-app-form.jsp
+++ b/iam-login-service/src/main/webapp/WEB-INF/views/iam/authenticator-app/verify-authenticator-app-form.jsp
@@ -17,7 +17,7 @@
 --%>
 
   

-    

+    
       

         For your security, please enter a code from your authenticator app
       

@@ -35,7 +35,7 @@
           value="${multiFactorVerificationPageConfiguration.verifyButtonText}" name="submit" class="form-control">
       

     
-    

+    
       

         Lost access to your authenticator app? Enter a recovery code to regain access
       


From 11cbc2c88282f59976fd00489df455334db70257 Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Fri, 25 Feb 2022 17:18:16 +0000
Subject: [PATCH 68/76] Fixing login credential failure handling

Bad credentials for the initial password-based login were failing due to a failure handler not being attached to the login filter. This was because the default UsernamePasswordAuthenticationFilter has been replaced by the ExtendedAuthenticationFilter
---
 .../ExtendedAuthenticationFilter.java         | 60 +++++++++++--
 .../MultiFactorAuthenticationProvider.java    | 90 -------------------
 .../config/security/IamWebSecurityConfig.java | 15 ++--
 .../core/IamLocalAuthenticationProvider.java  | 37 ++++++--
 4 files changed, 94 insertions(+), 108 deletions(-)
 delete mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorAuthenticationProvider.java

diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/ExtendedAuthenticationFilter.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/ExtendedAuthenticationFilter.java
index 9786074aa..f734d8886 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/ExtendedAuthenticationFilter.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/ExtendedAuthenticationFilter.java
@@ -15,6 +15,7 @@
  */
 package it.infn.mw.iam.authn.multi_factor_authentication;
 
+import javax.annotation.Nullable;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
@@ -22,8 +23,10 @@
 import org.springframework.security.authentication.AuthenticationServiceException;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.AuthenticationException;
+import org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter;
+import org.springframework.security.web.authentication.AuthenticationFailureHandler;
 import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
-import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
+import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
 
 import it.infn.mw.iam.core.ExtendedAuthenticationToken;
 
@@ -38,15 +41,26 @@
  * based on the type or quantity of authentication methods used. The authentication methods are
  * passed to the OAuth2 authorization endpoint and stored in the id_token returned to the client.
  */
-public class ExtendedAuthenticationFilter extends UsernamePasswordAuthenticationFilter {
+public class ExtendedAuthenticationFilter extends AbstractAuthenticationProcessingFilter {
+
+  public static final String SPRING_SECURITY_FORM_USERNAME_KEY = "username";
+
+  public static final String SPRING_SECURITY_FORM_PASSWORD_KEY = "password";
+
+  private static final AntPathRequestMatcher DEFAULT_ANT_PATH_REQUEST_MATCHER =
+      new AntPathRequestMatcher("/login", "POST");
+
+  private String usernameParameter = SPRING_SECURITY_FORM_USERNAME_KEY;
+
+  private String passwordParameter = SPRING_SECURITY_FORM_PASSWORD_KEY;
 
   private boolean postOnly = true;
-  private AuthenticationManager authenticationManager;
 
   public ExtendedAuthenticationFilter(AuthenticationManager authenticationManager,
-      AuthenticationSuccessHandler successHandler) {
-    this.authenticationManager = authenticationManager;
-    this.setAuthenticationSuccessHandler(successHandler);
+      AuthenticationSuccessHandler successHandler, AuthenticationFailureHandler failureHandler) {
+    super(DEFAULT_ANT_PATH_REQUEST_MATCHER, authenticationManager);
+    setAuthenticationSuccessHandler(successHandler);
+    setAuthenticationFailureHandler(failureHandler);
   }
 
   @Override
@@ -66,10 +80,42 @@ public Authentication attemptAuthentication(HttpServletRequest request,
     ExtendedAuthenticationToken authRequest = new ExtendedAuthenticationToken(username, password);
     // Allow subclasses to set the "details" property
     setDetails(request, authRequest);
-    return this.authenticationManager.authenticate(authRequest);
+    return this.getAuthenticationManager().authenticate(authRequest);
   }
 
   private void setDetails(HttpServletRequest request, ExtendedAuthenticationToken authRequest) {
     authRequest.setDetails(this.authenticationDetailsSource.buildDetails(request));
   }
+
+  /**
+   * Enables subclasses to override the composition of the password, such as by including additional
+   * values and a separator.
+   * 

+   * This might be used for example if a postcode/zipcode was required in addition to the password.
+   * A delimiter such as a pipe (|) should be used to separate the password and extended value(s).
+   * The AuthenticationDao will need to generate the expected password in a
+   * corresponding manner.
+   * 

+   * 
+   * @param request so that request attributes can be retrieved
+   * @return the password that will be presented in the Authentication request token to
+   *         the AuthenticationManager
+   */
+  @Nullable
+  protected String obtainPassword(HttpServletRequest request) {
+    return request.getParameter(this.passwordParameter);
+  }
+
+  /**
+   * Enables subclasses to override the composition of the username, such as by including additional
+   * values and a separator.
+   * 
+   * @param request so that request attributes can be retrieved
+   * @return the username that will be presented in the Authentication request token to
+   *         the AuthenticationManager
+   */
+  @Nullable
+  protected String obtainUsername(HttpServletRequest request) {
+    return request.getParameter(this.usernameParameter);
+  }
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorAuthenticationProvider.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorAuthenticationProvider.java
deleted file mode 100644
index c76c9c32b..000000000
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorAuthenticationProvider.java
+++ /dev/null
@@ -1,90 +0,0 @@
-/**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package it.infn.mw.iam.authn.multi_factor_authentication;
-
-import static it.infn.mw.iam.authn.multi_factor_authentication.IamAuthenticationMethodReference.AuthenticationMethodReferenceValues.PASSWORD;
-
-import java.util.ArrayList;
-import java.util.HashSet;
-import java.util.List;
-import java.util.Set;
-
-import org.springframework.security.authentication.AuthenticationProvider;
-import org.springframework.security.authentication.BadCredentialsException;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.core.AuthenticationException;
-import org.springframework.security.core.GrantedAuthority;
-import org.springframework.security.core.authority.SimpleGrantedAuthority;
-import org.springframework.security.crypto.password.PasswordEncoder;
-
-import it.infn.mw.iam.core.ExtendedAuthenticationToken;
-import it.infn.mw.iam.persistence.model.IamAccount;
-import it.infn.mw.iam.persistence.repository.IamAccountRepository;
-
-public class MultiFactorAuthenticationProvider implements AuthenticationProvider {
-
-  private IamAccountRepository accountRepo;
-  private PasswordEncoder passwordEncoder;
-
-  public MultiFactorAuthenticationProvider(IamAccountRepository accountRepo,
-      PasswordEncoder passwordEncoder) {
-    this.accountRepo = accountRepo;
-    this.passwordEncoder = passwordEncoder;
-  }
-
-  @Override
-  public Authentication authenticate(Authentication authentication) throws AuthenticationException {
-    if (authentication.isAuthenticated()) {
-      return authentication;
-    }
-
-    IamAccount account = accountRepo.findByUsername(authentication.getName())
-      .orElseThrow(() -> new BadCredentialsException("Invalid login details"));
-    String password = authentication.getCredentials().toString();
-    if (!passwordEncoder.matches(password, account.getPassword())) {
-      throw new BadCredentialsException("Invalid login details");
-    }
-
-    if (account.getTotpMfa() != null && account.getTotpMfa().isActive()) {
-      List currentAuthorities = new ArrayList<>();
-      for (GrantedAuthority authority : authentication.getAuthorities()) {
-        currentAuthorities.add(new SimpleGrantedAuthority(authority.getAuthority()));
-      }
-      currentAuthorities.add(new SimpleGrantedAuthority("ROLE_PRE_AUTHENTICATED"));
-
-      // Used multi-factor authentication, so add pwd and otp as methods of
-      // authentication. This ensures the amr flag is properly set in an id_token, if OIDC used. otp
-      // refers to one-time-password (this authentication provider is for authenticator apps, which
-      // use OTPs)
-      IamAuthenticationMethodReference pwd =
-          new IamAuthenticationMethodReference(PASSWORD.getValue());
-      Set refs = new HashSet<>();
-      refs.add(pwd);
-
-      ExtendedAuthenticationToken token = new ExtendedAuthenticationToken(
-          authentication.getPrincipal(), authentication.getCredentials(), currentAuthorities, refs);
-      token.setAuthenticated(false);
-      return token;
-    }
-
-    return null;
-  }
-
-  @Override
-  public boolean supports(Class authentication) {
-    return authentication.equals(ExtendedAuthenticationToken.class);
-  }
-}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java
index 6298df676..930ae2cf8 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java
@@ -41,8 +41,10 @@
 import org.springframework.security.oauth2.provider.expression.OAuth2WebSecurityExpressionHandler;
 import org.springframework.security.web.AuthenticationEntryPoint;
 import org.springframework.security.web.access.AccessDeniedHandler;
+import org.springframework.security.web.authentication.AuthenticationFailureHandler;
 import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
 import org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint;
+import org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler;
 import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
 import org.springframework.security.web.context.SecurityContextPersistenceFilter;
 import org.springframework.security.web.savedrequest.HttpSessionRequestCache;
@@ -58,7 +60,6 @@
 import it.infn.mw.iam.authn.RootIsDashboardSuccessHandler;
 import it.infn.mw.iam.authn.multi_factor_authentication.ExtendedAuthenticationFilter;
 import it.infn.mw.iam.authn.multi_factor_authentication.ExtendedHttpServletRequestFilter;
-import it.infn.mw.iam.authn.multi_factor_authentication.MultiFactorAuthenticationProvider;
 import it.infn.mw.iam.authn.multi_factor_authentication.MultiFactorVerificationFilter;
 import it.infn.mw.iam.authn.oidc.OidcAuthenticationProvider;
 import it.infn.mw.iam.authn.oidc.OidcClientFilter;
@@ -127,8 +128,7 @@ public static class UserLoginConfig extends WebSecurityConfigurerAdapter {
     @Autowired
     public void configureGlobal(final AuthenticationManagerBuilder auth) throws Exception {
       // @formatter:off
-      auth.authenticationProvider(new MultiFactorAuthenticationProvider(accountRepo, passwordEncoder));
-      auth.authenticationProvider(new IamLocalAuthenticationProvider(iamProperties, iamUserDetailsService, passwordEncoder));
+      auth.authenticationProvider(new IamLocalAuthenticationProvider(iamProperties, iamUserDetailsService, passwordEncoder, accountRepo));
       // @formatter:on
     }
 
@@ -175,13 +175,13 @@ protected void configure(final HttpSecurity http) throws Exception {
         .and()
           .formLogin()
             .loginPage("/login")
-            .failureUrl("/login?error=failure")
+            .failureUrl("/login?error=failure") // this line and line below it now may not be used. They act upon the UsernamePasswordAuthenticationFilter, which has been replaced
             .successHandler(successHandler())
         .and()
           .exceptionHandling()
             .authenticationEntryPoint(entryPoint())
         .and()
-          .addFilterAt(new ExtendedAuthenticationFilter(this.authenticationManager(), successHandler()), UsernamePasswordAuthenticationFilter.class)
+          .addFilterAt(new ExtendedAuthenticationFilter(this.authenticationManager(), successHandler(), failureHandler()), UsernamePasswordAuthenticationFilter.class)
           .addFilterBefore(authorizationRequestFilter, SecurityContextPersistenceFilter.class)
           .addFilterAfter(extendedHttpServletRequestFilter(), UsernamePasswordAuthenticationFilter.class)
         .logout()
@@ -215,6 +215,10 @@ public AuthenticationSuccessHandler successHandler() {
       // return new EnforceAupSignatureSuccessHandler(delegate, aupSignatureCheckService,
       // accountUtils, accountRepo);
     }
+
+    public AuthenticationFailureHandler failureHandler() {
+      return new SimpleUrlAuthenticationFailureHandler("/login?error=failure");
+    }
   }
 
   @Configuration
@@ -368,6 +372,7 @@ protected void configure(HttpSecurity http) throws Exception {
         .hasRole("PRE_AUTHENTICATED")
         .and()
         .formLogin()
+        .failureUrl("/iam/verify?error=failure")
         .and()
         .exceptionHandling()
         .authenticationEntryPoint(mfaAuthenticationEntryPoint())
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/IamLocalAuthenticationProvider.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/IamLocalAuthenticationProvider.java
index b6d36d412..4b07f9bb8 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/IamLocalAuthenticationProvider.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/IamLocalAuthenticationProvider.java
@@ -17,16 +17,20 @@
 
 import static it.infn.mw.iam.authn.multi_factor_authentication.IamAuthenticationMethodReference.AuthenticationMethodReferenceValues.PASSWORD;
 
+import java.util.ArrayList;
 import java.util.HashSet;
+import java.util.List;
 import java.util.Set;
 import java.util.function.Predicate;
 
+import org.springframework.security.authentication.BadCredentialsException;
 import org.springframework.security.authentication.DisabledException;
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
 import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.AuthenticationException;
 import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.authority.SimpleGrantedAuthority;
 import org.springframework.security.core.userdetails.UserDetails;
 import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.crypto.password.PasswordEncoder;
@@ -34,21 +38,25 @@
 import it.infn.mw.iam.authn.multi_factor_authentication.IamAuthenticationMethodReference;
 import it.infn.mw.iam.config.IamProperties;
 import it.infn.mw.iam.config.IamProperties.LocalAuthenticationAllowedUsers;
+import it.infn.mw.iam.persistence.model.IamAccount;
+import it.infn.mw.iam.persistence.repository.IamAccountRepository;
 
 public class IamLocalAuthenticationProvider extends DaoAuthenticationProvider {
 
   public static final String DISABLED_AUTH_MESSAGE = "Local authentication is disabled";
 
   private final LocalAuthenticationAllowedUsers allowedUsers;
+  private final IamAccountRepository accountRepo;
 
   private static final Predicate ADMIN_MATCHER =
       a -> a.getAuthority().equals("ROLE_ADMIN");
 
   public IamLocalAuthenticationProvider(IamProperties properties, UserDetailsService uds,
-      PasswordEncoder passwordEncoder) {
+      PasswordEncoder passwordEncoder, IamAccountRepository accountRepo) {
     this.allowedUsers = properties.getLocalAuthn().getEnabledFor();
     setUserDetailsService(uds);
     setPasswordEncoder(passwordEncoder);
+    this.accountRepo = accountRepo;
   }
 
   @Override
@@ -62,16 +70,33 @@ public Authentication authenticate(Authentication authentication) throws Authent
     Set refs = new HashSet<>();
     refs.add(pwd);
 
-    ExtendedAuthenticationToken token =
-        new ExtendedAuthenticationToken(authentication.getPrincipal(),
-            authentication.getCredentials(), authentication.getAuthorities(), refs);
-    token.setAuthenticated(true);
+    IamAccount account = accountRepo.findByUsername(authentication.getName())
+      .orElseThrow(() -> new BadCredentialsException("Invalid login details"));
+
+    ExtendedAuthenticationToken token;
+
+    if (account.getTotpMfa() != null && account.getTotpMfa().isActive()) {
+      List currentAuthorities = new ArrayList<>();
+      for (GrantedAuthority authority : authentication.getAuthorities()) {
+        currentAuthorities.add(new SimpleGrantedAuthority(authority.getAuthority()));
+      }
+      currentAuthorities.add(new SimpleGrantedAuthority("ROLE_PRE_AUTHENTICATED"));
+
+      token = new ExtendedAuthenticationToken(authentication.getPrincipal(),
+          authentication.getCredentials(), currentAuthorities, refs);
+      token.setAuthenticated(false);
+    } else {
+      token = new ExtendedAuthenticationToken(authentication.getPrincipal(),
+          authentication.getCredentials(), authentication.getAuthorities(), refs);
+      token.setAuthenticated(true);
+    }
+
     return token;
   }
 
   @Override
   protected void additionalAuthenticationChecks(UserDetails userDetails,
-      UsernamePasswordAuthenticationToken authentication) {
+      UsernamePasswordAuthenticationToken authentication) throws AuthenticationException {
 
     super.additionalAuthenticationChecks(userDetails, authentication);
     if (LocalAuthenticationAllowedUsers.NONE.equals(allowedUsers)

From dc01d78eec671b039faa79f9614d087cfa09b96a Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Fri, 25 Feb 2022 18:02:03 +0000
Subject: [PATCH 69/76] Fixing TOTP verification process

Incorrect setting of failure handlers and handling of errors in general meant incorrect TOTPs would cause a crash. Incorrect codes now redirect back to the /verify endpoint in the same way as a failed credential check would redirect back to the /login endpoint
---
 .../MultiFactorCodeCheckProvider.java         | 61 ++++++-------
 .../MultiFactorVerificationFilter.java        | 85 ++++++-------------
 .../infn/mw/iam/config/IamTotpMfaConfig.java  | 14 +--
 3 files changed, 60 insertions(+), 100 deletions(-)

diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorCodeCheckProvider.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorCodeCheckProvider.java
index 5d9060c9c..104679fc0 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorCodeCheckProvider.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorCodeCheckProvider.java
@@ -31,7 +31,6 @@
 import dev.samstevens.totp.code.CodeVerifier;
 import it.infn.mw.iam.core.ExtendedAuthenticationToken;
 import it.infn.mw.iam.persistence.model.IamAccount;
-import it.infn.mw.iam.persistence.model.IamTotpMfa;
 import it.infn.mw.iam.persistence.repository.IamAccountRepository;
 
 public class MultiFactorCodeCheckProvider implements AuthenticationProvider {
@@ -46,47 +45,39 @@ public MultiFactorCodeCheckProvider(IamAccountRepository accountRepo, CodeVerifi
 
   @Override
   public Authentication authenticate(Authentication authentication) throws AuthenticationException {
-    if (authentication.isAuthenticated()) {
-      return authentication;
-    }
-
     ExtendedAuthenticationToken token = (ExtendedAuthenticationToken) authentication;
-    String code = token.getCode();
 
     IamAccount account = accountRepo.findByUsername(authentication.getName())
       .orElseThrow(() -> new BadCredentialsException("Invalid login details"));
 
-    IamTotpMfa totpMfa = account.getTotpMfa();
-
-    if (code != null && totpMfa != null && totpMfa.isActive()) {
-      if (codeVerifier.isValidCode(totpMfa.getSecret(), code)) {
-        IamAuthenticationMethodReference otp =
-            new IamAuthenticationMethodReference(ONE_TIME_PASSWORD.getValue());
-        Set refs = token.getAuthenticationMethodReferences();
-        refs.add(otp);
-        token.setAuthenticationMethodReferences(refs);
-        token.setAuthenticated(true);
-
-        List authorities = new ArrayList<>();
-        for (GrantedAuthority authority : authentication.getAuthorities()) {
-          authorities.add(new SimpleGrantedAuthority(authority.getAuthority()));
-        }
-        authorities.remove(new SimpleGrantedAuthority("ROLE_PRE_AUTHENTICATED"));
-
-        account.getAuthorities()
-          .stream()
-          .forEach(
-              authority -> authorities.add(new SimpleGrantedAuthority(authority.getAuthority())));
-
-        ExtendedAuthenticationToken newToken = new ExtendedAuthenticationToken(token.getPrincipal(),
-            token.getCredentials(), authorities, token.getAuthenticationMethodReferences());
-        newToken.setAuthenticated(true);
-
-        return newToken;
-      }
+    String mfaSecret = account.getTotpMfa().getSecret();
+    String code = token.getCode();
+
+    if (!codeVerifier.isValidCode(mfaSecret, code)) {
+      throw new BadCredentialsException("Bad code");
     }
 
-    return null;
+    IamAuthenticationMethodReference otp =
+        new IamAuthenticationMethodReference(ONE_TIME_PASSWORD.getValue());
+    Set refs = token.getAuthenticationMethodReferences();
+    refs.add(otp);
+    token.setAuthenticationMethodReferences(refs);
+
+    List authorities = new ArrayList<>();
+    for (GrantedAuthority authority : authentication.getAuthorities()) {
+      authorities.add(new SimpleGrantedAuthority(authority.getAuthority()));
+    }
+    authorities.remove(new SimpleGrantedAuthority("ROLE_PRE_AUTHENTICATED"));
+
+    account.getAuthorities()
+      .stream()
+      .forEach(authority -> authorities.add(new SimpleGrantedAuthority(authority.getAuthority())));
+
+    ExtendedAuthenticationToken newToken = new ExtendedAuthenticationToken(token.getPrincipal(),
+        token.getCredentials(), authorities, token.getAuthenticationMethodReferences());
+    newToken.setAuthenticated(true);
+
+    return newToken;
   }
 
   @Override
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorVerificationFilter.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorVerificationFilter.java
index 6e84db688..1ff2a10eb 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorVerificationFilter.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorVerificationFilter.java
@@ -16,12 +16,8 @@
 package it.infn.mw.iam.authn.multi_factor_authentication;
 
 import java.io.IOException;
-import java.util.Collection;
 
-import javax.servlet.FilterChain;
 import javax.servlet.ServletException;
-import javax.servlet.ServletRequest;
-import javax.servlet.ServletResponse;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
@@ -29,10 +25,11 @@
 import org.springframework.security.authentication.AuthenticationServiceException;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.AuthenticationException;
-import org.springframework.security.core.GrantedAuthority;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter;
+import org.springframework.security.web.authentication.AuthenticationFailureHandler;
 import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
+import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
 
 import it.infn.mw.iam.core.ExtendedAuthenticationToken;
 
@@ -41,61 +38,18 @@ public class MultiFactorVerificationFilter extends AbstractAuthenticationProcess
   public static final String TOTP_MFA_CODE_KEY = "code";
   public static final String MULTI_FACTOR_VERIFIED = "MULTI_FACTOR_VERIFIED";
 
+  private static final AntPathRequestMatcher DEFAULT_ANT_PATH_REQUEST_MATCHER =
+      new AntPathRequestMatcher("/iam/verify", "POST");
+
   private final boolean postOnly = true;
-  private AuthenticationManager authenticationManager;
 
-  private ExtendedAuthenticationToken token;
   private String codeParameter = TOTP_MFA_CODE_KEY;
-  private AuthenticationSuccessHandler authenticationSuccessHandler;
-
-  public MultiFactorVerificationFilter(AuthenticationManager authenticationManager) {
-    super("/iam/verify", authenticationManager);
-    this.authenticationManager = authenticationManager;
-  }
 
-  public void setAuthenticationSuccessHandler(
-      AuthenticationSuccessHandler authenticationSuccessHandler) {
-    this.authenticationSuccessHandler = authenticationSuccessHandler;
-  }
-
-  @Override
-  public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
-      throws IOException, ServletException {
-    Object multiFactorVerifiedAttribute = request.getAttribute(MULTI_FACTOR_VERIFIED);
-
-    if (multiFactorVerifiedAttribute == null) {
-      HttpServletRequest httpServletRequest = (HttpServletRequest) request;
-      if (httpServletRequest.getMethod().equals("POST")
-          && httpServletRequest.getRequestURI().equals("/iam/verify")) {
-        Authentication auth = SecurityContextHolder.getContext().getAuthentication();
-
-        if (auth instanceof ExtendedAuthenticationToken && isMfaEnabled(auth)) {
-          token = (ExtendedAuthenticationToken) auth;
-          HttpServletResponse httpServletResponse = (HttpServletResponse) response;
-
-          Authentication newAuth = attemptAuthentication(httpServletRequest, httpServletResponse);
-          SecurityContextHolder.getContext().setAuthentication(newAuth);
-
-          request.setAttribute(MULTI_FACTOR_VERIFIED, Boolean.TRUE);
-          authenticationSuccessHandler.onAuthenticationSuccess(httpServletRequest,
-              httpServletResponse, newAuth);
-        }
-      }
-    }
-
-    chain.doFilter(request, response);
-  }
-
-  private boolean isMfaEnabled(final Authentication authentication) {
-    final Collection authorities = authentication.getAuthorities();
-    for (final GrantedAuthority grantedAuthority : authorities) {
-      String authorityName = grantedAuthority.getAuthority();
-      if (authorityName.equals("ROLE_PRE_AUTHENTICATED")) {
-        return true;
-      }
-    }
-
-    return false;
+  public MultiFactorVerificationFilter(AuthenticationManager authenticationManager,
+      AuthenticationSuccessHandler successHandler, AuthenticationFailureHandler failureHandler) {
+    super(DEFAULT_ANT_PATH_REQUEST_MATCHER, authenticationManager);
+    setAuthenticationSuccessHandler(successHandler);
+    setAuthenticationFailureHandler(failureHandler);
   }
 
   @Override
@@ -106,17 +60,28 @@ public Authentication attemptAuthentication(HttpServletRequest request,
           "Authentication method not supported: " + request.getMethod());
     }
 
-    if (this.token == null) {
-      return null;
+    Authentication auth = SecurityContextHolder.getContext().getAuthentication();
+    if (auth == null || !(auth instanceof ExtendedAuthenticationToken)) {
+      throw new AuthenticationServiceException("Bad authentication");
     }
 
     String code = request.getParameter(this.codeParameter);
     code = (code != null) ? code : "";
     code = code.trim();
 
-    ExtendedAuthenticationToken authRequest = new ExtendedAuthenticationToken(this.token);
+    ExtendedAuthenticationToken authRequest = (ExtendedAuthenticationToken) auth;
     authRequest.setCode(code);
 
-    return this.authenticationManager.authenticate(authRequest);
+    return this.getAuthenticationManager().authenticate(authRequest);
+  }
+
+  @Override
+  protected void unsuccessfulAuthentication(HttpServletRequest request,
+      HttpServletResponse response, AuthenticationException failed)
+      throws IOException, ServletException {
+    this.logger.trace("Failed to process authentication request", failed);
+    this.logger.trace("Handling authentication failure");
+    this.getRememberMeServices().loginFail(request, response);
+    this.getFailureHandler().onAuthenticationFailure(request, response, failed);
   }
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/IamTotpMfaConfig.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/IamTotpMfaConfig.java
index d01efe2fc..fa8b5d929 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/IamTotpMfaConfig.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/IamTotpMfaConfig.java
@@ -24,7 +24,9 @@
 import org.springframework.context.annotation.Configuration;
 import org.springframework.security.authentication.AuthenticationManager;
 import org.springframework.security.authentication.ProviderManager;
+import org.springframework.security.web.authentication.AuthenticationFailureHandler;
 import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
+import org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler;
 import org.springframework.security.web.savedrequest.HttpSessionRequestCache;
 
 import dev.samstevens.totp.code.CodeVerifier;
@@ -114,11 +116,10 @@ public RecoveryCodeGenerator recoveryCodeGenerator() {
 
   @Bean(name = "MultiFactorVerificationFilter")
   public MultiFactorVerificationFilter multiFactorVerificationFilter(
-      @Qualifier("MultiFactorVerificationAuthenticationManager") AuthenticationManager authenticationManager,
-      @Qualifier("MultiFactorVerificationSuccessHandler") AuthenticationSuccessHandler authenticationSuccessHandler) {
+      @Qualifier("MultiFactorVerificationAuthenticationManager") AuthenticationManager authenticationManager) {
 
-    MultiFactorVerificationFilter filter = new MultiFactorVerificationFilter(authenticationManager);
-    filter.setAuthenticationSuccessHandler(authenticationSuccessHandler);
+    MultiFactorVerificationFilter filter = new MultiFactorVerificationFilter(authenticationManager,
+        successHandler(), failureHandler());
 
     return filter;
   }
@@ -129,7 +130,6 @@ public AuthenticationManager authenticationManager(
     return new ProviderManager(Arrays.asList(codeCheckProvider));
   }
 
-  @Bean(name = "MultiFactorVerificationSuccessHandler")
   public AuthenticationSuccessHandler successHandler() {
     AuthenticationSuccessHandler delegate =
         new RootIsDashboardSuccessHandler(iamBaseUrl, new HttpSessionRequestCache());
@@ -138,6 +138,10 @@ public AuthenticationSuccessHandler successHandler() {
         accountRepo);
   }
 
+  public AuthenticationFailureHandler failureHandler() {
+    return new SimpleUrlAuthenticationFailureHandler("/iam/verify?error=failure");
+  }
+
   @Bean
   public MultiFactorCodeCheckProvider codeCheckProvider(CodeVerifier codeVerifier) {
     return new MultiFactorCodeCheckProvider(accountRepo, codeVerifier);

From a231f5e36abf858881517ceef89e47164e1148f3 Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Fri, 4 Mar 2022 15:48:09 +0000
Subject: [PATCH 70/76] Adding recovery code verification to login flow

This currently allows the user, having entered a code, to choose whether or not to reset their recovery codes.
---
 .../DefaultRecoveryCodeResetService.java      |  72 ++++++++++
 .../RecoveryCodeResetService.java             |  23 ++++
 ...ckMultiFactorIsEnabledSuccessHandler.java} |  87 +++---------
 .../MultiFactorRecoveryCodeCheckProvider.java |  95 +++++++++++++
 ...java => MultiFactorTotpCheckProvider.java} |  24 ++--
 .../MultiFactorVerificationFilter.java        |  49 +++++--
 ...MultiFactorVerificationSuccessHandler.java |  89 ++++++++++++
 .../ResetOrSkipRecoveryCodesFilter.java       | 127 ++++++++++++++++++
 .../ViewRecoveryCodesFilter.java              | 100 ++++++++++++++
 .../RecoveryCodeManagementController.java     |  68 ++++------
 .../error/NoMultiFactorSecretError.java       |  25 ++++
 .../infn/mw/iam/config/IamTotpMfaConfig.java  |  49 +++++--
 .../config/security/IamWebSecurityConfig.java |  60 +++++++--
 .../iam/core/ExtendedAuthenticationToken.java |  32 ++---
 .../authenticator-app/recovery-code/reset.jsp |   4 +-
 .../authenticator-app/recovery-code/view.jsp  |   4 +-
 .../verify-authenticator-app-form.jsp         |   4 +-
 17 files changed, 732 insertions(+), 180 deletions(-)
 create mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/DefaultRecoveryCodeResetService.java
 create mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/RecoveryCodeResetService.java
 rename iam-login-service/src/main/java/it/infn/mw/iam/authn/{MultiFactorAuthenticationSuccessHandler.java => CheckMultiFactorIsEnabledSuccessHandler.java} (51%)
 create mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorRecoveryCodeCheckProvider.java
 rename iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/{MultiFactorCodeCheckProvider.java => MultiFactorTotpCheckProvider.java} (85%)
 create mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorVerificationSuccessHandler.java
 create mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/ResetOrSkipRecoveryCodesFilter.java
 create mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/ViewRecoveryCodesFilter.java
 create mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/error/NoMultiFactorSecretError.java

diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/DefaultRecoveryCodeResetService.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/DefaultRecoveryCodeResetService.java
new file mode 100644
index 000000000..d25f454f6
--- /dev/null
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/DefaultRecoveryCodeResetService.java
@@ -0,0 +1,72 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.infn.mw.iam.api.account.multi_factor_authentication.authenticator_app;
+
+import java.util.HashSet;
+import java.util.Set;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.ApplicationEventPublisher;
+import org.springframework.context.ApplicationEventPublisherAware;
+import org.springframework.stereotype.Service;
+
+import dev.samstevens.totp.recovery.RecoveryCodeGenerator;
+import it.infn.mw.iam.audit.events.account.multi_factor_authentication.RecoveryCodesResetEvent;
+import it.infn.mw.iam.persistence.model.IamAccount;
+import it.infn.mw.iam.persistence.model.IamTotpMfa;
+import it.infn.mw.iam.persistence.model.IamTotpRecoveryCode;
+import it.infn.mw.iam.persistence.repository.IamAccountRepository;
+
+@Service
+public class DefaultRecoveryCodeResetService
+    implements RecoveryCodeResetService, ApplicationEventPublisherAware {
+
+  private final IamAccountRepository accountRepository;
+  private final RecoveryCodeGenerator recoveryCodeGenerator;
+  private ApplicationEventPublisher eventPublisher;
+
+  @Autowired
+  public DefaultRecoveryCodeResetService(IamAccountRepository accountRepository,
+      RecoveryCodeGenerator recoveryCodeGenerator) {
+    this.accountRepository = accountRepository;
+    this.recoveryCodeGenerator = recoveryCodeGenerator;
+  }
+
+  @Override
+  public void setApplicationEventPublisher(ApplicationEventPublisher applicationEventPublisher) {
+    this.eventPublisher = applicationEventPublisher;
+  }
+
+  @Override
+  public void resetRecoveryCodes(IamAccount account) {
+    IamTotpMfa totpMfa = account.getTotpMfa();
+    String[] recoveryCodeStrings = recoveryCodeGenerator.generateCodes(6);
+    Set recoveryCodes = new HashSet<>();
+    for (String code : recoveryCodeStrings) {
+      IamTotpRecoveryCode recoveryCode = new IamTotpRecoveryCode(totpMfa);
+      recoveryCode.setCode(code);
+      recoveryCodes.add(recoveryCode);
+    }
+
+    // Attach to account
+    totpMfa.setRecoveryCodes(recoveryCodes);
+    totpMfa.touch();
+    account.touch();
+    accountRepository.save(account);
+    eventPublisher.publishEvent(new RecoveryCodesResetEvent(this, account));
+  }
+
+}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/RecoveryCodeResetService.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/RecoveryCodeResetService.java
new file mode 100644
index 000000000..4d2680f45
--- /dev/null
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/RecoveryCodeResetService.java
@@ -0,0 +1,23 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.infn.mw.iam.api.account.multi_factor_authentication.authenticator_app;
+
+import it.infn.mw.iam.persistence.model.IamAccount;
+
+public interface RecoveryCodeResetService {
+
+  public void resetRecoveryCodes(IamAccount account);
+}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/MultiFactorAuthenticationSuccessHandler.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/CheckMultiFactorIsEnabledSuccessHandler.java
similarity index 51%
rename from iam-login-service/src/main/java/it/infn/mw/iam/authn/MultiFactorAuthenticationSuccessHandler.java
rename to iam-login-service/src/main/java/it/infn/mw/iam/authn/CheckMultiFactorIsEnabledSuccessHandler.java
index 865937c39..b4b23ae14 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/MultiFactorAuthenticationSuccessHandler.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/CheckMultiFactorIsEnabledSuccessHandler.java
@@ -15,51 +15,37 @@
  */
 package it.infn.mw.iam.authn;
 
-import static it.infn.mw.iam.core.web.aup.EnforceAupFilter.REQUESTING_SIGNATURE;
 import static it.infn.mw.iam.authn.multi_factor_authentication.MfaVerifyController.MFA_VERIFY_URL;
 
 import java.io.IOException;
 import java.util.Collection;
-import java.util.Date;
-import java.util.Optional;
 
 import javax.servlet.ServletException;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import javax.servlet.http.HttpSession;
 
-import org.mitre.openid.connect.web.AuthenticationTimeStamper;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.GrantedAuthority;
-import org.springframework.security.oauth2.provider.OAuth2Authentication;
+import org.springframework.security.web.WebAttributes;
 import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
-// import org.springframework.security.web.savedrequest.RequestCache;
+import org.springframework.security.web.savedrequest.HttpSessionRequestCache;
 
 import it.infn.mw.iam.api.account.AccountUtils;
 import it.infn.mw.iam.api.aup.AUPSignatureCheckService;
-import it.infn.mw.iam.core.util.IamAuthenticationLogger;
-import it.infn.mw.iam.persistence.model.IamAccount;
 import it.infn.mw.iam.persistence.repository.IamAccountRepository;
 
-@SuppressWarnings("deprecation")
-public class MultiFactorAuthenticationSuccessHandler implements AuthenticationSuccessHandler {
+public class CheckMultiFactorIsEnabledSuccessHandler implements AuthenticationSuccessHandler {
 
   private final AccountUtils accountUtils;
-  private final AuthenticationSuccessHandler rootIsDashboardSuccessHandler;
-  // private final String iamBaseUrl;
-  // private final RequestCache requestCache;
-  // private final EnforceAupSignatureSuccessHandler enforceAupSignatureSuccessHandler;
+  private final String iamBaseUrl;
   private final AUPSignatureCheckService aupSignatureCheckService;
   private final IamAccountRepository accountRepo;
 
-  public MultiFactorAuthenticationSuccessHandler(AccountUtils accountUtils,
-      AuthenticationSuccessHandler delegate, AUPSignatureCheckService aupSignatureCheckService,
-      IamAccountRepository accountRepo) {
+  public CheckMultiFactorIsEnabledSuccessHandler(AccountUtils accountUtils, String iamBaseUrl,
+      AUPSignatureCheckService aupSignatureCheckService, IamAccountRepository accountRepo) {
     this.accountUtils = accountUtils;
-    this.rootIsDashboardSuccessHandler = delegate;
-    // this.iamBaseUrl = iamBaseUrl;
-    // this.requestCache = requestCache;
-    // this.enforceAupSignatureSuccessHandler = enforceAupSignatureSuccessHandler;
+    this.iamBaseUrl = iamBaseUrl;
     this.aupSignatureCheckService = aupSignatureCheckService;
     this.accountRepo = accountRepo;
   }
@@ -68,6 +54,7 @@ public MultiFactorAuthenticationSuccessHandler(AccountUtils accountUtils,
   public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response,
       Authentication authentication) throws IOException, ServletException {
     handle(request, response, authentication);
+    clearAuthenticationAttributes(request);
   }
 
   protected void handle(HttpServletRequest request, HttpServletResponse response,
@@ -95,61 +82,25 @@ protected boolean isMfaEnabled(final Authentication authentication) {
       }
     }
 
-    // throw new IllegalStateException();
     return false;
   }
 
-  public void continueWithDefaultSuccessHandler(HttpServletRequest request,
+  protected void continueWithDefaultSuccessHandler(HttpServletRequest request,
       HttpServletResponse response, Authentication auth) throws IOException, ServletException {
-    HttpSession session = request.getSession(false);
-
-    setAuthenticationTimestamp(request, auth);
-    touchLastLoginTimeForIamAccount(auth);
-
-    Optional authenticatedAccount = lookupAuthenticatedUser(auth);
-
-    if (!authenticatedAccount.isPresent()
-        || !aupSignatureCheckService.needsAupSignature(authenticatedAccount.get())) {
-      rootIsDashboardSuccessHandler.onAuthenticationSuccess(request, response, auth);
-
-    } else {
-      session.setAttribute(REQUESTING_SIGNATURE, true);
-      response.sendRedirect("/iam/aup/sign");
-    }
-  }
-
-  protected void setAuthenticationTimestamp(HttpServletRequest request,
-      Authentication authentication) {
-
-    Date timestamp = new Date();
-    HttpSession session = request.getSession();
-    session.setAttribute(AuthenticationTimeStamper.AUTH_TIMESTAMP, timestamp);
-    IamAuthenticationLogger.INSTANCE.logAuthenticationSuccess(authentication);
-  }
 
-  protected void touchLastLoginTimeForIamAccount(Authentication authentication) {
+    AuthenticationSuccessHandler delegate =
+        new RootIsDashboardSuccessHandler(iamBaseUrl, new HttpSessionRequestCache());
 
-    resolveUserAuthentication(authentication)
-      .ifPresent(a -> accountRepo.touchLastLoginTimeForUserWithUsername(a.getName()));
+    EnforceAupSignatureSuccessHandler handler = new EnforceAupSignatureSuccessHandler(delegate,
+        aupSignatureCheckService, accountUtils, accountRepo);
+    handler.onAuthenticationSuccess(request, response, auth);
   }
 
-  private Optional resolveUserAuthentication(Authentication auth) {
-    if (auth instanceof OAuth2Authentication) {
-      OAuth2Authentication oauth = (OAuth2Authentication) auth;
-      return Optional.ofNullable(oauth.getUserAuthentication());
-    }
-    return Optional.of(auth);
-  }
-
-  private Optional lookupAuthenticatedUser(Authentication auth) {
-
-    Optional userAuth = resolveUserAuthentication(auth);
-
-    if (userAuth.isPresent()) {
-      return accountUtils.getAuthenticatedUserAccount(userAuth.get());
+  protected void clearAuthenticationAttributes(HttpServletRequest request) {
+    HttpSession session = request.getSession(false);
+    if (session == null) {
+      return;
     }
-
-    return Optional.empty();
-
+    session.removeAttribute(WebAttributes.AUTHENTICATION_EXCEPTION);
   }
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorRecoveryCodeCheckProvider.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorRecoveryCodeCheckProvider.java
new file mode 100644
index 000000000..54fbc9e2a
--- /dev/null
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorRecoveryCodeCheckProvider.java
@@ -0,0 +1,95 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.infn.mw.iam.authn.multi_factor_authentication;
+
+import static it.infn.mw.iam.authn.multi_factor_authentication.IamAuthenticationMethodReference.AuthenticationMethodReferenceValues.ONE_TIME_PASSWORD;
+
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Set;
+
+import org.springframework.security.authentication.AuthenticationProvider;
+import org.springframework.security.authentication.BadCredentialsException;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.AuthenticationException;
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.authority.SimpleGrantedAuthority;
+
+import it.infn.mw.iam.core.ExtendedAuthenticationToken;
+import it.infn.mw.iam.persistence.model.IamAccount;
+import it.infn.mw.iam.persistence.model.IamTotpRecoveryCode;
+import it.infn.mw.iam.persistence.repository.IamAccountRepository;
+
+public class MultiFactorRecoveryCodeCheckProvider implements AuthenticationProvider {
+
+  private final IamAccountRepository accountRepo;
+
+  public MultiFactorRecoveryCodeCheckProvider(IamAccountRepository accountRepo) {
+    this.accountRepo = accountRepo;
+  }
+
+  @Override
+  public Authentication authenticate(Authentication authentication) throws AuthenticationException {
+    ExtendedAuthenticationToken token = (ExtendedAuthenticationToken) authentication;
+
+    String recoveryCode = token.getRecoveryCode();
+    if (recoveryCode == null) {
+      return null;
+    }
+
+    IamAccount account = accountRepo.findByUsername(authentication.getName())
+      .orElseThrow(() -> new BadCredentialsException("Invalid login details"));
+
+    Set accountRecoveryCodes = account.getTotpMfa().getRecoveryCodes();
+    for (IamTotpRecoveryCode recoveryCodeObject : accountRecoveryCodes) {
+      String recoveryCodeString = recoveryCodeObject.getCode();
+      if (recoveryCode.equals(recoveryCodeString)) {
+        return createSuccessfulAuthentication(token);
+      }
+    }
+
+    throw new BadCredentialsException("Bad recovery code");
+  }
+
+  protected Authentication createSuccessfulAuthentication(ExtendedAuthenticationToken token) {
+    IamAuthenticationMethodReference otp =
+        new IamAuthenticationMethodReference(ONE_TIME_PASSWORD.getValue());
+    Set refs = token.getAuthenticationMethodReferences();
+    refs.add(otp);
+    token.setAuthenticationMethodReferences(refs);
+
+    List authorities = new ArrayList<>();
+    for (GrantedAuthority authority : token.getAuthorities()) {
+      authorities.add(new SimpleGrantedAuthority(authority.getAuthority()));
+    }
+    authorities.remove(new SimpleGrantedAuthority("ROLE_PRE_AUTHENTICATED"));
+
+    // account.getAuthorities()
+    // .stream()
+    // .forEach(authority -> authorities.add(new SimpleGrantedAuthority(authority.getAuthority())));
+
+    ExtendedAuthenticationToken newToken = new ExtendedAuthenticationToken(token.getPrincipal(),
+        token.getCredentials(), authorities, token.getAuthenticationMethodReferences());
+    newToken.setAuthenticated(true);
+
+    return newToken;
+  }
+
+  @Override
+  public boolean supports(Class authentication) {
+    return authentication.equals(ExtendedAuthenticationToken.class);
+  }
+}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorCodeCheckProvider.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorTotpCheckProvider.java
similarity index 85%
rename from iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorCodeCheckProvider.java
rename to iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorTotpCheckProvider.java
index 104679fc0..d1ae2ef34 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorCodeCheckProvider.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorTotpCheckProvider.java
@@ -33,12 +33,12 @@
 import it.infn.mw.iam.persistence.model.IamAccount;
 import it.infn.mw.iam.persistence.repository.IamAccountRepository;
 
-public class MultiFactorCodeCheckProvider implements AuthenticationProvider {
+public class MultiFactorTotpCheckProvider implements AuthenticationProvider {
 
   private final IamAccountRepository accountRepo;
   private final CodeVerifier codeVerifier;
 
-  public MultiFactorCodeCheckProvider(IamAccountRepository accountRepo, CodeVerifier codeVerifier) {
+  public MultiFactorTotpCheckProvider(IamAccountRepository accountRepo, CodeVerifier codeVerifier) {
     this.accountRepo = accountRepo;
     this.codeVerifier = codeVerifier;
   }
@@ -47,16 +47,24 @@ public MultiFactorCodeCheckProvider(IamAccountRepository accountRepo, CodeVerifi
   public Authentication authenticate(Authentication authentication) throws AuthenticationException {
     ExtendedAuthenticationToken token = (ExtendedAuthenticationToken) authentication;
 
+    String totp = token.getTotp();
+    if (totp == null) {
+      return null;
+    }
+
     IamAccount account = accountRepo.findByUsername(authentication.getName())
       .orElseThrow(() -> new BadCredentialsException("Invalid login details"));
 
     String mfaSecret = account.getTotpMfa().getSecret();
-    String code = token.getCode();
 
-    if (!codeVerifier.isValidCode(mfaSecret, code)) {
-      throw new BadCredentialsException("Bad code");
+    if (codeVerifier.isValidCode(mfaSecret, totp)) {
+      return createSuccessfulAuthentication(token);
     }
 
+    throw new BadCredentialsException("Bad code");
+  }
+
+  protected Authentication createSuccessfulAuthentication(ExtendedAuthenticationToken token) {
     IamAuthenticationMethodReference otp =
         new IamAuthenticationMethodReference(ONE_TIME_PASSWORD.getValue());
     Set refs = token.getAuthenticationMethodReferences();
@@ -64,15 +72,11 @@ public Authentication authenticate(Authentication authentication) throws Authent
     token.setAuthenticationMethodReferences(refs);
 
     List authorities = new ArrayList<>();
-    for (GrantedAuthority authority : authentication.getAuthorities()) {
+    for (GrantedAuthority authority : token.getAuthorities()) {
       authorities.add(new SimpleGrantedAuthority(authority.getAuthority()));
     }
     authorities.remove(new SimpleGrantedAuthority("ROLE_PRE_AUTHENTICATED"));
 
-    account.getAuthorities()
-      .stream()
-      .forEach(authority -> authorities.add(new SimpleGrantedAuthority(authority.getAuthority())));
-
     ExtendedAuthenticationToken newToken = new ExtendedAuthenticationToken(token.getPrincipal(),
         token.getCredentials(), authorities, token.getAuthenticationMethodReferences());
     newToken.setAuthenticated(true);
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorVerificationFilter.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorVerificationFilter.java
index 1ff2a10eb..f13020c91 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorVerificationFilter.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorVerificationFilter.java
@@ -16,6 +16,7 @@
 package it.infn.mw.iam.authn.multi_factor_authentication;
 
 import java.io.IOException;
+import java.nio.file.ProviderNotFoundException;
 
 import javax.servlet.ServletException;
 import javax.servlet.http.HttpServletRequest;
@@ -35,15 +36,18 @@
 
 public class MultiFactorVerificationFilter extends AbstractAuthenticationProcessingFilter {
 
-  public static final String TOTP_MFA_CODE_KEY = "code";
-  public static final String MULTI_FACTOR_VERIFIED = "MULTI_FACTOR_VERIFIED";
+  public static final String TOTP_MFA_CODE_KEY = "totp";
+  public static final String TOTP_RECOVERY_CODE_KEY = "recoveryCode";
+  public static final String TOTP_VERIFIED = "TOTP_VERIFIED";
+  public static final String RECOVERY_CODE_VERIFIED = "RECOVERY_CODE_VERIFIED";
 
   private static final AntPathRequestMatcher DEFAULT_ANT_PATH_REQUEST_MATCHER =
       new AntPathRequestMatcher("/iam/verify", "POST");
 
   private final boolean postOnly = true;
 
-  private String codeParameter = TOTP_MFA_CODE_KEY;
+  private String totpParameter = TOTP_MFA_CODE_KEY;
+  private String recoveryCodeParameter = TOTP_RECOVERY_CODE_KEY;
 
   public MultiFactorVerificationFilter(AuthenticationManager authenticationManager,
       AuthenticationSuccessHandler successHandler, AuthenticationFailureHandler failureHandler) {
@@ -65,14 +69,31 @@ public Authentication attemptAuthentication(HttpServletRequest request,
       throw new AuthenticationServiceException("Bad authentication");
     }
 
-    String code = request.getParameter(this.codeParameter);
-    code = (code != null) ? code : "";
-    code = code.trim();
-
     ExtendedAuthenticationToken authRequest = (ExtendedAuthenticationToken) auth;
-    authRequest.setCode(code);
 
-    return this.getAuthenticationManager().authenticate(authRequest);
+    String totp = parseTotp(request);
+    String recoveryCode = parseRecoveryCode(request);
+
+    if (totp != null) {
+      authRequest.setTotp(totp);
+    } else if (recoveryCode != null) {
+      authRequest.setRecoveryCode(recoveryCode);
+    } else {
+      throw new ProviderNotFoundException("No valid totp code or recovery code was received");
+    }
+
+    Authentication newAuth = this.getAuthenticationManager().authenticate(authRequest);
+    if (newAuth == null) {
+      throw new ProviderNotFoundException("No valid totp code or recovery code was received");
+    }
+
+    if (authRequest.getTotp() != null) {
+      request.setAttribute(TOTP_VERIFIED, Boolean.TRUE);
+    } else if (authRequest.getRecoveryCode() != null) {
+      request.setAttribute(RECOVERY_CODE_VERIFIED, Boolean.TRUE);
+    }
+
+    return newAuth;
   }
 
   @Override
@@ -84,4 +105,14 @@ protected void unsuccessfulAuthentication(HttpServletRequest request,
     this.getRememberMeServices().loginFail(request, response);
     this.getFailureHandler().onAuthenticationFailure(request, response, failed);
   }
+
+  private String parseTotp(HttpServletRequest request) {
+    String totp = request.getParameter(this.totpParameter);
+    return totp != null ? totp.trim() : null;
+  }
+
+  private String parseRecoveryCode(HttpServletRequest request) {
+    String recoveryCode = request.getParameter(this.recoveryCodeParameter);
+    return recoveryCode != null ? recoveryCode.trim() : null;
+  }
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorVerificationSuccessHandler.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorVerificationSuccessHandler.java
new file mode 100644
index 000000000..7a991f4f5
--- /dev/null
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorVerificationSuccessHandler.java
@@ -0,0 +1,89 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.infn.mw.iam.authn.multi_factor_authentication;
+
+import static it.infn.mw.iam.authn.multi_factor_authentication.MfaVerifyController.MFA_VERIFY_URL;
+import static it.infn.mw.iam.authn.multi_factor_authentication.authenticator_app.RecoveryCodeManagementController.RECOVERY_CODE_RESET_URL;
+import static it.infn.mw.iam.authn.multi_factor_authentication.MultiFactorVerificationFilter.RECOVERY_CODE_VERIFIED;
+
+import java.io.IOException;
+
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.springframework.security.core.Authentication;
+import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
+// import org.springframework.security.web.savedrequest.RequestCache;
+import org.springframework.security.web.savedrequest.HttpSessionRequestCache;
+
+import it.infn.mw.iam.api.account.AccountUtils;
+import it.infn.mw.iam.api.aup.AUPSignatureCheckService;
+import it.infn.mw.iam.authn.EnforceAupSignatureSuccessHandler;
+import it.infn.mw.iam.authn.RootIsDashboardSuccessHandler;
+import it.infn.mw.iam.persistence.repository.IamAccountRepository;
+
+public class MultiFactorVerificationSuccessHandler implements AuthenticationSuccessHandler {
+
+  private final AccountUtils accountUtils;
+  private final AUPSignatureCheckService aupSignatureCheckService;
+  private final IamAccountRepository accountRepo;
+  private final String iamBaseUrl;
+
+  public MultiFactorVerificationSuccessHandler(AccountUtils accountUtils,
+      AUPSignatureCheckService aupSignatureCheckService, IamAccountRepository accountRepo,
+      String iamBaseUrl) {
+    this.accountUtils = accountUtils;
+    this.aupSignatureCheckService = aupSignatureCheckService;
+    this.accountRepo = accountRepo;
+    this.iamBaseUrl = iamBaseUrl;
+  }
+
+  @Override
+  public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response,
+      Authentication authentication) throws IOException, ServletException {
+    handle(request, response, authentication);
+  }
+
+  protected void handle(HttpServletRequest request, HttpServletResponse response,
+      Authentication authentication) throws IOException, ServletException {
+    if (response.isCommitted()) {
+      System.out
+        .println("Response has already been committed. Unable to redirect to " + MFA_VERIFY_URL);
+      return;
+    } else {
+      Object recoveryCodeVerifiedAttribute = request.getAttribute(RECOVERY_CODE_VERIFIED);
+      if (recoveryCodeVerifiedAttribute != null
+          && (boolean) recoveryCodeVerifiedAttribute == Boolean.TRUE) {
+        response.sendRedirect(RECOVERY_CODE_RESET_URL);
+      } else {
+        continueWithDefaultSuccessHandler(request, response, authentication);
+      }
+    }
+  }
+
+  public void continueWithDefaultSuccessHandler(HttpServletRequest request,
+      HttpServletResponse response, Authentication auth) throws IOException, ServletException {
+
+    AuthenticationSuccessHandler delegate =
+        new RootIsDashboardSuccessHandler(iamBaseUrl, new HttpSessionRequestCache());
+
+    EnforceAupSignatureSuccessHandler handler = new EnforceAupSignatureSuccessHandler(delegate,
+        aupSignatureCheckService, accountUtils, accountRepo);
+    handler.onAuthenticationSuccess(request, response, auth);
+  }
+}
+
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/ResetOrSkipRecoveryCodesFilter.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/ResetOrSkipRecoveryCodesFilter.java
new file mode 100644
index 000000000..f8c2f727c
--- /dev/null
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/ResetOrSkipRecoveryCodesFilter.java
@@ -0,0 +1,127 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.infn.mw.iam.authn.multi_factor_authentication;
+
+import static it.infn.mw.iam.authn.multi_factor_authentication.authenticator_app.RecoveryCodeManagementController.RECOVERY_CODE_RESET_URL;
+import static it.infn.mw.iam.authn.multi_factor_authentication.authenticator_app.RecoveryCodeManagementController.RECOVERY_CODE_VIEW_URL;
+
+import java.io.IOException;
+
+import javax.servlet.FilterChain;
+import javax.servlet.ServletException;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.core.log.LogMessage;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
+import org.springframework.security.web.savedrequest.HttpSessionRequestCache;
+import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
+import org.springframework.web.filter.GenericFilterBean;
+
+import it.infn.mw.iam.api.account.AccountUtils;
+import it.infn.mw.iam.api.account.multi_factor_authentication.authenticator_app.RecoveryCodeResetService;
+import it.infn.mw.iam.api.aup.AUPSignatureCheckService;
+import it.infn.mw.iam.api.common.error.NoAuthenticatedUserError;
+import it.infn.mw.iam.authn.EnforceAupSignatureSuccessHandler;
+import it.infn.mw.iam.authn.RootIsDashboardSuccessHandler;
+import it.infn.mw.iam.persistence.model.IamAccount;
+import it.infn.mw.iam.persistence.repository.IamAccountRepository;
+
+public class ResetOrSkipRecoveryCodesFilter extends GenericFilterBean {
+
+  public static final String RESET_KEY = "reset";
+  public static final String SKIP_KEY = "skip";
+  private static final AntPathRequestMatcher DEFAULT_ANT_PATH_REQUEST_MATCHER =
+      new AntPathRequestMatcher(RECOVERY_CODE_RESET_URL, "POST");
+
+  private String resetParameter = RESET_KEY;
+  private String skipParameter = SKIP_KEY;
+
+  private final AccountUtils accountUtils;
+  private final AUPSignatureCheckService aupSignatureCheckService;
+  private final IamAccountRepository accountRepo;
+  private final String iamBaseUrl;
+
+  @Autowired
+  private RecoveryCodeResetService service;
+
+  public ResetOrSkipRecoveryCodesFilter(AccountUtils accountUtils,
+      AUPSignatureCheckService aupSignatureCheckService, IamAccountRepository accountRepo,
+      String iamBaseUrl) {
+    this.accountUtils = accountUtils;
+    this.aupSignatureCheckService = aupSignatureCheckService;
+    this.accountRepo = accountRepo;
+    this.iamBaseUrl = iamBaseUrl;
+  }
+
+  @Override
+  public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
+      throws IOException, ServletException {
+    doFilter((HttpServletRequest) request, (HttpServletResponse) response, chain);
+  }
+
+  private void doFilter(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
+      throws IOException, ServletException {
+    if (!requiresProcessing(request, response)) {
+      chain.doFilter(request, response);
+      return;
+    }
+
+    String reset = request.getParameter(resetParameter);
+    String skip = request.getParameter(skipParameter);
+
+    if (reset != null) {
+      IamAccount account =
+          accountUtils.getAuthenticatedUserAccount().orElseThrow(NoAuthenticatedUserError::new);
+      service.resetRecoveryCodes(account);
+      response.sendRedirect(RECOVERY_CODE_VIEW_URL);
+    } else if (skip != null) {
+      chain.doFilter(request, response);
+      Authentication auth = SecurityContextHolder.getContext().getAuthentication();
+      continueWithDefaultSuccessHandler(request, response, auth);
+      return;
+    } else {
+      response.sendError(HttpServletResponse.SC_BAD_REQUEST, "No valid parameter was received");
+    }
+  }
+
+  protected boolean requiresProcessing(HttpServletRequest request, HttpServletResponse response) {
+    if (DEFAULT_ANT_PATH_REQUEST_MATCHER.matches(request)) {
+      return true;
+    }
+    if (this.logger.isTraceEnabled()) {
+      this.logger
+        .trace(LogMessage.format("Did not match request to %s", DEFAULT_ANT_PATH_REQUEST_MATCHER));
+    }
+    return false;
+  }
+
+  protected void continueWithDefaultSuccessHandler(HttpServletRequest request,
+      HttpServletResponse response, Authentication auth) throws IOException, ServletException {
+
+    AuthenticationSuccessHandler delegate =
+        new RootIsDashboardSuccessHandler(iamBaseUrl, new HttpSessionRequestCache());
+
+    EnforceAupSignatureSuccessHandler handler = new EnforceAupSignatureSuccessHandler(delegate,
+        aupSignatureCheckService, accountUtils, accountRepo);
+    handler.onAuthenticationSuccess(request, response, auth);
+  }
+}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/ViewRecoveryCodesFilter.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/ViewRecoveryCodesFilter.java
new file mode 100644
index 000000000..69c271918
--- /dev/null
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/ViewRecoveryCodesFilter.java
@@ -0,0 +1,100 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.infn.mw.iam.authn.multi_factor_authentication;
+
+import static it.infn.mw.iam.authn.multi_factor_authentication.authenticator_app.RecoveryCodeManagementController.RECOVERY_CODE_VIEW_URL;
+
+import java.io.IOException;
+
+import javax.servlet.FilterChain;
+import javax.servlet.ServletException;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.springframework.core.log.LogMessage;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
+import org.springframework.security.web.savedrequest.HttpSessionRequestCache;
+import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
+import org.springframework.web.filter.GenericFilterBean;
+
+import it.infn.mw.iam.api.account.AccountUtils;
+import it.infn.mw.iam.api.aup.AUPSignatureCheckService;
+import it.infn.mw.iam.authn.EnforceAupSignatureSuccessHandler;
+import it.infn.mw.iam.authn.RootIsDashboardSuccessHandler;
+import it.infn.mw.iam.persistence.repository.IamAccountRepository;
+
+public class ViewRecoveryCodesFilter extends GenericFilterBean {
+
+  private static final AntPathRequestMatcher DEFAULT_ANT_PATH_REQUEST_MATCHER =
+      new AntPathRequestMatcher(RECOVERY_CODE_VIEW_URL, "POST");
+
+  private final AccountUtils accountUtils;
+  private final AUPSignatureCheckService aupSignatureCheckService;
+  private final IamAccountRepository accountRepo;
+  private final String iamBaseUrl;
+
+  public ViewRecoveryCodesFilter(AccountUtils accountUtils,
+      AUPSignatureCheckService aupSignatureCheckService, IamAccountRepository accountRepo,
+      String iamBaseUrl) {
+    this.accountUtils = accountUtils;
+    this.aupSignatureCheckService = aupSignatureCheckService;
+    this.accountRepo = accountRepo;
+    this.iamBaseUrl = iamBaseUrl;
+  }
+
+  @Override
+  public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
+      throws IOException, ServletException {
+    doFilter((HttpServletRequest) request, (HttpServletResponse) response, chain);
+  }
+
+  private void doFilter(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
+      throws IOException, ServletException {
+    if (!requiresProcessing(request, response)) {
+      chain.doFilter(request, response);
+      return;
+    }
+
+    Authentication auth = SecurityContextHolder.getContext().getAuthentication();
+    continueWithDefaultSuccessHandler(request, response, auth);
+  }
+
+  protected boolean requiresProcessing(HttpServletRequest request, HttpServletResponse response) {
+    if (DEFAULT_ANT_PATH_REQUEST_MATCHER.matches(request)) {
+      return true;
+    }
+    if (this.logger.isTraceEnabled()) {
+      this.logger
+        .trace(LogMessage.format("Did not match request to %s", DEFAULT_ANT_PATH_REQUEST_MATCHER));
+    }
+    return false;
+  }
+
+  protected void continueWithDefaultSuccessHandler(HttpServletRequest request,
+      HttpServletResponse response, Authentication auth) throws IOException, ServletException {
+
+    AuthenticationSuccessHandler delegate =
+        new RootIsDashboardSuccessHandler(iamBaseUrl, new HttpSessionRequestCache());
+
+    EnforceAupSignatureSuccessHandler handler = new EnforceAupSignatureSuccessHandler(delegate,
+        aupSignatureCheckService, accountUtils, accountRepo);
+    handler.onAuthenticationSuccess(request, response, auth);
+  }
+}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/RecoveryCodeManagementController.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/RecoveryCodeManagementController.java
index 17b3c245f..d414165d3 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/RecoveryCodeManagementController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/RecoveryCodeManagementController.java
@@ -19,9 +19,7 @@
 import java.util.List;
 
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.context.ApplicationEventPublisher;
 import org.springframework.http.HttpStatus;
-import org.springframework.http.ResponseEntity;
 import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.stereotype.Controller;
 import org.springframework.ui.ModelMap;
@@ -33,9 +31,8 @@
 
 import it.infn.mw.iam.api.account.AccountUtils;
 import it.infn.mw.iam.api.common.ErrorDTO;
-import it.infn.mw.iam.audit.events.account.multi_factor_authentication.RecoveryCodesResetEvent;
 import it.infn.mw.iam.authn.multi_factor_authentication.error.MultiFactorAuthenticationError;
-import it.infn.mw.iam.core.user.IamAccountService;
+import it.infn.mw.iam.authn.multi_factor_authentication.error.NoMultiFactorSecretError;
 import it.infn.mw.iam.persistence.model.IamAccount;
 import it.infn.mw.iam.persistence.model.IamTotpRecoveryCode;
 
@@ -47,69 +44,43 @@
 @Controller
 public class RecoveryCodeManagementController {
 
-  public static final String AUTHENTICATOR_APP_URL = "/iam/authenticator-app";
-  public static final String RECOVERY_CODE_URL = AUTHENTICATOR_APP_URL + "/recovery-code";
-  public static final String RESET_URL = RECOVERY_CODE_URL + "/reset";
-  public static final String GET_URL = RECOVERY_CODE_URL + "/get";
-  public static final String VIEW_URL = RECOVERY_CODE_URL + "/view";
+  public static final String RECOVERY_CODE_RESET_URL = "/iam/authenticator-app/recovery-code/reset";
+  public static final String RECOVERY_CODE_VIEW_URL = "/iam/authenticator-app/recovery-code/view";
+  public static final String RECOVERY_CODE_GET_URL = "/iam/authenticator-app/recovery-code/get";
 
   private final AccountUtils accountUtils;
-  private final IamAccountService service;
-  private ApplicationEventPublisher eventPublisher;
 
   @Autowired
-  public RecoveryCodeManagementController(AccountUtils accountUtils, IamAccountService service,
-      ApplicationEventPublisher eventPublisher) {
+  public RecoveryCodeManagementController(AccountUtils accountUtils) {
     this.accountUtils = accountUtils;
-    this.service = service;
-    this.eventPublisher = eventPublisher;
-  }
-
-  private void recoveryCodesResetEvent(IamAccount account) {
-    eventPublisher.publishEvent(new RecoveryCodesResetEvent(this, account));
   }
 
   @PreAuthorize("hasRole('USER')")
-  @RequestMapping(method = RequestMethod.GET, path = RESET_URL)
+  @RequestMapping(method = RequestMethod.GET, path = RECOVERY_CODE_RESET_URL)
   public String getResetRecoveryCodesResetView() {
-    return "/iam/authenticator-app/recovery-code/reset";
-  }
-
-  @PreAuthorize("hasRole('USER')")
-  @RequestMapping(method = RequestMethod.POST, path = RESET_URL)
-  public String resetRecoveryCodesAndView() {
-    resetRecoveryCodes();
-
-    return "redirect:/iam/authenticator-app/recovery-code/view";
-  }
-
-  @PreAuthorize("hasRole('USER')")
-  @RequestMapping(method = RequestMethod.PUT, path = RESET_URL)
-  public ResponseEntity resetRecoveryCodes() {
-    IamAccount account = accountUtils.getAuthenticatedUserAccount()
-      .orElseThrow(() -> new MultiFactorAuthenticationError("Account not found"));
-    account = service.addTotpMfaRecoveryCodes(account);
-    account = service.saveAccount(account);
-
-    recoveryCodesResetEvent(account);
-
-    return ResponseEntity.ok().build();
+    return RECOVERY_CODE_RESET_URL;
   }
 
   @PreAuthorize("hasRole('USER')")
-  @RequestMapping(method = RequestMethod.GET, path = VIEW_URL)
+  @RequestMapping(method = RequestMethod.GET, path = RECOVERY_CODE_VIEW_URL)
   public String viewRecoveryCodes(ModelMap model) {
     String[] codes = getRecoveryCodes();
+
     model.addAttribute("recoveryCodes", codes);
-    return "/iam/authenticator-app/recovery-code/view";
+    return RECOVERY_CODE_VIEW_URL;
   }
 
   @PreAuthorize("hasRole('USER')")
-  @RequestMapping(method = RequestMethod.GET, path = GET_URL)
+  @RequestMapping(method = RequestMethod.GET, path = RECOVERY_CODE_GET_URL)
   public @ResponseBody String[] getRecoveryCodes() {
     IamAccount account = accountUtils.getAuthenticatedUserAccount()
       .orElseThrow(() -> new MultiFactorAuthenticationError("Account not found"));
 
+    if (account.getTotpMfa() == null || !account.getTotpMfa().isActive()) {
+      throw new NoMultiFactorSecretError(
+          "No multi-factor secret is associated with account " + account.getUsername());
+    }
+
     List recs = new ArrayList<>(account.getTotpMfa().getRecoveryCodes());
     String[] codes = new String[recs.size()];
 
@@ -126,4 +97,11 @@ public String viewRecoveryCodes(ModelMap model) {
   public ErrorDTO handleMultiFactorAuthenticationError(MultiFactorAuthenticationError e) {
     return ErrorDTO.fromString(e.getMessage());
   }
+
+  @ResponseStatus(code = HttpStatus.NOT_FOUND)
+  @ExceptionHandler(NoMultiFactorSecretError.class)
+  @ResponseBody
+  public ErrorDTO handleNoMultiFactorSecretError(NoMultiFactorSecretError e) {
+    return ErrorDTO.fromString(e.getMessage());
+  }
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/error/NoMultiFactorSecretError.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/error/NoMultiFactorSecretError.java
new file mode 100644
index 000000000..4829ae134
--- /dev/null
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/error/NoMultiFactorSecretError.java
@@ -0,0 +1,25 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.infn.mw.iam.authn.multi_factor_authentication.error;
+
+public class NoMultiFactorSecretError extends MultiFactorAuthenticationError {
+
+  private static final long serialVersionUID = 1L;
+
+  public NoMultiFactorSecretError(String msg) {
+    super(msg);
+  }
+}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/IamTotpMfaConfig.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/IamTotpMfaConfig.java
index fa8b5d929..82906d435 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/IamTotpMfaConfig.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/IamTotpMfaConfig.java
@@ -27,7 +27,6 @@
 import org.springframework.security.web.authentication.AuthenticationFailureHandler;
 import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
 import org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler;
-import org.springframework.security.web.savedrequest.HttpSessionRequestCache;
 
 import dev.samstevens.totp.code.CodeVerifier;
 import dev.samstevens.totp.code.DefaultCodeGenerator;
@@ -40,10 +39,12 @@
 import dev.samstevens.totp.time.SystemTimeProvider;
 import it.infn.mw.iam.api.account.AccountUtils;
 import it.infn.mw.iam.api.aup.AUPSignatureCheckService;
-import it.infn.mw.iam.authn.EnforceAupSignatureSuccessHandler;
-import it.infn.mw.iam.authn.RootIsDashboardSuccessHandler;
-import it.infn.mw.iam.authn.multi_factor_authentication.MultiFactorCodeCheckProvider;
+import it.infn.mw.iam.authn.multi_factor_authentication.MultiFactorRecoveryCodeCheckProvider;
+import it.infn.mw.iam.authn.multi_factor_authentication.MultiFactorTotpCheckProvider;
 import it.infn.mw.iam.authn.multi_factor_authentication.MultiFactorVerificationFilter;
+import it.infn.mw.iam.authn.multi_factor_authentication.MultiFactorVerificationSuccessHandler;
+import it.infn.mw.iam.authn.multi_factor_authentication.ResetOrSkipRecoveryCodesFilter;
+import it.infn.mw.iam.authn.multi_factor_authentication.ViewRecoveryCodesFilter;
 import it.infn.mw.iam.persistence.repository.IamAccountRepository;
 
 // TODO add admin config options from properties file
@@ -124,18 +125,33 @@ public MultiFactorVerificationFilter multiFactorVerificationFilter(
     return filter;
   }
 
+  @Bean(name = "ResetOrSkipRecoveryCodesFilter")
+  public ResetOrSkipRecoveryCodesFilter resetOrSkipRecoveryCodesFilter() {
+
+    ResetOrSkipRecoveryCodesFilter filter = new ResetOrSkipRecoveryCodesFilter(accountUtils,
+        aupSignatureCheckService, accountRepo, iamBaseUrl);
+
+    return filter;
+  }
+
+  @Bean(name = "ViewRecoveryCodesFilter")
+  public ViewRecoveryCodesFilter viewRecoveryCodesFilter() {
+
+    ViewRecoveryCodesFilter filter = new ViewRecoveryCodesFilter(accountUtils,
+        aupSignatureCheckService, accountRepo, iamBaseUrl);
+
+    return filter;
+  }
+
   @Bean(name = "MultiFactorVerificationAuthenticationManager")
-  public AuthenticationManager authenticationManager(
-      MultiFactorCodeCheckProvider codeCheckProvider) {
-    return new ProviderManager(Arrays.asList(codeCheckProvider));
+  public AuthenticationManager authenticationManager(MultiFactorTotpCheckProvider totpCheckProvider,
+      MultiFactorRecoveryCodeCheckProvider recoveryCodeCheckProvider) {
+    return new ProviderManager(Arrays.asList(totpCheckProvider, recoveryCodeCheckProvider));
   }
 
   public AuthenticationSuccessHandler successHandler() {
-    AuthenticationSuccessHandler delegate =
-        new RootIsDashboardSuccessHandler(iamBaseUrl, new HttpSessionRequestCache());
-
-    return new EnforceAupSignatureSuccessHandler(delegate, aupSignatureCheckService, accountUtils,
-        accountRepo);
+    return new MultiFactorVerificationSuccessHandler(accountUtils, aupSignatureCheckService,
+        accountRepo, iamBaseUrl);
   }
 
   public AuthenticationFailureHandler failureHandler() {
@@ -143,7 +159,12 @@ public AuthenticationFailureHandler failureHandler() {
   }
 
   @Bean
-  public MultiFactorCodeCheckProvider codeCheckProvider(CodeVerifier codeVerifier) {
-    return new MultiFactorCodeCheckProvider(accountRepo, codeVerifier);
+  public MultiFactorTotpCheckProvider totpCheckProvider(CodeVerifier codeVerifier) {
+    return new MultiFactorTotpCheckProvider(accountRepo, codeVerifier);
+  }
+
+  @Bean
+  public MultiFactorRecoveryCodeCheckProvider recoveryCodeCheckProvider() {
+    return new MultiFactorRecoveryCodeCheckProvider(accountRepo);
   }
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java
index 930ae2cf8..30533790e 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java
@@ -17,6 +17,8 @@
 
 import static it.infn.mw.iam.authn.ExternalAuthenticationHandlerSupport.EXT_AUTHN_UNREGISTERED_USER_AUTH;
 import static it.infn.mw.iam.authn.ExternalAuthenticationRegistrationInfo.ExternalAuthenticationType.OIDC;
+import static it.infn.mw.iam.authn.multi_factor_authentication.authenticator_app.RecoveryCodeManagementController.RECOVERY_CODE_RESET_URL;
+import static it.infn.mw.iam.authn.multi_factor_authentication.authenticator_app.RecoveryCodeManagementController.RECOVERY_CODE_VIEW_URL;
 
 import javax.servlet.RequestDispatcher;
 
@@ -47,20 +49,19 @@
 import org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler;
 import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
 import org.springframework.security.web.context.SecurityContextPersistenceFilter;
-import org.springframework.security.web.savedrequest.HttpSessionRequestCache;
 import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
 import org.springframework.web.filter.GenericFilterBean;
 
 import it.infn.mw.iam.api.account.AccountUtils;
 import it.infn.mw.iam.api.aup.AUPSignatureCheckService;
-// import it.infn.mw.iam.authn.EnforceAupSignatureSuccessHandler;
 import it.infn.mw.iam.authn.ExternalAuthenticationHintService;
 import it.infn.mw.iam.authn.HintAwareAuthenticationEntryPoint;
-import it.infn.mw.iam.authn.MultiFactorAuthenticationSuccessHandler;
-import it.infn.mw.iam.authn.RootIsDashboardSuccessHandler;
+import it.infn.mw.iam.authn.CheckMultiFactorIsEnabledSuccessHandler;
 import it.infn.mw.iam.authn.multi_factor_authentication.ExtendedAuthenticationFilter;
 import it.infn.mw.iam.authn.multi_factor_authentication.ExtendedHttpServletRequestFilter;
 import it.infn.mw.iam.authn.multi_factor_authentication.MultiFactorVerificationFilter;
+import it.infn.mw.iam.authn.multi_factor_authentication.ResetOrSkipRecoveryCodesFilter;
+import it.infn.mw.iam.authn.multi_factor_authentication.ViewRecoveryCodesFilter;
 import it.infn.mw.iam.authn.oidc.OidcAuthenticationProvider;
 import it.infn.mw.iam.authn.oidc.OidcClientFilter;
 import it.infn.mw.iam.authn.x509.IamX509AuthenticationProvider;
@@ -204,16 +205,9 @@ public ExtendedHttpServletRequestFilter extendedHttpServletRequestFilter() {
       return new ExtendedHttpServletRequestFilter();
     }
 
-    // TODO refactor this
     public AuthenticationSuccessHandler successHandler() {
-      AuthenticationSuccessHandler delegate =
-          new RootIsDashboardSuccessHandler(iamBaseUrl, new HttpSessionRequestCache());
-
-      return new MultiFactorAuthenticationSuccessHandler(accountUtils, delegate,
+      return new CheckMultiFactorIsEnabledSuccessHandler(accountUtils, iamBaseUrl,
           aupSignatureCheckService, accountRepo);
-
-      // return new EnforceAupSignatureSuccessHandler(delegate, aupSignatureCheckService,
-      // accountUtils, accountRepo);
     }
 
     public AuthenticationFailureHandler failureHandler() {
@@ -357,6 +351,10 @@ public static class MultiFactorConfigurationAdapter extends WebSecurityConfigure
     @Qualifier("MultiFactorVerificationFilter")
     private MultiFactorVerificationFilter multiFactorVerificationFilter;
 
+    @Autowired
+    @Qualifier("ResetOrSkipRecoveryCodesFilter")
+    private ResetOrSkipRecoveryCodesFilter resetOrSkipRecoveryCodesFilter;
+
     @Bean
     public AuthenticationEntryPoint mfaAuthenticationEntryPoint() {
       LoginUrlAuthenticationEntryPoint entryPoint =
@@ -380,4 +378,42 @@ protected void configure(HttpSecurity http) throws Exception {
         .addFilterAt(multiFactorVerificationFilter, UsernamePasswordAuthenticationFilter.class);
     }
   }
+
+  @Configuration
+  @Order(103)
+  public static class RecoveryCodeConfigurationAdapter extends WebSecurityConfigurerAdapter {
+
+    @Autowired
+    @Qualifier("ResetOrSkipRecoveryCodesFilter")
+    private ResetOrSkipRecoveryCodesFilter resetOrSkipRecoveryCodesFilter;
+
+    @Override
+    protected void configure(HttpSecurity http) throws Exception {
+      http.antMatcher(RECOVERY_CODE_RESET_URL + "**")
+        .authorizeRequests()
+        .anyRequest()
+        .hasRole("USER")
+        .and()
+        .addFilterAfter(resetOrSkipRecoveryCodesFilter, UsernamePasswordAuthenticationFilter.class);
+    }
+  }
+
+  @Configuration
+  @Order(104)
+  public static class RecoveryCodeViewConfigurationAdapter extends WebSecurityConfigurerAdapter {
+
+    @Autowired
+    @Qualifier("ViewRecoveryCodesFilter")
+    private ViewRecoveryCodesFilter viewRecoveryCodesFilter;
+
+    @Override
+    protected void configure(HttpSecurity http) throws Exception {
+      http.antMatcher(RECOVERY_CODE_VIEW_URL + "**")
+        .authorizeRequests()
+        .anyRequest()
+        .hasRole("USER")
+        .and()
+        .addFilterAfter(viewRecoveryCodesFilter, UsernamePasswordAuthenticationFilter.class);
+    }
+  }
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/ExtendedAuthenticationToken.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/ExtendedAuthenticationToken.java
index 5f60ace6b..6c0194151 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/ExtendedAuthenticationToken.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/ExtendedAuthenticationToken.java
@@ -29,7 +29,8 @@ public class ExtendedAuthenticationToken extends AbstractAuthenticationToken {
   private final Object principal;
   private Object credentials;
   private Set authenticationMethodReferences = new HashSet<>();
-  private String code;
+  private String totp;
+  private String recoveryCode;
 
   public ExtendedAuthenticationToken(Object principal, Object credentials) {
     super(null);
@@ -61,22 +62,13 @@ public ExtendedAuthenticationToken(Object principal, Object credentials,
     this.authenticationMethodReferences = authenticationMethodReferences;
   }
 
-  public ExtendedAuthenticationToken(Object principal, Object credentials,
-      Collection authorities,
-      Set authenticationMethodReferences, String code) {
-    super(authorities);
-    this.principal = principal;
-    this.credentials = credentials;
-    this.authenticationMethodReferences = authenticationMethodReferences;
-    this.code = code;
-  }
-
   public ExtendedAuthenticationToken(ExtendedAuthenticationToken other) {
     super(other.getAuthorities());
     this.principal = other.getPrincipal();
     this.credentials = other.getCredentials();
     this.authenticationMethodReferences = other.getAuthenticationMethodReferences();
-    this.code = other.getCode();
+    this.totp = other.getTotp();
+    this.recoveryCode = other.getRecoveryCode();
   }
 
   public Set getAuthenticationMethodReferences() {
@@ -88,12 +80,20 @@ public void setAuthenticationMethodReferences(
     this.authenticationMethodReferences = authenticationMethodReferences;
   }
 
-  public String getCode() {
-    return code;
+  public String getTotp() {
+    return totp;
+  }
+
+  public void setTotp(String totp) {
+    this.totp = totp;
+  }
+
+  public String getRecoveryCode() {
+    return recoveryCode;
   }
 
-  public void setCode(String code) {
-    this.code = code;
+  public void setRecoveryCode(String recoveryCode) {
+    this.recoveryCode = recoveryCode;
   }
 
   @Override
diff --git a/iam-login-service/src/main/webapp/WEB-INF/views/iam/authenticator-app/recovery-code/reset.jsp b/iam-login-service/src/main/webapp/WEB-INF/views/iam/authenticator-app/recovery-code/reset.jsp
index faa018993..f96d4e0f0 100644
--- a/iam-login-service/src/main/webapp/WEB-INF/views/iam/authenticator-app/recovery-code/reset.jsp
+++ b/iam-login-service/src/main/webapp/WEB-INF/views/iam/authenticator-app/recovery-code/reset.jsp
@@ -34,8 +34,8 @@
       
     
-    
-    

+
+    
       
       
diff --git a/iam-login-service/src/main/webapp/WEB-INF/views/iam/authenticator-app/recovery-code/view.jsp b/iam-login-service/src/main/webapp/WEB-INF/views/iam/authenticator-app/recovery-code/view.jsp
index 48473e95c..a051b485c 100644
--- a/iam-login-service/src/main/webapp/WEB-INF/views/iam/authenticator-app/recovery-code/view.jsp
+++ b/iam-login-service/src/main/webapp/WEB-INF/views/iam/authenticator-app/recovery-code/view.jsp
@@ -35,8 +35,8 @@
       
     

     

-      

-        
+      
+        
       

     

   
diff --git a/iam-login-service/src/main/webapp/WEB-INF/views/iam/authenticator-app/verify-authenticator-app-form.jsp b/iam-login-service/src/main/webapp/WEB-INF/views/iam/authenticator-app/verify-authenticator-app-form.jsp
index a93a3e773..910c5d6eb 100644
--- a/iam-login-service/src/main/webapp/WEB-INF/views/iam/authenticator-app/verify-authenticator-app-form.jsp
+++ b/iam-login-service/src/main/webapp/WEB-INF/views/iam/authenticator-app/verify-authenticator-app-form.jsp
@@ -26,8 +26,8 @@
           
             
           
-          
+          
         

       
         

From e34f016a8d07518a299d486086930bd918d29f00 Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Fri, 4 Mar 2022 19:42:54 +0000
Subject: [PATCH 71/76] Merge branch mfa-db-migrations into
 issue-418-mfa-support

Includes latest updates to database migrations and repositories, etc.

Now making use of separate repository and service for IamTotpMfa secret objects and their respective operations. This separates them in a more logical manner from IamAccount objects and removes the need to go through an IamAccount to access its MFA secret.

Also adding a service specifically for resetting recovery codes.

Also fixing a couple of bugs with resetting recovery codes.
---
 .../DefaultIamTotpMfaService.java             | 183 ++++++++++++++++++
 ...faultIamTotpRecoveryCodeResetService.java} |  23 ++-
 .../IamTotpMfaService.java                    |  54 ++++++
 ...a => IamTotpRecoveryCodeResetService.java} |   4 +-
 .../MultiFactorSettingsController.java        |  19 +-
 .../AuthenticatorAppSettingsController.java   |  48 +++--
 .../MfaVerifyController.java                  |  18 +-
 .../MultiFactorRecoveryCodeCheckProvider.java |  21 +-
 .../MultiFactorTotpCheckProvider.java         |  21 +-
 .../ResetOrSkipRecoveryCodesFilter.java       |  12 +-
 .../RecoveryCodeManagementController.java     |  38 +++-
 .../infn/mw/iam/config/IamTotpMfaConfig.java  |  14 +-
 .../config/security/IamWebSecurityConfig.java |   6 +-
 .../core/IamLocalAuthenticationProvider.java  |  11 +-
 .../core/user/DefaultIamAccountService.java   | 125 ------------
 .../mw/iam/core/user/IamAccountService.java   |  26 ---
 .../home/recovery-codes-reset-confirm.html    |   2 +-
 .../java/it/infn/mw/iam/test/TestUtils.java   |   2 +-
 .../DefaultPagedAccountsServiceTests.java     |   8 +-
 .../repository/IamTotpMfaRepositoryTests.java |  53 +++++
 .../mw/iam/persistence/model/IamAccount.java  |  12 --
 .../mw/iam/persistence/model/IamTotpMfa.java  |   8 +-
 .../repository/IamTotpMfaRepository.java      |  28 +++
 .../IamTotpMfaRepositoryCustom.java           |  26 +++
 .../repository/IamTotpMfaRepositoryImpl.java  |  37 ++++
 .../db/migration/h2/V70___totp_mfa.sql        |   8 +-
 .../V71___add_pre_authenticated_authority.sql |   4 +-
 .../db/migration/mysql/V70___totp_mfa.sql     |   8 +-
 .../V71___add_pre_authenticated_authority.sql |   2 +
 .../V71___add_pre_authenticed_authority.sql   |   2 -
 .../db/migration/test/V100000___test_data.sql |  11 +-
 31 files changed, 588 insertions(+), 246 deletions(-)
 create mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/DefaultIamTotpMfaService.java
 rename iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/{authenticator_app/DefaultRecoveryCodeResetService.java => DefaultIamTotpRecoveryCodeResetService.java} (71%)
 create mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/IamTotpMfaService.java
 rename iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/{authenticator_app/RecoveryCodeResetService.java => IamTotpRecoveryCodeResetService.java} (85%)
 create mode 100644 iam-login-service/src/test/java/it/infn/mw/iam/test/repository/IamTotpMfaRepositoryTests.java
 create mode 100644 iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamTotpMfaRepository.java
 create mode 100644 iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamTotpMfaRepositoryCustom.java
 create mode 100644 iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamTotpMfaRepositoryImpl.java
 create mode 100644 iam-persistence/src/main/resources/db/migration/mysql/V71___add_pre_authenticated_authority.sql
 delete mode 100644 iam-persistence/src/main/resources/db/migration/mysql/V71___add_pre_authenticed_authority.sql

diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/DefaultIamTotpMfaService.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/DefaultIamTotpMfaService.java
new file mode 100644
index 000000000..f020a687d
--- /dev/null
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/DefaultIamTotpMfaService.java
@@ -0,0 +1,183 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.infn.mw.iam.api.account.multi_factor_authentication;
+
+import java.util.HashSet;
+import java.util.Optional;
+import java.util.Set;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.ApplicationEventPublisher;
+import org.springframework.context.ApplicationEventPublisherAware;
+import org.springframework.stereotype.Service;
+
+import dev.samstevens.totp.recovery.RecoveryCodeGenerator;
+import dev.samstevens.totp.secret.SecretGenerator;
+import it.infn.mw.iam.audit.events.account.multi_factor_authentication.AuthenticatorAppDisabledEvent;
+import it.infn.mw.iam.audit.events.account.multi_factor_authentication.AuthenticatorAppEnabledEvent;
+import it.infn.mw.iam.core.user.IamAccountService;
+import it.infn.mw.iam.core.user.exception.MfaSecretAlreadyBoundException;
+import it.infn.mw.iam.core.user.exception.MfaSecretNotFoundException;
+import it.infn.mw.iam.core.user.exception.TotpMfaAlreadyEnabledException;
+import it.infn.mw.iam.persistence.model.IamAccount;
+import it.infn.mw.iam.persistence.model.IamTotpMfa;
+import it.infn.mw.iam.persistence.model.IamTotpRecoveryCode;
+import it.infn.mw.iam.persistence.repository.IamTotpMfaRepository;
+
+@Service
+public class DefaultIamTotpMfaService implements IamTotpMfaService, ApplicationEventPublisherAware {
+
+  private final IamAccountService iamAccountService;
+  private final IamTotpMfaRepository totpMfaRepository;
+  private final SecretGenerator secretGenerator;
+  private final RecoveryCodeGenerator recoveryCodeGenerator;
+  private ApplicationEventPublisher eventPublisher;
+
+  @Autowired
+  public DefaultIamTotpMfaService(IamAccountService iamAccountService,
+      IamTotpMfaRepository totpMfaRepository, SecretGenerator secretGenerator,
+      RecoveryCodeGenerator recoveryCodeGenerator, ApplicationEventPublisher eventPublisher) {
+    this.iamAccountService = iamAccountService;
+    this.totpMfaRepository = totpMfaRepository;
+    this.secretGenerator = secretGenerator;
+    this.recoveryCodeGenerator = recoveryCodeGenerator;
+    this.eventPublisher = eventPublisher;
+  }
+
+  private void authenticatorAppEnabledEvent(IamAccount account) {
+    eventPublisher.publishEvent(new AuthenticatorAppEnabledEvent(this, account));
+  }
+
+  private void authenticatorAppDisabledEvent(IamAccount account) {
+    eventPublisher.publishEvent(new AuthenticatorAppDisabledEvent(this, account));
+  }
+
+  @Override
+  public void setApplicationEventPublisher(ApplicationEventPublisher applicationEventPublisher) {
+    this.eventPublisher = applicationEventPublisher;
+  }
+
+  /**
+   * Generates and attaches a TOTP MFA secret to a user account, along with a set of recovery codes
+   * This is pre-emptive to actually enabling TOTP MFA on the account - the secret is written for
+   * server-side TOTP verification
+   * 
+   * @param account the account to add the secret to
+   * @return the new TOTP secret
+   */
+  @Override
+  public IamTotpMfa addTotpMfaSecret(IamAccount account) {
+    Optional totpMfaOptional = totpMfaRepository.findByAccount(account);
+    if (totpMfaOptional.isPresent() && totpMfaOptional.get().isActive()) {
+      throw new MfaSecretAlreadyBoundException(
+          "A multi-factor secret is already assigned to this account");
+    }
+
+    // Generate secret
+    IamTotpMfa totpMfa = new IamTotpMfa(account);
+    totpMfa.setSecret(secretGenerator.generate());
+    totpMfa.setAccount(account);
+
+    Set recoveryCodes = generateRecoveryCodes(totpMfa);
+    totpMfa.setRecoveryCodes(recoveryCodes);
+    totpMfaRepository.save(totpMfa);
+    return totpMfa;
+  }
+
+  /**
+   * Adds a set of recovery codes to a given account's TOTP secret.
+   * 
+   * @param account the account to add recovery codes to
+   * @return the affected TOTP secret
+   */
+  @Override
+  public IamTotpMfa addTotpMfaRecoveryCodes(IamAccount account) {
+    Optional totpMfaOptional = totpMfaRepository.findByAccount(account);
+    if (!totpMfaOptional.isPresent()) {
+      throw new MfaSecretNotFoundException("No multi-factor secret is attached to this account");
+    }
+
+    IamTotpMfa totpMfa = totpMfaOptional.get();
+
+    Set recoveryCodes = generateRecoveryCodes(totpMfa);
+
+    // Attach to account
+    totpMfa.setRecoveryCodes(recoveryCodes);
+    totpMfa.touch();
+    return totpMfa;
+  }
+
+  /**
+   * Enables TOTP MFA on a provided account. Relies on the account already having a non-active TOTP
+   * secret attached to it
+   * 
+   * @param account the account to enable TOTP MFA on
+   * @return the newly-enabled TOTP secret
+   */
+  @Override
+  public IamTotpMfa enableTotpMfa(IamAccount account) {
+    Optional totpMfaOptional = totpMfaRepository.findByAccount(account);
+    if (!totpMfaOptional.isPresent()) {
+      throw new MfaSecretNotFoundException("No multi-factor secret is attached to this account");
+    }
+
+    IamTotpMfa totpMfa = totpMfaOptional.get();
+    if (totpMfa.isActive()) {
+      throw new TotpMfaAlreadyEnabledException("TOTP MFA is already enabled on this account");
+    }
+
+    totpMfa.setActive(true);
+    totpMfa.touch();
+    totpMfaRepository.save(totpMfa);
+    iamAccountService.saveAccount(account);
+    authenticatorAppEnabledEvent(account);
+    return totpMfa;
+  }
+
+  /**
+   * Disables TOTP MFA on a provided account. Relies on the account having an active TOTP secret
+   * attached to it. Disabling means to delete the secret entirely (if a user chooses to enable
+   * again, a new secret is generated anyway)
+   * 
+   * @param account the account to disable TOTP MFA on
+   * @return the newly-disabled TOTP MFA
+   */
+  @Override
+  public IamTotpMfa disableTotpMfa(IamAccount account) {
+    Optional totpMfaOptional = totpMfaRepository.findByAccount(account);
+    if (!totpMfaOptional.isPresent()) {
+      throw new MfaSecretNotFoundException("No multi-factor secret is attached to this account");
+    }
+
+    IamTotpMfa totpMfa = totpMfaOptional.get();
+    totpMfaRepository.delete(totpMfa);
+
+    iamAccountService.saveAccount(account);
+    authenticatorAppDisabledEvent(account);
+    return totpMfa;
+  }
+
+  private Set generateRecoveryCodes(IamTotpMfa totpMfa) {
+    String[] recoveryCodeStrings = recoveryCodeGenerator.generateCodes(6);
+    Set recoveryCodes = new HashSet<>();
+    for (String code : recoveryCodeStrings) {
+      IamTotpRecoveryCode recoveryCode = new IamTotpRecoveryCode(totpMfa);
+      recoveryCode.setCode(code);
+      recoveryCodes.add(recoveryCode);
+    }
+    return recoveryCodes;
+  }
+}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/DefaultRecoveryCodeResetService.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/DefaultIamTotpRecoveryCodeResetService.java
similarity index 71%
rename from iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/DefaultRecoveryCodeResetService.java
rename to iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/DefaultIamTotpRecoveryCodeResetService.java
index d25f454f6..25ace696f 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/DefaultRecoveryCodeResetService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/DefaultIamTotpRecoveryCodeResetService.java
@@ -13,9 +13,10 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package it.infn.mw.iam.api.account.multi_factor_authentication.authenticator_app;
+package it.infn.mw.iam.api.account.multi_factor_authentication;
 
 import java.util.HashSet;
+import java.util.Optional;
 import java.util.Set;
 
 import org.springframework.beans.factory.annotation.Autowired;
@@ -25,23 +26,27 @@
 
 import dev.samstevens.totp.recovery.RecoveryCodeGenerator;
 import it.infn.mw.iam.audit.events.account.multi_factor_authentication.RecoveryCodesResetEvent;
+import it.infn.mw.iam.core.user.exception.MfaSecretNotFoundException;
 import it.infn.mw.iam.persistence.model.IamAccount;
 import it.infn.mw.iam.persistence.model.IamTotpMfa;
 import it.infn.mw.iam.persistence.model.IamTotpRecoveryCode;
 import it.infn.mw.iam.persistence.repository.IamAccountRepository;
+import it.infn.mw.iam.persistence.repository.IamTotpMfaRepository;
 
 @Service
-public class DefaultRecoveryCodeResetService
-    implements RecoveryCodeResetService, ApplicationEventPublisherAware {
+public class DefaultIamTotpRecoveryCodeResetService
+    implements IamTotpRecoveryCodeResetService, ApplicationEventPublisherAware {
 
   private final IamAccountRepository accountRepository;
+  private final IamTotpMfaRepository totpMfaRepository;
   private final RecoveryCodeGenerator recoveryCodeGenerator;
   private ApplicationEventPublisher eventPublisher;
 
   @Autowired
-  public DefaultRecoveryCodeResetService(IamAccountRepository accountRepository,
-      RecoveryCodeGenerator recoveryCodeGenerator) {
+  public DefaultIamTotpRecoveryCodeResetService(IamAccountRepository accountRepository,
+      IamTotpMfaRepository totpMfaRepository, RecoveryCodeGenerator recoveryCodeGenerator) {
     this.accountRepository = accountRepository;
+    this.totpMfaRepository = totpMfaRepository;
     this.recoveryCodeGenerator = recoveryCodeGenerator;
   }
 
@@ -52,7 +57,12 @@ public void setApplicationEventPublisher(ApplicationEventPublisher applicationEv
 
   @Override
   public void resetRecoveryCodes(IamAccount account) {
-    IamTotpMfa totpMfa = account.getTotpMfa();
+    Optional totpMfaOptional = totpMfaRepository.findByAccount(account);
+    if (!totpMfaOptional.isPresent()) {
+      throw new MfaSecretNotFoundException("No multi-factor secret is attached to this account");
+    }
+
+    IamTotpMfa totpMfa = totpMfaOptional.get();
     String[] recoveryCodeStrings = recoveryCodeGenerator.generateCodes(6);
     Set recoveryCodes = new HashSet<>();
     for (String code : recoveryCodeStrings) {
@@ -66,6 +76,7 @@ public void resetRecoveryCodes(IamAccount account) {
     totpMfa.touch();
     account.touch();
     accountRepository.save(account);
+    totpMfaRepository.save(totpMfa);
     eventPublisher.publishEvent(new RecoveryCodesResetEvent(this, account));
   }
 
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/IamTotpMfaService.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/IamTotpMfaService.java
new file mode 100644
index 000000000..de96c37a7
--- /dev/null
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/IamTotpMfaService.java
@@ -0,0 +1,54 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.infn.mw.iam.api.account.multi_factor_authentication;
+
+import it.infn.mw.iam.persistence.model.IamAccount;
+import it.infn.mw.iam.persistence.model.IamTotpMfa;
+
+public interface IamTotpMfaService {
+
+  /**
+   * Adds a TOTP secret to an account
+   * 
+   * @param account the account to add the secret to
+   * @return the added secret
+   */
+  IamTotpMfa addTotpMfaSecret(IamAccount account);
+
+  /**
+   * Adds recovery codes to a TOTP secret
+   * 
+   * @param account the account who's TOTP secret we will add recovery codes to
+   * @return the affected TOTP secret
+   */
+  IamTotpMfa addTotpMfaRecoveryCodes(IamAccount account);
+
+  /**
+   * Enable TOTP MFA on account with TOTP secret
+   * 
+   * @param account the account to enable TOTP MFA on
+   * @return the enabled secret
+   */
+  IamTotpMfa enableTotpMfa(IamAccount account);
+
+  /**
+   * Disable TOTP MFA on account with TOTP secret
+   * 
+   * @param account the account to disable TOTP MFA on
+   * @return the disabled secret
+   */
+  IamTotpMfa disableTotpMfa(IamAccount account);
+}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/RecoveryCodeResetService.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/IamTotpRecoveryCodeResetService.java
similarity index 85%
rename from iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/RecoveryCodeResetService.java
rename to iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/IamTotpRecoveryCodeResetService.java
index 4d2680f45..071b6e3f7 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/RecoveryCodeResetService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/IamTotpRecoveryCodeResetService.java
@@ -13,11 +13,11 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package it.infn.mw.iam.api.account.multi_factor_authentication.authenticator_app;
+package it.infn.mw.iam.api.account.multi_factor_authentication;
 
 import it.infn.mw.iam.persistence.model.IamAccount;
 
-public interface RecoveryCodeResetService {
+public interface IamTotpRecoveryCodeResetService {
 
   public void resetRecoveryCodes(IamAccount account);
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/MultiFactorSettingsController.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/MultiFactorSettingsController.java
index 68c4b4382..74377f762 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/MultiFactorSettingsController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/MultiFactorSettingsController.java
@@ -15,6 +15,8 @@
  */
 package it.infn.mw.iam.api.account.multi_factor_authentication;
 
+import java.util.Optional;
+
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.http.MediaType;
 import org.springframework.security.access.prepost.PreAuthorize;
@@ -28,7 +30,9 @@
 
 import it.infn.mw.iam.api.common.NoSuchAccountError;
 import it.infn.mw.iam.persistence.model.IamAccount;
+import it.infn.mw.iam.persistence.model.IamTotpMfa;
 import it.infn.mw.iam.persistence.repository.IamAccountRepository;
+import it.infn.mw.iam.persistence.repository.IamTotpMfaRepository;
 
 /**
  * Controller for retrieving all multi-factor settings for a user account
@@ -39,10 +43,13 @@ public class MultiFactorSettingsController {
 
   public static final String MULTI_FACTOR_SETTINGS_URL = "/iam/multi-factor-settings";
   final IamAccountRepository accountRepository;
+  final IamTotpMfaRepository totpMfaRepository;
 
   @Autowired
-  public MultiFactorSettingsController(IamAccountRepository accountRepository) {
+  public MultiFactorSettingsController(IamAccountRepository accountRepository,
+      IamTotpMfaRepository totpMfaRepository) {
     this.accountRepository = accountRepository;
+    this.totpMfaRepository = totpMfaRepository;
   }
 
 
@@ -60,9 +67,15 @@ public MultiFactorSettingsDTO getMultiFactorSettings() {
     final String username = getUsernameFromSecurityContext();
     IamAccount account = accountRepository.findByUsername(username)
       .orElseThrow(() -> NoSuchAccountError.forUsername(username));
-
+    Optional totpMfaOptional = totpMfaRepository.findByAccount(account);
     MultiFactorSettingsDTO dto = new MultiFactorSettingsDTO();
-    dto.setAuthenticatorAppActive(account.getTotpMfa() != null && account.getTotpMfa().isActive());
+    if (totpMfaOptional.isPresent()) {
+      IamTotpMfa totpMfa = totpMfaOptional.get();
+      dto.setAuthenticatorAppActive(totpMfa.isActive());
+    } else {
+      dto.setAuthenticatorAppActive(false);
+    }
+
     // add further factors if/when implemented
 
     return dto;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppSettingsController.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppSettingsController.java
index 7301b8a32..8b1d2fc49 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppSettingsController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppSettingsController.java
@@ -17,6 +17,8 @@
 
 import static dev.samstevens.totp.util.Utils.getDataUriForImage;
 
+import java.util.Optional;
+
 import javax.validation.Valid;
 
 import org.springframework.beans.factory.annotation.Autowired;
@@ -40,15 +42,17 @@
 import dev.samstevens.totp.exceptions.QrGenerationException;
 import dev.samstevens.totp.qr.QrData;
 import dev.samstevens.totp.qr.QrGenerator;
+import it.infn.mw.iam.api.account.multi_factor_authentication.IamTotpMfaService;
 import it.infn.mw.iam.api.account.multi_factor_authentication.authenticator_app.error.BadMfaCodeError;
 import it.infn.mw.iam.api.common.ErrorDTO;
 import it.infn.mw.iam.api.common.NoSuchAccountError;
-import it.infn.mw.iam.core.user.IamAccountService;
 import it.infn.mw.iam.core.user.exception.MfaSecretAlreadyBoundException;
 import it.infn.mw.iam.core.user.exception.MfaSecretNotFoundException;
 import it.infn.mw.iam.core.user.exception.TotpMfaAlreadyEnabledException;
 import it.infn.mw.iam.persistence.model.IamAccount;
+import it.infn.mw.iam.persistence.model.IamTotpMfa;
 import it.infn.mw.iam.persistence.repository.IamAccountRepository;
+import it.infn.mw.iam.persistence.repository.IamTotpMfaRepository;
 
 /**
  * Controller for customising user's authenticator app MFA settings Can enable or disable the
@@ -63,16 +67,19 @@ public class AuthenticatorAppSettingsController {
   public static final String ENABLE_URL = BASE_URL + "/enable";
   public static final String DISABLE_URL = BASE_URL + "/disable";
 
-  final IamAccountService service;
+  final IamTotpMfaService service;
   final IamAccountRepository accountRepository;
+  final IamTotpMfaRepository totpMfaRepository;
   private QrGenerator qrGenerator;
   private CodeVerifier codeVerifier;
 
   @Autowired
-  public AuthenticatorAppSettingsController(IamAccountService service,
-      IamAccountRepository accountRepository, QrGenerator qrGenerator, CodeVerifier codeVerifier) {
+  public AuthenticatorAppSettingsController(IamTotpMfaService service,
+      IamAccountRepository accountRepository, IamTotpMfaRepository totpMfaRepository,
+      QrGenerator qrGenerator, CodeVerifier codeVerifier) {
     this.service = service;
     this.accountRepository = accountRepository;
+    this.totpMfaRepository = totpMfaRepository;
     this.qrGenerator = qrGenerator;
     this.codeVerifier = codeVerifier;
   }
@@ -93,16 +100,16 @@ public SecretAndDataUriDTO addSecret() {
     IamAccount account = accountRepository.findByUsername(username)
       .orElseThrow(() -> NoSuchAccountError.forUsername(username));
 
-    account = service.addTotpMfaSecret(account);
+    IamTotpMfa totpMfa = service.addTotpMfaSecret(account);
+    SecretAndDataUriDTO dto = new SecretAndDataUriDTO(totpMfa.getSecret());
 
-    SecretAndDataUriDTO dto = new SecretAndDataUriDTO(account.getTotpMfa().getSecret());
     try {
-      String dataUri =
-          generateQRCodeFromSecret(account.getTotpMfa().getSecret(), account.getUsername());
+      String dataUri = generateQRCodeFromSecret(totpMfa.getSecret(), account.getUsername());
       dto.setDataUri(dataUri);
     } catch (QrGenerationException e) {
-      // TODO QR code couldn't be generated. What should be done here?
+      throw new BadMfaCodeError("Could not generate QR code");
     }
+
     return dto;
   }
 
@@ -128,9 +135,14 @@ public void enableAuthenticatorApp(@ModelAttribute @Valid CodeDTO code,
     final String username = getUsernameFromSecurityContext();
     IamAccount account = accountRepository.findByUsername(username)
       .orElseThrow(() -> NoSuchAccountError.forUsername(username));
-
-    if (!codeVerifier.isValidCode(account.getTotpMfa().getSecret(), code.getCode())) {
-      throw new BadMfaCodeError("Bad MFA code");
+    Optional totpMfaOptional = totpMfaRepository.findByAccount(account);
+    if (totpMfaOptional.isPresent()) {
+      IamTotpMfa totpMfa = totpMfaOptional.get();
+      if (!codeVerifier.isValidCode(totpMfa.getSecret(), code.getCode())) {
+        throw new BadMfaCodeError("Bad MFA code");
+      }
+    } else {
+      throw new MfaSecretNotFoundException("No multi-factor secret is attached to this account");
     }
 
     service.enableTotpMfa(account);
@@ -157,9 +169,15 @@ public void disableAuthenticatorApp(@Valid CodeDTO code, BindingResult validatio
     final String username = getUsernameFromSecurityContext();
     IamAccount account = accountRepository.findByUsername(username)
       .orElseThrow(() -> NoSuchAccountError.forUsername(username));
-
-    if (!codeVerifier.isValidCode(account.getTotpMfa().getSecret(), code.getCode())) {
-      throw new BadMfaCodeError("Bad MFA code");
+    Optional totpMfaOptional = totpMfaRepository.findByAccount(account);
+
+    if (totpMfaOptional.isPresent()) {
+      IamTotpMfa totpMfa = totpMfaOptional.get();
+      if (!codeVerifier.isValidCode(totpMfa.getSecret(), code.getCode())) {
+        throw new BadMfaCodeError("Bad MFA code");
+      }
+    } else {
+      throw new MfaSecretNotFoundException("No multi-factor secret is attached to this account");
     }
 
     service.disableTotpMfa(account);
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MfaVerifyController.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MfaVerifyController.java
index 631b4486b..2a29170a1 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MfaVerifyController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MfaVerifyController.java
@@ -17,6 +17,8 @@
 
 import static it.infn.mw.iam.authn.multi_factor_authentication.MfaVerifyController.MFA_VERIFY_URL;
 
+import java.util.Optional;
+
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.http.HttpStatus;
 import org.springframework.security.access.prepost.PreAuthorize;
@@ -33,7 +35,9 @@
 import it.infn.mw.iam.api.common.ErrorDTO;
 import it.infn.mw.iam.api.common.NoSuchAccountError;
 import it.infn.mw.iam.persistence.model.IamAccount;
+import it.infn.mw.iam.persistence.model.IamTotpMfa;
 import it.infn.mw.iam.persistence.repository.IamAccountRepository;
+import it.infn.mw.iam.persistence.repository.IamTotpMfaRepository;
 
 //TODO when unauthenticated and navigating to other pages like /dashboard, we redirect to /login. But here we show up as unauthorized. Can we replicate the behaviour of /dashboard?
 
@@ -47,10 +51,13 @@ public class MfaVerifyController {
 
   public static final String MFA_VERIFY_URL = "/iam/verify";
   final IamAccountRepository accountRepository;
+  final IamTotpMfaRepository totpMfaRepository;
 
   @Autowired
-  public MfaVerifyController(IamAccountRepository accountRepository) {
+  public MfaVerifyController(IamAccountRepository accountRepository,
+      IamTotpMfaRepository totpMfaRepository) {
     this.accountRepository = accountRepository;
+    this.totpMfaRepository = totpMfaRepository;
   }
 
   @PreAuthorize("hasRole('PRE_AUTHENTICATED')")
@@ -66,7 +73,14 @@ public String getVerifyMfaView(Authentication authentication, ModelMap model) {
 
   private MultiFactorSettingsDTO populateMfaSettings(IamAccount account) {
     MultiFactorSettingsDTO dto = new MultiFactorSettingsDTO();
-    dto.setAuthenticatorAppActive(account.getTotpMfa() != null && account.getTotpMfa().isActive());
+
+    Optional totpMfaOptional = totpMfaRepository.findByAccount(account);
+    if (totpMfaOptional.isPresent()) {
+      IamTotpMfa totpMfa = totpMfaOptional.get();
+      dto.setAuthenticatorAppActive(totpMfa.isActive());
+    } else {
+      dto.setAuthenticatorAppActive(false);
+    }
 
     return dto;
   }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorRecoveryCodeCheckProvider.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorRecoveryCodeCheckProvider.java
index 54fbc9e2a..071bbe309 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorRecoveryCodeCheckProvider.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorRecoveryCodeCheckProvider.java
@@ -19,6 +19,7 @@
 
 import java.util.ArrayList;
 import java.util.List;
+import java.util.Optional;
 import java.util.Set;
 
 import org.springframework.security.authentication.AuthenticationProvider;
@@ -29,16 +30,22 @@
 import org.springframework.security.core.authority.SimpleGrantedAuthority;
 
 import it.infn.mw.iam.core.ExtendedAuthenticationToken;
+import it.infn.mw.iam.core.user.exception.MfaSecretNotFoundException;
 import it.infn.mw.iam.persistence.model.IamAccount;
+import it.infn.mw.iam.persistence.model.IamTotpMfa;
 import it.infn.mw.iam.persistence.model.IamTotpRecoveryCode;
 import it.infn.mw.iam.persistence.repository.IamAccountRepository;
+import it.infn.mw.iam.persistence.repository.IamTotpMfaRepository;
 
 public class MultiFactorRecoveryCodeCheckProvider implements AuthenticationProvider {
 
   private final IamAccountRepository accountRepo;
+  private final IamTotpMfaRepository totpMfaRepository;
 
-  public MultiFactorRecoveryCodeCheckProvider(IamAccountRepository accountRepo) {
+  public MultiFactorRecoveryCodeCheckProvider(IamAccountRepository accountRepo,
+      IamTotpMfaRepository totpMfaRepository) {
     this.accountRepo = accountRepo;
+    this.totpMfaRepository = totpMfaRepository;
   }
 
   @Override
@@ -53,7 +60,17 @@ public Authentication authenticate(Authentication authentication) throws Authent
     IamAccount account = accountRepo.findByUsername(authentication.getName())
       .orElseThrow(() -> new BadCredentialsException("Invalid login details"));
 
-    Set accountRecoveryCodes = account.getTotpMfa().getRecoveryCodes();
+    Optional totpMfaOptional = totpMfaRepository.findByAccount(account);
+    if (!totpMfaOptional.isPresent()) {
+      throw new MfaSecretNotFoundException("No multi-factor secret is attached to this account");
+    }
+
+    IamTotpMfa totpMfa = totpMfaOptional.get();
+    if (!totpMfa.isActive()) {
+      throw new MfaSecretNotFoundException("No multi-factor secret is attached to this account");
+    }
+
+    Set accountRecoveryCodes = totpMfa.getRecoveryCodes();
     for (IamTotpRecoveryCode recoveryCodeObject : accountRecoveryCodes) {
       String recoveryCodeString = recoveryCodeObject.getCode();
       if (recoveryCode.equals(recoveryCodeString)) {
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorTotpCheckProvider.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorTotpCheckProvider.java
index d1ae2ef34..f0570e7ec 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorTotpCheckProvider.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorTotpCheckProvider.java
@@ -19,6 +19,7 @@
 
 import java.util.ArrayList;
 import java.util.List;
+import java.util.Optional;
 import java.util.Set;
 
 import org.springframework.security.authentication.AuthenticationProvider;
@@ -30,16 +31,22 @@
 
 import dev.samstevens.totp.code.CodeVerifier;
 import it.infn.mw.iam.core.ExtendedAuthenticationToken;
+import it.infn.mw.iam.core.user.exception.MfaSecretNotFoundException;
 import it.infn.mw.iam.persistence.model.IamAccount;
+import it.infn.mw.iam.persistence.model.IamTotpMfa;
 import it.infn.mw.iam.persistence.repository.IamAccountRepository;
+import it.infn.mw.iam.persistence.repository.IamTotpMfaRepository;
 
 public class MultiFactorTotpCheckProvider implements AuthenticationProvider {
 
   private final IamAccountRepository accountRepo;
+  private final IamTotpMfaRepository totpMfaRepository;
   private final CodeVerifier codeVerifier;
 
-  public MultiFactorTotpCheckProvider(IamAccountRepository accountRepo, CodeVerifier codeVerifier) {
+  public MultiFactorTotpCheckProvider(IamAccountRepository accountRepo,
+      IamTotpMfaRepository totpMfaRepository, CodeVerifier codeVerifier) {
     this.accountRepo = accountRepo;
+    this.totpMfaRepository = totpMfaRepository;
     this.codeVerifier = codeVerifier;
   }
 
@@ -55,7 +62,17 @@ public Authentication authenticate(Authentication authentication) throws Authent
     IamAccount account = accountRepo.findByUsername(authentication.getName())
       .orElseThrow(() -> new BadCredentialsException("Invalid login details"));
 
-    String mfaSecret = account.getTotpMfa().getSecret();
+    Optional totpMfaOptional = totpMfaRepository.findByAccount(account);
+    if (!totpMfaOptional.isPresent()) {
+      throw new MfaSecretNotFoundException("No multi-factor secret is attached to this account");
+    }
+
+    IamTotpMfa totpMfa = totpMfaOptional.get();
+    if (!totpMfa.isActive()) {
+      throw new MfaSecretNotFoundException("No multi-factor secret is attached to this account");
+    }
+
+    String mfaSecret = totpMfa.getSecret();
 
     if (codeVerifier.isValidCode(mfaSecret, totp)) {
       return createSuccessfulAuthentication(token);
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/ResetOrSkipRecoveryCodesFilter.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/ResetOrSkipRecoveryCodesFilter.java
index f8c2f727c..2225119be 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/ResetOrSkipRecoveryCodesFilter.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/ResetOrSkipRecoveryCodesFilter.java
@@ -27,7 +27,6 @@
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
-import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.core.log.LogMessage;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.context.SecurityContextHolder;
@@ -37,7 +36,7 @@
 import org.springframework.web.filter.GenericFilterBean;
 
 import it.infn.mw.iam.api.account.AccountUtils;
-import it.infn.mw.iam.api.account.multi_factor_authentication.authenticator_app.RecoveryCodeResetService;
+import it.infn.mw.iam.api.account.multi_factor_authentication.IamTotpRecoveryCodeResetService;
 import it.infn.mw.iam.api.aup.AUPSignatureCheckService;
 import it.infn.mw.iam.api.common.error.NoAuthenticatedUserError;
 import it.infn.mw.iam.authn.EnforceAupSignatureSuccessHandler;
@@ -59,17 +58,16 @@ public class ResetOrSkipRecoveryCodesFilter extends GenericFilterBean {
   private final AUPSignatureCheckService aupSignatureCheckService;
   private final IamAccountRepository accountRepo;
   private final String iamBaseUrl;
-
-  @Autowired
-  private RecoveryCodeResetService service;
+  private final IamTotpRecoveryCodeResetService recoveryCodeResetService;
 
   public ResetOrSkipRecoveryCodesFilter(AccountUtils accountUtils,
       AUPSignatureCheckService aupSignatureCheckService, IamAccountRepository accountRepo,
-      String iamBaseUrl) {
+      String iamBaseUrl, IamTotpRecoveryCodeResetService recoveryCodeResetService) {
     this.accountUtils = accountUtils;
     this.aupSignatureCheckService = aupSignatureCheckService;
     this.accountRepo = accountRepo;
     this.iamBaseUrl = iamBaseUrl;
+    this.recoveryCodeResetService = recoveryCodeResetService;
   }
 
   @Override
@@ -91,7 +89,7 @@ private void doFilter(HttpServletRequest request, HttpServletResponse response,
     if (reset != null) {
       IamAccount account =
           accountUtils.getAuthenticatedUserAccount().orElseThrow(NoAuthenticatedUserError::new);
-      service.resetRecoveryCodes(account);
+      recoveryCodeResetService.resetRecoveryCodes(account);
       response.sendRedirect(RECOVERY_CODE_VIEW_URL);
     } else if (skip != null) {
       chain.doFilter(request, response);
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/RecoveryCodeManagementController.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/RecoveryCodeManagementController.java
index d414165d3..8f79cec54 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/RecoveryCodeManagementController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/RecoveryCodeManagementController.java
@@ -17,9 +17,11 @@
 
 import java.util.ArrayList;
 import java.util.List;
+import java.util.Optional;
 
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.http.HttpStatus;
+import org.springframework.http.ResponseEntity;
 import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.stereotype.Controller;
 import org.springframework.ui.ModelMap;
@@ -30,11 +32,15 @@
 import org.springframework.web.bind.annotation.ResponseStatus;
 
 import it.infn.mw.iam.api.account.AccountUtils;
+import it.infn.mw.iam.api.account.multi_factor_authentication.IamTotpRecoveryCodeResetService;
 import it.infn.mw.iam.api.common.ErrorDTO;
 import it.infn.mw.iam.authn.multi_factor_authentication.error.MultiFactorAuthenticationError;
 import it.infn.mw.iam.authn.multi_factor_authentication.error.NoMultiFactorSecretError;
+import it.infn.mw.iam.core.user.exception.MfaSecretNotFoundException;
 import it.infn.mw.iam.persistence.model.IamAccount;
+import it.infn.mw.iam.persistence.model.IamTotpMfa;
 import it.infn.mw.iam.persistence.model.IamTotpRecoveryCode;
+import it.infn.mw.iam.persistence.repository.IamTotpMfaRepository;
 
 // TODO if the resetting of recovery codes after use is a requirement, we need to prevent the user
 // from accessing IAM webpages after authenticating. This may require an additional ROLE for
@@ -49,10 +55,16 @@ public class RecoveryCodeManagementController {
   public static final String RECOVERY_CODE_GET_URL = "/iam/authenticator-app/recovery-code/get";
 
   private final AccountUtils accountUtils;
+  private final IamTotpMfaRepository totpMfaRepository;
+  private final IamTotpRecoveryCodeResetService recoveryCodeResetService;
 
   @Autowired
-  public RecoveryCodeManagementController(AccountUtils accountUtils) {
+  public RecoveryCodeManagementController(AccountUtils accountUtils,
+      IamTotpMfaRepository totpMfaRepository,
+      IamTotpRecoveryCodeResetService recoveryCodeResetService) {
     this.accountUtils = accountUtils;
+    this.totpMfaRepository = totpMfaRepository;
+    this.recoveryCodeResetService = recoveryCodeResetService;
   }
 
   @PreAuthorize("hasRole('USER')")
@@ -76,12 +88,17 @@ public String viewRecoveryCodes(ModelMap model) {
     IamAccount account = accountUtils.getAuthenticatedUserAccount()
       .orElseThrow(() -> new MultiFactorAuthenticationError("Account not found"));
 
-    if (account.getTotpMfa() == null || !account.getTotpMfa().isActive()) {
-      throw new NoMultiFactorSecretError(
-          "No multi-factor secret is associated with account " + account.getUsername());
+    Optional totpMfaOptional = totpMfaRepository.findByAccount(account);
+    if (!totpMfaOptional.isPresent()) {
+      throw new MfaSecretNotFoundException("No multi-factor secret is attached to this account");
     }
 
-    List recs = new ArrayList<>(account.getTotpMfa().getRecoveryCodes());
+    IamTotpMfa totpMfa = totpMfaOptional.get();
+    if (!totpMfa.isActive()) {
+      throw new MfaSecretNotFoundException("No multi-factor secret is attached to this account");
+    }
+
+    List recs = new ArrayList<>(totpMfa.getRecoveryCodes());
     String[] codes = new String[recs.size()];
 
     for (int i = 0; i < recs.size(); i++) {
@@ -91,6 +108,17 @@ public String viewRecoveryCodes(ModelMap model) {
     return codes;
   }
 
+  @PreAuthorize("hasRole('USER')")
+  @RequestMapping(method = RequestMethod.PUT, path = RECOVERY_CODE_RESET_URL)
+  public ResponseEntity resetRecoveryCodes() {
+    IamAccount account = accountUtils.getAuthenticatedUserAccount()
+      .orElseThrow(() -> new MultiFactorAuthenticationError("Account not found"));
+
+    recoveryCodeResetService.resetRecoveryCodes(account);
+
+    return ResponseEntity.ok().build();
+  }
+
   @ResponseStatus(code = HttpStatus.BAD_REQUEST)
   @ExceptionHandler(MultiFactorAuthenticationError.class)
   @ResponseBody
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/IamTotpMfaConfig.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/IamTotpMfaConfig.java
index 82906d435..4e85af3f9 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/IamTotpMfaConfig.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/IamTotpMfaConfig.java
@@ -38,6 +38,7 @@
 import dev.samstevens.totp.secret.SecretGenerator;
 import dev.samstevens.totp.time.SystemTimeProvider;
 import it.infn.mw.iam.api.account.AccountUtils;
+import it.infn.mw.iam.api.account.multi_factor_authentication.IamTotpRecoveryCodeResetService;
 import it.infn.mw.iam.api.aup.AUPSignatureCheckService;
 import it.infn.mw.iam.authn.multi_factor_authentication.MultiFactorRecoveryCodeCheckProvider;
 import it.infn.mw.iam.authn.multi_factor_authentication.MultiFactorTotpCheckProvider;
@@ -46,6 +47,7 @@
 import it.infn.mw.iam.authn.multi_factor_authentication.ResetOrSkipRecoveryCodesFilter;
 import it.infn.mw.iam.authn.multi_factor_authentication.ViewRecoveryCodesFilter;
 import it.infn.mw.iam.persistence.repository.IamAccountRepository;
+import it.infn.mw.iam.persistence.repository.IamTotpMfaRepository;
 
 // TODO add admin config options from properties file
 
@@ -61,9 +63,15 @@ public class IamTotpMfaConfig {
   @Autowired
   private IamAccountRepository accountRepo;
 
+  @Autowired
+  private IamTotpMfaRepository totpMfaRepository;
+
   @Autowired
   private AUPSignatureCheckService aupSignatureCheckService;
 
+  @Autowired
+  private IamTotpRecoveryCodeResetService recoveryCodeResetService;
+
   @Autowired
   private AccountUtils accountUtils;
 
@@ -129,7 +137,7 @@ public MultiFactorVerificationFilter multiFactorVerificationFilter(
   public ResetOrSkipRecoveryCodesFilter resetOrSkipRecoveryCodesFilter() {
 
     ResetOrSkipRecoveryCodesFilter filter = new ResetOrSkipRecoveryCodesFilter(accountUtils,
-        aupSignatureCheckService, accountRepo, iamBaseUrl);
+        aupSignatureCheckService, accountRepo, iamBaseUrl, recoveryCodeResetService);
 
     return filter;
   }
@@ -160,11 +168,11 @@ public AuthenticationFailureHandler failureHandler() {
 
   @Bean
   public MultiFactorTotpCheckProvider totpCheckProvider(CodeVerifier codeVerifier) {
-    return new MultiFactorTotpCheckProvider(accountRepo, codeVerifier);
+    return new MultiFactorTotpCheckProvider(accountRepo, totpMfaRepository, codeVerifier);
   }
 
   @Bean
   public MultiFactorRecoveryCodeCheckProvider recoveryCodeCheckProvider() {
-    return new MultiFactorRecoveryCodeCheckProvider(accountRepo);
+    return new MultiFactorRecoveryCodeCheckProvider(accountRepo, totpMfaRepository);
   }
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java
index 30533790e..35563f692 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java
@@ -71,6 +71,7 @@
 import it.infn.mw.iam.config.IamProperties;
 import it.infn.mw.iam.core.IamLocalAuthenticationProvider;
 import it.infn.mw.iam.persistence.repository.IamAccountRepository;
+import it.infn.mw.iam.persistence.repository.IamTotpMfaRepository;
 
 @SuppressWarnings("deprecation")
 @Configuration
@@ -114,6 +115,9 @@ public static class UserLoginConfig extends WebSecurityConfigurerAdapter {
     @Autowired
     private IamAccountRepository accountRepo;
 
+    @Autowired
+    private IamTotpMfaRepository totpMfaRepository;
+
     @Autowired
     private AUPSignatureCheckService aupSignatureCheckService;
 
@@ -129,7 +133,7 @@ public static class UserLoginConfig extends WebSecurityConfigurerAdapter {
     @Autowired
     public void configureGlobal(final AuthenticationManagerBuilder auth) throws Exception {
       // @formatter:off
-      auth.authenticationProvider(new IamLocalAuthenticationProvider(iamProperties, iamUserDetailsService, passwordEncoder, accountRepo));
+      auth.authenticationProvider(new IamLocalAuthenticationProvider(iamProperties, iamUserDetailsService, passwordEncoder, accountRepo, totpMfaRepository));
       // @formatter:on
     }
 
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/IamLocalAuthenticationProvider.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/IamLocalAuthenticationProvider.java
index 4b07f9bb8..73449f04b 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/IamLocalAuthenticationProvider.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/IamLocalAuthenticationProvider.java
@@ -20,6 +20,7 @@
 import java.util.ArrayList;
 import java.util.HashSet;
 import java.util.List;
+import java.util.Optional;
 import java.util.Set;
 import java.util.function.Predicate;
 
@@ -39,7 +40,9 @@
 import it.infn.mw.iam.config.IamProperties;
 import it.infn.mw.iam.config.IamProperties.LocalAuthenticationAllowedUsers;
 import it.infn.mw.iam.persistence.model.IamAccount;
+import it.infn.mw.iam.persistence.model.IamTotpMfa;
 import it.infn.mw.iam.persistence.repository.IamAccountRepository;
+import it.infn.mw.iam.persistence.repository.IamTotpMfaRepository;
 
 public class IamLocalAuthenticationProvider extends DaoAuthenticationProvider {
 
@@ -47,16 +50,19 @@ public class IamLocalAuthenticationProvider extends DaoAuthenticationProvider {
 
   private final LocalAuthenticationAllowedUsers allowedUsers;
   private final IamAccountRepository accountRepo;
+  private final IamTotpMfaRepository totpMfaRepository;
 
   private static final Predicate ADMIN_MATCHER =
       a -> a.getAuthority().equals("ROLE_ADMIN");
 
   public IamLocalAuthenticationProvider(IamProperties properties, UserDetailsService uds,
-      PasswordEncoder passwordEncoder, IamAccountRepository accountRepo) {
+      PasswordEncoder passwordEncoder, IamAccountRepository accountRepo,
+      IamTotpMfaRepository totpMfaRepository) {
     this.allowedUsers = properties.getLocalAuthn().getEnabledFor();
     setUserDetailsService(uds);
     setPasswordEncoder(passwordEncoder);
     this.accountRepo = accountRepo;
+    this.totpMfaRepository = totpMfaRepository;
   }
 
   @Override
@@ -75,7 +81,8 @@ public Authentication authenticate(Authentication authentication) throws Authent
 
     ExtendedAuthenticationToken token;
 
-    if (account.getTotpMfa() != null && account.getTotpMfa().isActive()) {
+    Optional totpMfaOptional = totpMfaRepository.findByAccount(account);
+    if (totpMfaOptional.isPresent() && totpMfaOptional.get().isActive()) {
       List currentAuthorities = new ArrayList<>();
       for (GrantedAuthority authority : authentication.getAuthorities()) {
         currentAuthorities.add(new SimpleGrantedAuthority(authority.getAuthority()));
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/DefaultIamAccountService.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/DefaultIamAccountService.java
index 175d52538..337f1b0ab 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/DefaultIamAccountService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/DefaultIamAccountService.java
@@ -18,20 +18,11 @@
 import static com.google.common.base.Preconditions.checkArgument;
 import static com.google.common.base.Preconditions.checkNotNull;
 import static com.google.common.base.Strings.isNullOrEmpty;
-import it.infn.mw.iam.audit.events.account.multi_factor_authentication.AuthenticatorAppEnabledEvent;
-import it.infn.mw.iam.audit.events.account.multi_factor_authentication.AuthenticatorAppDisabledEvent;
 import static it.infn.mw.iam.core.lifecycle.ExpiredAccountsHandler.LIFECYCLE_STATUS_LABEL;
-import it.infn.mw.iam.core.user.exception.MfaSecretAlreadyBoundException;
-import it.infn.mw.iam.core.user.exception.MfaSecretNotFoundException;
-import it.infn.mw.iam.core.user.exception.TotpMfaAlreadyEnabledException;
-import it.infn.mw.iam.persistence.model.IamTotpMfa;
-import it.infn.mw.iam.persistence.model.IamTotpRecoveryCode;
-
 import static java.util.Objects.isNull;
 
 import java.time.Clock;
 import java.util.Date;
-import java.util.HashSet;
 import java.util.LinkedHashSet;
 import java.util.List;
 import java.util.Optional;
@@ -50,8 +41,6 @@
 import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
 
-import dev.samstevens.totp.recovery.RecoveryCodeGenerator;
-import dev.samstevens.totp.secret.SecretGenerator;
 import it.infn.mw.iam.audit.events.account.AccountCreatedEvent;
 import it.infn.mw.iam.audit.events.account.AccountDisabledEvent;
 import it.infn.mw.iam.audit.events.account.AccountEndTimeUpdatedEvent;
@@ -92,15 +81,12 @@ public class DefaultIamAccountService implements IamAccountService, ApplicationE
   private final PasswordEncoder passwordEncoder;
   private ApplicationEventPublisher eventPublisher;
   private final OAuth2TokenEntityService tokenService;
-  private final SecretGenerator secretGenerator;
-  private final RecoveryCodeGenerator recoveryCodeGenerator;
   private final IamAccountClientRepository accountClientRepo;
 
   @Autowired
   public DefaultIamAccountService(Clock clock, IamAccountRepository accountRepo,
       IamGroupRepository groupRepo, IamAuthoritiesRepository authoritiesRepo,
       PasswordEncoder passwordEncoder, ApplicationEventPublisher eventPublisher,
-      SecretGenerator secretGenerator, RecoveryCodeGenerator recoveryCodeGenerator,
       OAuth2TokenEntityService tokenService, IamAccountClientRepository accountClientRepo) {
 
     this.clock = clock;
@@ -110,8 +96,6 @@ public DefaultIamAccountService(Clock clock, IamAccountRepository accountRepo,
     this.passwordEncoder = passwordEncoder;
     this.eventPublisher = eventPublisher;
     this.tokenService = tokenService;
-    this.secretGenerator = secretGenerator;
-    this.recoveryCodeGenerator = recoveryCodeGenerator;
     this.accountClientRepo = accountClientRepo;
   }
 
@@ -139,14 +123,6 @@ private void attributeRemovedEvent(IamAccount account, IamAttribute attribute) {
     eventPublisher.publishEvent(new AccountAttributeRemovedEvent(this, account, attribute));
   }
 
-  private void authenticatorAppEnabledEvent(IamAccount account) {
-    eventPublisher.publishEvent(new AuthenticatorAppEnabledEvent(this, account));
-  }
-
-  private void authenticatorAppDisabledEvent(IamAccount account) {
-    eventPublisher.publishEvent(new AuthenticatorAppDisabledEvent(this, account));
-  }
-
   @Override
   public IamAccount createAccount(IamAccount account) {
     checkNotNull(account, "Cannot create a null account");
@@ -592,105 +568,4 @@ public IamAccount removeSshKey(IamAccount account, IamSshKey key) {
   public void setApplicationEventPublisher(ApplicationEventPublisher applicationEventPublisher) {
     eventPublisher = applicationEventPublisher;
   }
-
-  // TODO encrypt secret and recovery codes
-  // TODO move this secret generation to its own class
-
-  /**
-   * Generates and attaches a TOTP MFA secret to a user account, along with a set of recovery codes
-   * This is pre-emptive to actually enabling TOTP MFA on the account - the secret is written for
-   * server-side TOTP verification
-   * 
-   * @param account the account to add the secret to
-   * @return the account with the new secret added to it
-   */
-  @Override
-  public IamAccount addTotpMfaSecret(IamAccount account) {
-    if (!isNull(account.getTotpMfa()) && account.getTotpMfa().isActive()) {
-      throw new MfaSecretAlreadyBoundException(
-          "A multi-factor secret is already assigned to this account");
-    }
-
-    // Generate secret
-    IamTotpMfa totpMfa = new IamTotpMfa(account);
-    totpMfa.setSecret(secretGenerator.generate());
-    totpMfa.setAccount(account);
-    account.setTotpMfa(totpMfa);
-
-    // Generate recovery codes
-    account = addTotpMfaRecoveryCodes(account);
-
-    accountRepo.save(account);
-    return account;
-  }
-
-  @Override
-  public IamAccount addTotpMfaRecoveryCodes(IamAccount account) {
-    if (isNull(account.getTotpMfa())) {
-      throw new MfaSecretNotFoundException("No multi-factor secret is attached to this account");
-    }
-
-    IamTotpMfa totpMfa = account.getTotpMfa();
-
-    // Generate recovery codes
-    String[] recoveryCodeStrings = recoveryCodeGenerator.generateCodes(6);
-    Set recoveryCodes = new HashSet<>();
-    for (String code : recoveryCodeStrings) {
-      IamTotpRecoveryCode recoveryCode = new IamTotpRecoveryCode(totpMfa);
-      recoveryCode.setCode(code);
-      recoveryCodes.add(recoveryCode);
-    }
-
-    // Attach to account
-    totpMfa.setRecoveryCodes(recoveryCodes);
-    totpMfa.touch();
-    return account;
-  }
-
-
-  /**
-   * Enables TOTP MFA on a provided account. Relies on the account already having a non-active TOTP
-   * secret attached to it
-   * 
-   * @param account the account to enable TOTP MFA on
-   * @return the account with newly-enabled TOTP MFA
-   */
-  @Override
-  public IamAccount enableTotpMfa(IamAccount account) {
-    if (isNull(account.getTotpMfa())) {
-      throw new MfaSecretNotFoundException("No multi-factor secret is attached to this account");
-    } else if (account.getTotpMfa().isActive()) {
-      throw new TotpMfaAlreadyEnabledException("TOTP MFA is already enabled on this account");
-    }
-
-    IamTotpMfa totpMfa = account.getTotpMfa();
-    totpMfa.setActive(true);
-    account.setTotpMfa(totpMfa);
-
-    account = saveAccount(account);
-    authenticatorAppEnabledEvent(account);
-    return account;
-  }
-
-
-  /**
-   * Disables TOTP MFA on a provided account. Relies on the account having an active TOTP secret
-   * attached to it. Disabling means to delete the secret entirely (if a user chooses to enable
-   * again, a new secret is generated anyway)
-   * 
-   * @param account the account to disable TOTP MFA on
-   * @return the account with newly-disabled TOTP MFA
-   */
-  @Override
-  public IamAccount disableTotpMfa(IamAccount account) {
-    if (isNull(account.getTotpMfa())) {
-      throw new MfaSecretNotFoundException("No multi-factor secret is attached to this account");
-    }
-
-    account.setTotpMfa(null);
-
-    account = saveAccount(account);
-    authenticatorAppDisabledEvent(account);
-    return account;
-  }
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/IamAccountService.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/IamAccountService.java
index 120eab34d..edcc481d0 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/IamAccountService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/IamAccountService.java
@@ -184,30 +184,4 @@ public interface IamAccountService {
    */
   IamAccount removeSshKey(IamAccount account, IamSshKey key);
 
-  /**
-   * Adds a TOTP secret to an account
-   * 
-   * @param account the account to add the secret to
-   * @return the updated account
-   */
-  IamAccount addTotpMfaSecret(IamAccount account);
-
-  IamAccount addTotpMfaRecoveryCodes(IamAccount account);
-
-  /**
-   * Enable TOTP MFA on account with TOTP secret
-   * 
-   * @param account the account to enable TOTP MFA on
-   * @return the updated account
-   */
-  IamAccount enableTotpMfa(IamAccount account);
-
-  /**
-   * Disable TOTP MFA on account with TOTP secret
-   * 
-   * @param account the account to disable TOTP MFA on
-   * @return the updated account
-   */
-  IamAccount disableTotpMfa(IamAccount account);
-
 }
diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/recovery-codes-reset-confirm.html b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/recovery-codes-reset-confirm.html
index e693b43fd..84f9dee85 100644
--- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/recovery-codes-reset-confirm.html
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/recovery-codes-reset-confirm.html
@@ -27,6 +27,6 @@ 
Reset recovery codes

 
 
 

-  
+  
   
 

\ No newline at end of file
diff --git a/iam-login-service/src/test/java/it/infn/mw/iam/test/TestUtils.java b/iam-login-service/src/test/java/it/infn/mw/iam/test/TestUtils.java
index a01876716..af46b36ac 100644
--- a/iam-login-service/src/test/java/it/infn/mw/iam/test/TestUtils.java
+++ b/iam-login-service/src/test/java/it/infn/mw/iam/test/TestUtils.java
@@ -29,7 +29,7 @@
 
 public class TestUtils {
 
-  public static final int TOTAL_USERS_COUNT = 253;
+  public static final int TOTAL_USERS_COUNT = 254;
   public static final String CLIENT_CRED_GRANT_CLIENT_ID = "client-cred";
   public static final String CLIENT_CRED_GRANT_CLIENT_SECRET = "secret";
   public static final String PASSWORD_GRANT_CLIENT_ID = "password-grant";
diff --git a/iam-login-service/src/test/java/it/infn/mw/iam/test/api/account/search/service/DefaultPagedAccountsServiceTests.java b/iam-login-service/src/test/java/it/infn/mw/iam/test/api/account/search/service/DefaultPagedAccountsServiceTests.java
index 59dfb11d6..63915a8b7 100644
--- a/iam-login-service/src/test/java/it/infn/mw/iam/test/api/account/search/service/DefaultPagedAccountsServiceTests.java
+++ b/iam-login-service/src/test/java/it/infn/mw/iam/test/api/account/search/service/DefaultPagedAccountsServiceTests.java
@@ -44,7 +44,7 @@
 public class DefaultPagedAccountsServiceTests extends AccountServiceUtils {
 
   public static final int ITEMS_PER_PAGE = 10;
-  public static final long TOTAL_TEST_ACCOUNTS = 253L;
+  public static final long TOTAL_TEST_ACCOUNTS = 254L;
   private static final int LAST_PAGE_NUMBER = (int) Math.ceil(TOTAL_TEST_ACCOUNTS / ITEMS_PER_PAGE);
   private static final int LAST_PAGE_SIZE = (int) (long) TOTAL_TEST_ACCOUNTS % ITEMS_PER_PAGE;
   private static final int LAST_PAGE_OFFSET =
@@ -139,7 +139,8 @@ public void testGetFirstPageSortByNameDesc() {
   @Test
   public void testGetLastPageSortByNameAsc() {
 
-    OffsetPageable op = new OffsetPageable(LAST_PAGE_OFFSET, ITEMS_PER_PAGE, getSortByName(Sort.Direction.ASC));
+    OffsetPageable op =
+        new OffsetPageable(LAST_PAGE_OFFSET, ITEMS_PER_PAGE, getSortByName(Sort.Direction.ASC));
     Page page = accountService.getPage(op);
     assertSortIsByNameAsc(page.getContent());
   }
@@ -148,7 +149,8 @@ public void testGetLastPageSortByNameAsc() {
   @Test
   public void testGetLastPageSortByNameDesc() {
 
-    OffsetPageable op = new OffsetPageable(LAST_PAGE_OFFSET, ITEMS_PER_PAGE, getSortByName(Sort.Direction.DESC));
+    OffsetPageable op =
+        new OffsetPageable(LAST_PAGE_OFFSET, ITEMS_PER_PAGE, getSortByName(Sort.Direction.DESC));
     Page page = accountService.getPage(op);
     assertSortIsByNameDesc(page.getContent());
   }
diff --git a/iam-login-service/src/test/java/it/infn/mw/iam/test/repository/IamTotpMfaRepositoryTests.java b/iam-login-service/src/test/java/it/infn/mw/iam/test/repository/IamTotpMfaRepositoryTests.java
new file mode 100644
index 000000000..5359ba943
--- /dev/null
+++ b/iam-login-service/src/test/java/it/infn/mw/iam/test/repository/IamTotpMfaRepositoryTests.java
@@ -0,0 +1,53 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.infn.mw.iam.test.repository;
+
+import static org.junit.Assert.assertNotNull;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.test.context.junit4.SpringRunner;
+
+import it.infn.mw.iam.persistence.model.IamAccount;
+import it.infn.mw.iam.persistence.model.IamTotpMfa;
+import it.infn.mw.iam.persistence.repository.IamAccountRepository;
+import it.infn.mw.iam.persistence.repository.IamTotpMfaRepository;
+import it.infn.mw.iam.test.util.annotation.IamNoMvcTest;
+
+@RunWith(SpringRunner.class)
+@IamNoMvcTest
+public class IamTotpMfaRepositoryTests {
+
+  @Autowired
+  private IamTotpMfaRepository totpMfaRepo;
+
+  @Autowired
+  private IamAccountRepository accountRepo;
+
+  @Test
+  public void testAccountIdResolutionWorksAsExpected() {
+
+    IamAccount testAccount = accountRepo.findByUsername("test-with-mfa")
+      .orElseThrow(() -> new AssertionError("Expected 'test-with-mfa' user not found"));
+
+    IamTotpMfa totpMfa = totpMfaRepo.findByAccount(testAccount)
+      .orElseThrow(() -> new AssertionError("Expected totp mfa secret not found"));
+
+    assertNotNull(totpMfa);
+  }
+
+}
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAccount.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAccount.java
index eb3aa7e3f..2055eb6ec 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAccount.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamAccount.java
@@ -92,10 +92,6 @@ public class IamAccount implements Serializable {
   @JoinColumn(name = "user_info_id")
   private IamUserInfo userInfo;
 
-  @OneToOne(cascade = CascadeType.ALL, orphanRemoval = true)
-  @JoinColumn(name = "totp_mfa_id", nullable = true)
-  private IamTotpMfa totpMfa;
-
   @Temporal(TemporalType.TIMESTAMP)
   @Column(name = "last_login_time", nullable = true)
   private Date lastLoginTime;
@@ -249,14 +245,6 @@ public void setActive(final boolean active) {
     this.active = active;
   }
 
-  public IamTotpMfa getTotpMfa() {
-    return totpMfa;
-  }
-
-  public void setTotpMfa(final IamTotpMfa totpMfa) {
-    this.totpMfa = totpMfa;
-  }
-
   public Set getSamlIds() {
 
     return samlIds;
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpMfa.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpMfa.java
index e06967bed..b92328f89 100644
--- a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpMfa.java
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/model/IamTotpMfa.java
@@ -141,12 +141,8 @@ public Set getRecoveryCodes() {
   }
 
   public void setRecoveryCodes(final Set recoveryCodes) {
-    if (this.recoveryCodes.isEmpty()) {
-      this.recoveryCodes = recoveryCodes;
-    } else {
-      this.recoveryCodes.clear();
-      this.recoveryCodes.addAll(recoveryCodes);
-    }
+    this.recoveryCodes.clear();
+    this.recoveryCodes.addAll(recoveryCodes);
   }
 
   @Override
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamTotpMfaRepository.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamTotpMfaRepository.java
new file mode 100644
index 000000000..e392c98fe
--- /dev/null
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamTotpMfaRepository.java
@@ -0,0 +1,28 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.infn.mw.iam.persistence.repository;
+
+import java.util.Optional;
+
+import org.springframework.data.repository.CrudRepository;
+
+import it.infn.mw.iam.persistence.model.IamTotpMfa;
+
+public interface IamTotpMfaRepository
+    extends CrudRepository, IamTotpMfaRepositoryCustom {
+
+  Optional findByAccountId(Long id);
+}
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamTotpMfaRepositoryCustom.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamTotpMfaRepositoryCustom.java
new file mode 100644
index 000000000..e70725180
--- /dev/null
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamTotpMfaRepositoryCustom.java
@@ -0,0 +1,26 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.infn.mw.iam.persistence.repository;
+
+import java.util.Optional;
+
+import it.infn.mw.iam.persistence.model.IamAccount;
+import it.infn.mw.iam.persistence.model.IamTotpMfa;
+
+public interface IamTotpMfaRepositoryCustom {
+
+  Optional findByAccount(IamAccount account);
+}
diff --git a/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamTotpMfaRepositoryImpl.java b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamTotpMfaRepositoryImpl.java
new file mode 100644
index 000000000..a8975abb1
--- /dev/null
+++ b/iam-persistence/src/main/java/it/infn/mw/iam/persistence/repository/IamTotpMfaRepositoryImpl.java
@@ -0,0 +1,37 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.infn.mw.iam.persistence.repository;
+
+import java.util.Optional;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Component;
+
+import it.infn.mw.iam.persistence.model.IamAccount;
+import it.infn.mw.iam.persistence.model.IamTotpMfa;
+
+@Component
+public class IamTotpMfaRepositoryImpl implements IamTotpMfaRepositoryCustom {
+
+  @Autowired
+  IamTotpMfaRepository repo;
+
+  @Override
+  public Optional findByAccount(IamAccount account) {
+    return repo.findByAccountId(account.getId());
+  }
+
+}
diff --git a/iam-persistence/src/main/resources/db/migration/h2/V70___totp_mfa.sql b/iam-persistence/src/main/resources/db/migration/h2/V70___totp_mfa.sql
index d16dd28eb..94f0cc2dd 100644
--- a/iam-persistence/src/main/resources/db/migration/h2/V70___totp_mfa.sql
+++ b/iam-persistence/src/main/resources/db/migration/h2/V70___totp_mfa.sql
@@ -1,15 +1,9 @@
 -- TOTP MFA secrets
 
-CREATE TABLE iam_totp_mfa (ID BIGINT IDENTITY NOT NULL, active BOOLEAN NOT NULL, secret VARCHAR(256) NOT NULL, creation_time TIMESTAMP NOT NULL, last_update_time TIMESTAMP NOT NULL, ACCOUNT_ID BIGINT, PRIMARY KEY (ID));
+CREATE TABLE iam_totp_mfa (ID BIGINT IDENTITY NOT NULL, active BOOLEAN NOT NULL, secret VARCHAR(255) NOT NULL, creation_time TIMESTAMP NOT NULL, last_update_time TIMESTAMP NOT NULL, ACCOUNT_ID BIGINT, PRIMARY KEY (ID));
 
 CREATE TABLE iam_totp_recovery_code (ID BIGINT IDENTITY NOT NULL, code VARCHAR(255) NOT NULL, totp_mfa_id BIGINT NOT NULL, PRIMARY KEY (ID));
 
-ALTER TABLE iam_account ADD COLUMN totp_mfa_id BIGINT;
-
-ALTER TABLE iam_account ADD CONSTRAINT FK_iam_account_totp_mfa_id FOREIGN KEY (totp_mfa_id) REFERENCES iam_totp_mfa (ID);
-
 ALTER TABLE iam_totp_mfa ADD CONSTRAINT FK_iam_totp_mfa_account_id FOREIGN KEY (ACCOUNT_ID) REFERENCES iam_account (ID);
 
 ALTER TABLE iam_totp_recovery_code ADD CONSTRAINT FK_iam_totp_recovery_code_totp_mfa_id FOREIGN KEY (totp_mfa_id) REFERENCES iam_totp_mfa (ID);
-
-CREATE INDEX idx_iam_totp_mfa_id ON iam_account (totp_mfa_id);
\ No newline at end of file
diff --git a/iam-persistence/src/main/resources/db/migration/h2/V71___add_pre_authenticated_authority.sql b/iam-persistence/src/main/resources/db/migration/h2/V71___add_pre_authenticated_authority.sql
index cb9d92e6c..efb0eed8b 100644
--- a/iam-persistence/src/main/resources/db/migration/h2/V71___add_pre_authenticated_authority.sql
+++ b/iam-persistence/src/main/resources/db/migration/h2/V71___add_pre_authenticated_authority.sql
@@ -1,2 +1,2 @@
-INSERT INTO iam_authority(ID, AUTH) VALUES
-(3, 'ROLE_PRE_AUTHENTICATED');
\ No newline at end of file
+INSERT INTO iam_authority(AUTH) VALUES
+('ROLE_PRE_AUTHENTICATED');
diff --git a/iam-persistence/src/main/resources/db/migration/mysql/V70___totp_mfa.sql b/iam-persistence/src/main/resources/db/migration/mysql/V70___totp_mfa.sql
index 237819648..cad0a9082 100644
--- a/iam-persistence/src/main/resources/db/migration/mysql/V70___totp_mfa.sql
+++ b/iam-persistence/src/main/resources/db/migration/mysql/V70___totp_mfa.sql
@@ -1,15 +1,9 @@
 -- TOTP MFA secrets
 
-CREATE TABLE iam_totp_mfa (ID BIGINT AUTO_INCREMENT NOT NULL, active TINYINT(1) default 0 NOT NULL, secret VARCHAR(256) NOT NULL, creation_time DATETIME NOT NULL, last_update_time DATETIME NOT NULL, ACCOUNT_ID BIGINT, PRIMARY KEY (ID));
+CREATE TABLE iam_totp_mfa (ID BIGINT AUTO_INCREMENT NOT NULL, active TINYINT(1) default 0 NOT NULL, secret VARCHAR(255) NOT NULL, creation_time DATETIME NOT NULL, last_update_time DATETIME NOT NULL, ACCOUNT_ID BIGINT, PRIMARY KEY (ID));
 
 CREATE TABLE iam_totp_recovery_code (ID BIGINT AUTO_INCREMENT NOT NULL, code VARCHAR(255) NOT NULL, totp_mfa_id BIGINT NOT NULL, PRIMARY KEY (ID));
 
-ALTER TABLE iam_account ADD totp_mfa_id BIGINT;
-
-ALTER TABLE iam_account ADD CONSTRAINT FK_iam_account_totp_mfa_id FOREIGN KEY (totp_mfa_id) REFERENCES iam_totp_mfa (ID);
-
 ALTER TABLE iam_totp_mfa ADD CONSTRAINT FK_iam_totp_mfa_account_id FOREIGN KEY (ACCOUNT_ID) REFERENCES iam_account (ID);
 
 ALTER TABLE iam_totp_recovery_code ADD CONSTRAINT FK_iam_totp_recovery_code_totp_mfa_id FOREIGN KEY (totp_mfa_id) REFERENCES iam_totp_mfa (ID);
-
-CREATE INDEX idx_iam_totp_mfa_id ON iam_account (totp_mfa_id);
\ No newline at end of file
diff --git a/iam-persistence/src/main/resources/db/migration/mysql/V71___add_pre_authenticated_authority.sql b/iam-persistence/src/main/resources/db/migration/mysql/V71___add_pre_authenticated_authority.sql
new file mode 100644
index 000000000..54a86d5cd
--- /dev/null
+++ b/iam-persistence/src/main/resources/db/migration/mysql/V71___add_pre_authenticated_authority.sql
@@ -0,0 +1,2 @@
+INSERT INTO iam_authority(AUTH) VALUES
+('ROLE_PRE_AUTHENTICATED');
\ No newline at end of file
diff --git a/iam-persistence/src/main/resources/db/migration/mysql/V71___add_pre_authenticed_authority.sql b/iam-persistence/src/main/resources/db/migration/mysql/V71___add_pre_authenticed_authority.sql
deleted file mode 100644
index cb9d92e6c..000000000
--- a/iam-persistence/src/main/resources/db/migration/mysql/V71___add_pre_authenticed_authority.sql
+++ /dev/null
@@ -1,2 +0,0 @@
-INSERT INTO iam_authority(ID, AUTH) VALUES
-(3, 'ROLE_PRE_AUTHENTICATED');
\ No newline at end of file
diff --git a/iam-persistence/src/main/resources/db/migration/test/V100000___test_data.sql b/iam-persistence/src/main/resources/db/migration/test/V100000___test_data.sql
index 8a0af4419..2462c35e5 100644
--- a/iam-persistence/src/main/resources/db/migration/test/V100000___test_data.sql
+++ b/iam-persistence/src/main/resources/db/migration/test/V100000___test_data.sql
@@ -176,11 +176,13 @@ INSERT INTO client_grant_type (owner_id, grant_type) VALUES
   (14, 'urn:ietf:params:oauth:grant-type:device_code');
     
 INSERT INTO iam_user_info(ID,GIVENNAME,FAMILYNAME, EMAIL, EMAILVERIFIED, BIRTHDATE, GENDER) VALUES
-(2, 'Test', 'User', 'test@iam.test', true, '1950-01-01','M');
+  (2, 'Test', 'User', 'test@iam.test', true, '1950-01-01','M'),
+  (1000, 'Test', 'MFA', 'testwithmfa@iam.test', true, '2000-01-01','F');
 
 
 INSERT INTO iam_account(id, uuid, username, password, user_info_id, creationtime, lastupdatetime, active) VALUES
-(2, '80e5fb8d-b7c8-451a-89ba-346ae278a66f', 'test', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 2, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true);
+  (2, '80e5fb8d-b7c8-451a-89ba-346ae278a66f', 'test', '$2a$10$UZeOZKD1.dj5oiTsZKD03OETA9FXCKGqBuuijhsxYygZpOPtWMUni', 2, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true),
+  (1000, '467c882e-90da-11ec-b909-0242ac120002', 'test-with-mfa', '$2a$12$S3lUZw/ESq9lULn5he6bBu9KNGCvs7C2rWo0XdVC6t65ITwAc22w2', 1000, CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), true);
 
 
 INSERT INTO iam_oidc_id(issuer, subject, account_id) VALUES
@@ -1511,5 +1513,6 @@ insert into iam_account_client(id, account_id, client_id, creation_time) VALUES
 (3, 199, 1, CURRENT_TIMESTAMP()),
 (4, 199, 2, CURRENT_TIMESTAMP());
 
-
-
+-- TOTP multi-factor secrets
+insert into iam_totp_mfa(active, secret, creation_time, last_update_time, account_id) VALUES
+(true, 'secret', CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP(), 1000);

From 6513b094f8e978fe9893ee049476d8ca60aaef65 Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Tue, 8 Mar 2022 15:49:32 +0000
Subject: [PATCH 72/76] Adding comments, fixing assigned authorities bug

Fixing a problem with granted authorities. Earlier changes to code meant that certain parts of the website could still be visited after only one step of authentication. This was because ROLE_USER was accidentally assigned alongside ROLE_PRE_AUTHENTICATED. This is being fixed by assigning the user's fully authenticated authorities to a separate field in the ExtendedAuthenticationToken, while the token's official authorities only contains ROLE_PRE_AUTHENTICATED. Once full authentication occurs, the full set of authorities are granted to the user.
---
 .gitignore                                    |  3 +-
 .../infn/mw/iam/api/account/AccountUtils.java | 19 ++++-
 .../DefaultIamTotpMfaService.java             |  6 +-
 ...efaultIamTotpRecoveryCodeResetService.java |  9 +-
 .../IamTotpMfaService.java                    | 21 +++--
 .../IamTotpRecoveryCodeResetService.java      |  5 ++
 .../MultiFactorSettingsController.java        |  4 +-
 .../MultiFactorSettingsDTO.java               |  1 -
 .../authenticator_app/CodeDTO.java            |  1 -
 .../SecretAndDataUriDTO.java                  |  2 -
 .../error/BadMfaCodeError.java                |  4 +-
 .../AuthenticatorAppDisabledEvent.java        |  3 +-
 .../AuthenticatorAppEnabledEvent.java         |  3 +-
 .../MultiFactorEvent.java                     |  3 +-
 .../RecoveryCodesResetEvent.java              |  3 +-
 ...eckMultiFactorIsEnabledSuccessHandler.java | 33 ++++++--
 .../MfaVerifyController.java                  | 15 +++-
 .../MultiFactorRecoveryCodeCheckProvider.java | 22 ++---
 .../MultiFactorTotpCheckProvider.java         | 18 ++--
 .../MultiFactorVerificationFilter.java        | 20 +++--
 ...MultiFactorVerificationSuccessHandler.java | 26 +++++-
 .../ResetOrSkipRecoveryCodesFilter.java       |  9 +-
 .../ViewRecoveryCodesFilter.java              |  8 +-
 .../RecoveryCodeManagementController.java     | 31 +++++--
 .../infn/mw/iam/authn/util/Authorities.java   |  2 +
 .../infn/mw/iam/config/IamTotpMfaConfig.java  | 13 +++
 .../VerifyButtonProperties.java               |  3 +
 .../config/security/IamWebSecurityConfig.java | 29 +++++--
 .../iam/core/ExtendedAuthenticationToken.java | 65 +++++++++++----
 .../core/IamLocalAuthenticationProvider.java  | 50 ++++++++---
 .../iam/IamJWTProfileIdTokenCustomizer.java   |  9 +-
 .../MfaSecretAlreadyBoundException.java       |  5 +-
 .../exception/MfaSecretNotFoundException.java |  5 +-
 .../TotpMfaAlreadyEnabledException.java       |  5 +-
 ...tiFactorVerificationPageConfiguration.java |  3 +
 ...tiFactorVerificationPageConfiguration.java |  3 +
 .../verify-authenticator-app-form.jsp         | 83 +++++++++----------
 .../webapp/WEB-INF/views/iam/verify-mfa.jsp   |  8 +-
 .../user/mfa/user.mfa.component.html          |  9 +-
 .../services/authenticator-app.service.js     |  1 -
 .../templates/home/editmfasettings.html       | 67 ++++++++-------
 41 files changed, 403 insertions(+), 226 deletions(-)

diff --git a/.gitignore b/.gitignore
index dc1c1d9b5..2dd068b79 100644
--- a/.gitignore
+++ b/.gitignore
@@ -28,5 +28,4 @@ travis/travis-build.out
 travis/travis-mitre-build.out
 
 *.iml
-.idea
-**/.factorypath
+.idea
\ No newline at end of file
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/AccountUtils.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/AccountUtils.java
index cfd6fcea8..e0b607142 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/AccountUtils.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/AccountUtils.java
@@ -27,6 +27,7 @@
 import org.springframework.stereotype.Component;
 
 import it.infn.mw.iam.authn.util.Authorities;
+import it.infn.mw.iam.core.ExtendedAuthenticationToken;
 import it.infn.mw.iam.persistence.model.IamAccount;
 import it.infn.mw.iam.persistence.repository.IamAccountRepository;
 
@@ -57,15 +58,27 @@ public boolean isAdmin(Authentication auth) {
     return auth.getAuthorities().contains(Authorities.ROLE_ADMIN);
   }
 
+  public boolean isPreAuthenticated(Authentication auth) {
+    if (auth == null || auth.getAuthorities() == null) {
+      return false;
+    }
+
+    return auth.getAuthorities().contains(Authorities.ROLE_PRE_AUTHENTICATED);
+  }
+
   public boolean isAuthenticated() {
     Authentication auth = SecurityContextHolder.getContext().getAuthentication();
 
     return isAuthenticated(auth);
   }
 
-  // TODO check pre-authenticated status
   public boolean isAuthenticated(Authentication auth) {
-    return !(isNull(auth) || auth instanceof AnonymousAuthenticationToken);
+    if (isNull(auth) || auth instanceof AnonymousAuthenticationToken) {
+      return false;
+    } else if (auth instanceof ExtendedAuthenticationToken && !auth.isAuthenticated()) {
+      return false;
+    }
+    return true;
   }
 
   public Optional getAuthenticatedUserAccount(Authentication authn) {
@@ -97,6 +110,4 @@ public Optional getAuthenticatedUserAccount() {
   public Optional getByAccountId(String accountId) {
     return accountRepo.findByUuid(accountId);
   }
-
-  // TODO potentially add checks for pre-authenticated status
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/DefaultIamTotpMfaService.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/DefaultIamTotpMfaService.java
index f020a687d..9dd7e276b 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/DefaultIamTotpMfaService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/DefaultIamTotpMfaService.java
@@ -40,6 +40,8 @@
 @Service
 public class DefaultIamTotpMfaService implements IamTotpMfaService, ApplicationEventPublisherAware {
 
+  public static final int RECOVERY_CODE_QUANTITY = 6;
+
   private final IamAccountService iamAccountService;
   private final IamTotpMfaRepository totpMfaRepository;
   private final SecretGenerator secretGenerator;
@@ -73,7 +75,7 @@ public void setApplicationEventPublisher(ApplicationEventPublisher applicationEv
   /**
    * Generates and attaches a TOTP MFA secret to a user account, along with a set of recovery codes
    * This is pre-emptive to actually enabling TOTP MFA on the account - the secret is written for
-   * server-side TOTP verification
+   * server-side TOTP verification during the user's enabling of MFA on their account
    * 
    * @param account the account to add the secret to
    * @return the new TOTP secret
@@ -171,7 +173,7 @@ public IamTotpMfa disableTotpMfa(IamAccount account) {
   }
 
   private Set generateRecoveryCodes(IamTotpMfa totpMfa) {
-    String[] recoveryCodeStrings = recoveryCodeGenerator.generateCodes(6);
+    String[] recoveryCodeStrings = recoveryCodeGenerator.generateCodes(RECOVERY_CODE_QUANTITY);
     Set recoveryCodes = new HashSet<>();
     for (String code : recoveryCodeStrings) {
       IamTotpRecoveryCode recoveryCode = new IamTotpRecoveryCode(totpMfa);
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/DefaultIamTotpRecoveryCodeResetService.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/DefaultIamTotpRecoveryCodeResetService.java
index 25ace696f..44e95aa5a 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/DefaultIamTotpRecoveryCodeResetService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/DefaultIamTotpRecoveryCodeResetService.java
@@ -15,6 +15,8 @@
  */
 package it.infn.mw.iam.api.account.multi_factor_authentication;
 
+import static it.infn.mw.iam.api.account.multi_factor_authentication.DefaultIamTotpMfaService.RECOVERY_CODE_QUANTITY;
+
 import java.util.HashSet;
 import java.util.Optional;
 import java.util.Set;
@@ -55,6 +57,11 @@ public void setApplicationEventPublisher(ApplicationEventPublisher applicationEv
     this.eventPublisher = applicationEventPublisher;
   }
 
+  /**
+   * Regenerates the recovery codes attached to a provided MFA-enabled IAM account
+   * 
+   * @param account - the account to regenerate codes on
+   */
   @Override
   public void resetRecoveryCodes(IamAccount account) {
     Optional totpMfaOptional = totpMfaRepository.findByAccount(account);
@@ -63,7 +70,7 @@ public void resetRecoveryCodes(IamAccount account) {
     }
 
     IamTotpMfa totpMfa = totpMfaOptional.get();
-    String[] recoveryCodeStrings = recoveryCodeGenerator.generateCodes(6);
+    String[] recoveryCodeStrings = recoveryCodeGenerator.generateCodes(RECOVERY_CODE_QUANTITY);
     Set recoveryCodes = new HashSet<>();
     for (String code : recoveryCodeStrings) {
       IamTotpRecoveryCode recoveryCode = new IamTotpRecoveryCode(totpMfa);
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/IamTotpMfaService.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/IamTotpMfaService.java
index de96c37a7..09f551b5a 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/IamTotpMfaService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/IamTotpMfaService.java
@@ -21,34 +21,39 @@
 public interface IamTotpMfaService {
 
   /**
-   * Adds a TOTP secret to an account
+   * Generates and attaches a TOTP MFA secret to a user account, along with a set of recovery codes
+   * This is pre-emptive to actually enabling TOTP MFA on the account - the secret is written for
+   * server-side TOTP verification during the user's enabling of MFA on their account
    * 
    * @param account the account to add the secret to
-   * @return the added secret
+   * @return the new TOTP secret
    */
   IamTotpMfa addTotpMfaSecret(IamAccount account);
 
   /**
-   * Adds recovery codes to a TOTP secret
+   * Adds a set of recovery codes to a given account's TOTP secret.
    * 
-   * @param account the account who's TOTP secret we will add recovery codes to
+   * @param account the account to add recovery codes to
    * @return the affected TOTP secret
    */
   IamTotpMfa addTotpMfaRecoveryCodes(IamAccount account);
 
   /**
-   * Enable TOTP MFA on account with TOTP secret
+   * Enables TOTP MFA on a provided account. Relies on the account already having a non-active TOTP
+   * secret attached to it
    * 
    * @param account the account to enable TOTP MFA on
-   * @return the enabled secret
+   * @return the newly-enabled TOTP secret
    */
   IamTotpMfa enableTotpMfa(IamAccount account);
 
   /**
-   * Disable TOTP MFA on account with TOTP secret
+   * Disables TOTP MFA on a provided account. Relies on the account having an active TOTP secret
+   * attached to it. Disabling means to delete the secret entirely (if a user chooses to enable
+   * again, a new secret is generated anyway)
    * 
    * @param account the account to disable TOTP MFA on
-   * @return the disabled secret
+   * @return the newly-disabled TOTP MFA
    */
   IamTotpMfa disableTotpMfa(IamAccount account);
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/IamTotpRecoveryCodeResetService.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/IamTotpRecoveryCodeResetService.java
index 071b6e3f7..d0b63f789 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/IamTotpRecoveryCodeResetService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/IamTotpRecoveryCodeResetService.java
@@ -19,5 +19,10 @@
 
 public interface IamTotpRecoveryCodeResetService {
 
+  /**
+   * Regenerates the recovery codes attached to a provided MFA-enabled IAM account
+   * 
+   * @param account - the account to regenerate codes on
+   */
   public void resetRecoveryCodes(IamAccount account);
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/MultiFactorSettingsController.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/MultiFactorSettingsController.java
index 74377f762..804da3110 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/MultiFactorSettingsController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/MultiFactorSettingsController.java
@@ -42,8 +42,8 @@
 public class MultiFactorSettingsController {
 
   public static final String MULTI_FACTOR_SETTINGS_URL = "/iam/multi-factor-settings";
-  final IamAccountRepository accountRepository;
-  final IamTotpMfaRepository totpMfaRepository;
+  private final IamAccountRepository accountRepository;
+  private final IamTotpMfaRepository totpMfaRepository;
 
   @Autowired
   public MultiFactorSettingsController(IamAccountRepository accountRepository,
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/MultiFactorSettingsDTO.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/MultiFactorSettingsDTO.java
index dbf554b23..06fbd9492 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/MultiFactorSettingsDTO.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/MultiFactorSettingsDTO.java
@@ -46,7 +46,6 @@ public boolean getAuthenticatorAppActive() {
 
   /**
    * @param authenticatorAppActive new status of authenticator app
-   * @return nothing
    */
   public void setAuthenticatorAppActive(final boolean authenticatorAppActive) {
     this.authenticatorAppActive = authenticatorAppActive;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/CodeDTO.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/CodeDTO.java
index a54fb2925..5264458f9 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/CodeDTO.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/CodeDTO.java
@@ -41,7 +41,6 @@ public String getCode() {
 
   /**
    * @param code new code
-   * @return nothing
    */
   public void setCode(final String code) {
     this.code = code;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/SecretAndDataUriDTO.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/SecretAndDataUriDTO.java
index 2bfe60c48..649293dc4 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/SecretAndDataUriDTO.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/SecretAndDataUriDTO.java
@@ -42,7 +42,6 @@ public String getSecret() {
 
   /**
    * @param secret the new secret
-   * @return nothing
    */
   public void setSecret(final String secret) {
     this.secret = secret;
@@ -59,7 +58,6 @@ public String getDataUri() {
 
   /**
    * @param dataUri the new QR code data URI
-   * @return nothing
    */
   public void setDataUri(final String dataUri) {
     this.dataUri = dataUri;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/error/BadMfaCodeError.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/error/BadMfaCodeError.java
index 6f737642a..88ab60b00 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/error/BadMfaCodeError.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/error/BadMfaCodeError.java
@@ -16,9 +16,7 @@
 package it.infn.mw.iam.api.account.multi_factor_authentication.authenticator_app.error;
 
 public class BadMfaCodeError extends RuntimeException {
-  /**
-  * 
-  */
+
   private static final long serialVersionUID = 1L;
 
   public BadMfaCodeError(String msg) {
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/AuthenticatorAppDisabledEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/AuthenticatorAppDisabledEvent.java
index efb0835af..76a5ae64a 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/AuthenticatorAppDisabledEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/AuthenticatorAppDisabledEvent.java
@@ -21,8 +21,7 @@ public class AuthenticatorAppDisabledEvent extends MultiFactorEvent {
 
   public static final String TEMPLATE = "Authenticator app MFA disabled on  account '%s'";
 
-  // TODO add this in
-  // private static final long serialVersionUID = 3213253939764135733L;
+  private static final long serialVersionUID = 1L;
 
   public AuthenticatorAppDisabledEvent(Object source, IamAccount account) {
     super(source, account, String.format(TEMPLATE, account.getUsername()));
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/AuthenticatorAppEnabledEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/AuthenticatorAppEnabledEvent.java
index 4a291cfa5..e39caf571 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/AuthenticatorAppEnabledEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/AuthenticatorAppEnabledEvent.java
@@ -21,8 +21,7 @@ public class AuthenticatorAppEnabledEvent extends MultiFactorEvent {
 
   public static final String TEMPLATE = "Authenticator app MFA enabled on account '%s'";
 
-  // TODO add this in
-  // private static final long serialVersionUID = 3213253939764135733L;
+  private static final long serialVersionUID = 1L;
 
   public AuthenticatorAppEnabledEvent(Object source, IamAccount account) {
     super(source, account, String.format(TEMPLATE, account.getUsername()));
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/MultiFactorEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/MultiFactorEvent.java
index a09a957de..67a8b12c6 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/MultiFactorEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/MultiFactorEvent.java
@@ -20,8 +20,7 @@
 
 public class MultiFactorEvent extends AccountEvent {
 
-  // TODO determine this
-  // private static final long serialVersionUID = 1L;
+  private static final long serialVersionUID = 1L;
 
   protected MultiFactorEvent(Object source, IamAccount account, String message) {
     super(source, account, message);
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/RecoveryCodesResetEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/RecoveryCodesResetEvent.java
index dc4c409ef..b8ab53731 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/RecoveryCodesResetEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/RecoveryCodesResetEvent.java
@@ -21,8 +21,7 @@ public class RecoveryCodesResetEvent extends MultiFactorEvent {
 
   public static final String TEMPLATE = "MFA recovery codes reset on account '%s'";
 
-  // TODO add this in
-  // private static final long serialVersionUID = 3213253939764135733L;
+  private static final long serialVersionUID = 1L;
 
   public RecoveryCodesResetEvent(Object source, IamAccount account) {
     super(source, account, String.format(TEMPLATE, account.getUsername()));
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/CheckMultiFactorIsEnabledSuccessHandler.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/CheckMultiFactorIsEnabledSuccessHandler.java
index b4b23ae14..b1ec53fe9 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/CheckMultiFactorIsEnabledSuccessHandler.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/CheckMultiFactorIsEnabledSuccessHandler.java
@@ -35,6 +35,13 @@
 import it.infn.mw.iam.api.aup.AUPSignatureCheckService;
 import it.infn.mw.iam.persistence.repository.IamAccountRepository;
 
+import it.infn.mw.iam.authn.util.Authorities;
+
+/**
+ * Success handler for the normal login flow. This determines if MFA is enabled on an account and,
+ * if so, redirects the user to a verification page. Otherwise, the default success handler is
+ * called
+ */
 public class CheckMultiFactorIsEnabledSuccessHandler implements AuthenticationSuccessHandler {
 
   private final AccountUtils accountUtils;
@@ -59,25 +66,32 @@ public void onAuthenticationSuccess(HttpServletRequest request, HttpServletRespo
 
   protected void handle(HttpServletRequest request, HttpServletResponse response,
       Authentication authentication) throws IOException, ServletException {
-    boolean isMfaEnabled = isMfaEnabled(authentication);
+    boolean isPreAuthenticated = isPreAuthenticated(authentication);
 
     if (response.isCommitted()) {
       System.out
         .println("Response has already been committed. Unable to redirect to " + MFA_VERIFY_URL);
       return;
-    } else if (isMfaEnabled) {
-      // session.setAttribute(REQUESTING_SIGNATURE, true);
+    } else if (isPreAuthenticated) {
       response.sendRedirect(MFA_VERIFY_URL);
     } else {
       continueWithDefaultSuccessHandler(request, response, authentication);
     }
   }
 
-  protected boolean isMfaEnabled(final Authentication authentication) {
+  /**
+   * If the user account is MFA enabled, the authentication provider would have assigned a role of
+   * PRE_AUTHENTICATED at this stage. This function verifies that to determine if we need
+   * redirecting to the verification page
+   * 
+   * @param authentication the user authentication
+   * @return true if PRE_AUTHENTICATED
+   */
+  protected boolean isPreAuthenticated(final Authentication authentication) {
     final Collection authorities = authentication.getAuthorities();
     for (final GrantedAuthority grantedAuthority : authorities) {
       String authorityName = grantedAuthority.getAuthority();
-      if (authorityName.equals("ROLE_PRE_AUTHENTICATED")) {
+      if (authorityName.equals(Authorities.ROLE_PRE_AUTHENTICATED.getAuthority())) {
         return true;
       }
     }
@@ -85,6 +99,15 @@ protected boolean isMfaEnabled(final Authentication authentication) {
     return false;
   }
 
+  /**
+   * This calls the normal success handler if the user does not have MFA enabled.
+   * 
+   * @param request
+   * @param response
+   * @param auth the user authentication
+   * @throws IOException
+   * @throws ServletException
+   */
   protected void continueWithDefaultSuccessHandler(HttpServletRequest request,
       HttpServletResponse response, Authentication auth) throws IOException, ServletException {
 
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MfaVerifyController.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MfaVerifyController.java
index 2a29170a1..c92ee1e04 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MfaVerifyController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MfaVerifyController.java
@@ -41,14 +41,15 @@
 
 //TODO when unauthenticated and navigating to other pages like /dashboard, we redirect to /login. But here we show up as unauthorized. Can we replicate the behaviour of /dashboard?
 
+/**
+ * Presents the step-up authentication page for verifying identity after successful username +
+ * password authentication. Only accessible if the user is pre-authenticated, i.e. has authenticated
+ * with username + password but not fully authenticated yet
+ */
 @Controller
 @RequestMapping(MFA_VERIFY_URL)
 public class MfaVerifyController {
 
-  // TODO - step up authentication page can't read SPRING_SECURITY_LAST_EXCEPTION.message to display
-  // "Bad code" error. Fix this and use
-  // ExternalAuthenticationHandlerSupport.saveAuthenticationErrorInSession() as a reference
-
   public static final String MFA_VERIFY_URL = "/iam/verify";
   final IamAccountRepository accountRepository;
   final IamTotpMfaRepository totpMfaRepository;
@@ -71,6 +72,12 @@ public String getVerifyMfaView(Authentication authentication, ModelMap model) {
     return "iam/verify-mfa";
   }
 
+  /**
+   * Populates a DTO containing info on which additional factors of authentication are active
+   * 
+   * @param account the MFA-enabled account
+   * @return DTO with populated settings
+   */
   private MultiFactorSettingsDTO populateMfaSettings(IamAccount account) {
     MultiFactorSettingsDTO dto = new MultiFactorSettingsDTO();
 
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorRecoveryCodeCheckProvider.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorRecoveryCodeCheckProvider.java
index 071bbe309..4c6f7cfc2 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorRecoveryCodeCheckProvider.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorRecoveryCodeCheckProvider.java
@@ -17,8 +17,6 @@
 
 import static it.infn.mw.iam.authn.multi_factor_authentication.IamAuthenticationMethodReference.AuthenticationMethodReferenceValues.ONE_TIME_PASSWORD;
 
-import java.util.ArrayList;
-import java.util.List;
 import java.util.Optional;
 import java.util.Set;
 
@@ -26,8 +24,6 @@
 import org.springframework.security.authentication.BadCredentialsException;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.AuthenticationException;
-import org.springframework.security.core.GrantedAuthority;
-import org.springframework.security.core.authority.SimpleGrantedAuthority;
 
 import it.infn.mw.iam.core.ExtendedAuthenticationToken;
 import it.infn.mw.iam.core.user.exception.MfaSecretNotFoundException;
@@ -37,6 +33,10 @@
 import it.infn.mw.iam.persistence.repository.IamAccountRepository;
 import it.infn.mw.iam.persistence.repository.IamTotpMfaRepository;
 
+/**
+ * Grants full authentication by verifying a provided MFA recovery code. Only comes into play in the
+ * step-up authentication flow.
+ */
 public class MultiFactorRecoveryCodeCheckProvider implements AuthenticationProvider {
 
   private final IamAccountRepository accountRepo;
@@ -70,6 +70,7 @@ public Authentication authenticate(Authentication authentication) throws Authent
       throw new MfaSecretNotFoundException("No multi-factor secret is attached to this account");
     }
 
+    // Check for a matching recovery code
     Set accountRecoveryCodes = totpMfa.getRecoveryCodes();
     for (IamTotpRecoveryCode recoveryCodeObject : accountRecoveryCodes) {
       String recoveryCodeString = recoveryCodeObject.getCode();
@@ -88,18 +89,9 @@ protected Authentication createSuccessfulAuthentication(ExtendedAuthenticationTo
     refs.add(otp);
     token.setAuthenticationMethodReferences(refs);
 
-    List authorities = new ArrayList<>();
-    for (GrantedAuthority authority : token.getAuthorities()) {
-      authorities.add(new SimpleGrantedAuthority(authority.getAuthority()));
-    }
-    authorities.remove(new SimpleGrantedAuthority("ROLE_PRE_AUTHENTICATED"));
-
-    // account.getAuthorities()
-    // .stream()
-    // .forEach(authority -> authorities.add(new SimpleGrantedAuthority(authority.getAuthority())));
-
     ExtendedAuthenticationToken newToken = new ExtendedAuthenticationToken(token.getPrincipal(),
-        token.getCredentials(), authorities, token.getAuthenticationMethodReferences());
+        token.getCredentials(), token.getFullyAuthenticatedAuthorities());
+    newToken.setAuthenticationMethodReferences(token.getAuthenticationMethodReferences());
     newToken.setAuthenticated(true);
 
     return newToken;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorTotpCheckProvider.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorTotpCheckProvider.java
index f0570e7ec..e250e9087 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorTotpCheckProvider.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorTotpCheckProvider.java
@@ -17,8 +17,6 @@
 
 import static it.infn.mw.iam.authn.multi_factor_authentication.IamAuthenticationMethodReference.AuthenticationMethodReferenceValues.ONE_TIME_PASSWORD;
 
-import java.util.ArrayList;
-import java.util.List;
 import java.util.Optional;
 import java.util.Set;
 
@@ -26,8 +24,6 @@
 import org.springframework.security.authentication.BadCredentialsException;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.AuthenticationException;
-import org.springframework.security.core.GrantedAuthority;
-import org.springframework.security.core.authority.SimpleGrantedAuthority;
 
 import dev.samstevens.totp.code.CodeVerifier;
 import it.infn.mw.iam.core.ExtendedAuthenticationToken;
@@ -37,6 +33,10 @@
 import it.infn.mw.iam.persistence.repository.IamAccountRepository;
 import it.infn.mw.iam.persistence.repository.IamTotpMfaRepository;
 
+/**
+ * Grants full authentication by verifying a provided MFA TOTP. Only comes into play in the step-up
+ * authentication flow.
+ */
 public class MultiFactorTotpCheckProvider implements AuthenticationProvider {
 
   private final IamAccountRepository accountRepo;
@@ -74,6 +74,7 @@ public Authentication authenticate(Authentication authentication) throws Authent
 
     String mfaSecret = totpMfa.getSecret();
 
+    // Verify provided TOTP
     if (codeVerifier.isValidCode(mfaSecret, totp)) {
       return createSuccessfulAuthentication(token);
     }
@@ -88,14 +89,9 @@ protected Authentication createSuccessfulAuthentication(ExtendedAuthenticationTo
     refs.add(otp);
     token.setAuthenticationMethodReferences(refs);
 
-    List authorities = new ArrayList<>();
-    for (GrantedAuthority authority : token.getAuthorities()) {
-      authorities.add(new SimpleGrantedAuthority(authority.getAuthority()));
-    }
-    authorities.remove(new SimpleGrantedAuthority("ROLE_PRE_AUTHENTICATED"));
-
     ExtendedAuthenticationToken newToken = new ExtendedAuthenticationToken(token.getPrincipal(),
-        token.getCredentials(), authorities, token.getAuthenticationMethodReferences());
+        token.getCredentials(), token.getFullyAuthenticatedAuthorities());
+    newToken.setAuthenticationMethodReferences(token.getAuthenticationMethodReferences());
     newToken.setAuthenticated(true);
 
     return newToken;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorVerificationFilter.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorVerificationFilter.java
index f13020c91..fa40554a7 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorVerificationFilter.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorVerificationFilter.java
@@ -34,6 +34,11 @@
 
 import it.infn.mw.iam.core.ExtendedAuthenticationToken;
 
+/**
+ * Used in the MFA verification flow. Receives either a TOTP or recovery code and constructs the
+ * authentication request with this parameter. The request is passed to dedicated authentication
+ * providers which will create the full authentication or raise the appropriate exception
+ */
 public class MultiFactorVerificationFilter extends AbstractAuthenticationProcessingFilter {
 
   public static final String TOTP_MFA_CODE_KEY = "totp";
@@ -41,7 +46,7 @@ public class MultiFactorVerificationFilter extends AbstractAuthenticationProcess
   public static final String TOTP_VERIFIED = "TOTP_VERIFIED";
   public static final String RECOVERY_CODE_VERIFIED = "RECOVERY_CODE_VERIFIED";
 
-  private static final AntPathRequestMatcher DEFAULT_ANT_PATH_REQUEST_MATCHER =
+  public static final AntPathRequestMatcher DEFAULT_MFA_VERIFY_ANT_PATH_REQUEST_MATCHER =
       new AntPathRequestMatcher("/iam/verify", "POST");
 
   private final boolean postOnly = true;
@@ -51,7 +56,7 @@ public class MultiFactorVerificationFilter extends AbstractAuthenticationProcess
 
   public MultiFactorVerificationFilter(AuthenticationManager authenticationManager,
       AuthenticationSuccessHandler successHandler, AuthenticationFailureHandler failureHandler) {
-    super(DEFAULT_ANT_PATH_REQUEST_MATCHER, authenticationManager);
+    super(DEFAULT_MFA_VERIFY_ANT_PATH_REQUEST_MATCHER, authenticationManager);
     setAuthenticationSuccessHandler(successHandler);
     setAuthenticationFailureHandler(failureHandler);
   }
@@ -71,6 +76,7 @@ public Authentication attemptAuthentication(HttpServletRequest request,
 
     ExtendedAuthenticationToken authRequest = (ExtendedAuthenticationToken) auth;
 
+    // Parse TOTP and recovery code from request (only one should be set)
     String totp = parseTotp(request);
     String recoveryCode = parseRecoveryCode(request);
 
@@ -82,8 +88,8 @@ public Authentication attemptAuthentication(HttpServletRequest request,
       throw new ProviderNotFoundException("No valid totp code or recovery code was received");
     }
 
-    Authentication newAuth = this.getAuthenticationManager().authenticate(authRequest);
-    if (newAuth == null) {
+    Authentication fullAuthentication = this.getAuthenticationManager().authenticate(authRequest);
+    if (fullAuthentication == null) {
       throw new ProviderNotFoundException("No valid totp code or recovery code was received");
     }
 
@@ -93,9 +99,13 @@ public Authentication attemptAuthentication(HttpServletRequest request,
       request.setAttribute(RECOVERY_CODE_VERIFIED, Boolean.TRUE);
     }
 
-    return newAuth;
+    return fullAuthentication;
   }
 
+  /**
+   * Overriding default method because we don't want to invalidate authentication. Doing so would
+   * remove our PRE_AUTHENTICATED role, which would kick us out of the verification process
+   */
   @Override
   protected void unsuccessfulAuthentication(HttpServletRequest request,
       HttpServletResponse response, AuthenticationException failed)
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorVerificationSuccessHandler.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorVerificationSuccessHandler.java
index 7a991f4f5..79d7a4a92 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorVerificationSuccessHandler.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorVerificationSuccessHandler.java
@@ -16,18 +16,20 @@
 package it.infn.mw.iam.authn.multi_factor_authentication;
 
 import static it.infn.mw.iam.authn.multi_factor_authentication.MfaVerifyController.MFA_VERIFY_URL;
-import static it.infn.mw.iam.authn.multi_factor_authentication.authenticator_app.RecoveryCodeManagementController.RECOVERY_CODE_RESET_URL;
+import static it.infn.mw.iam.authn.multi_factor_authentication.MultiFactorVerificationFilter.TOTP_VERIFIED;
 import static it.infn.mw.iam.authn.multi_factor_authentication.MultiFactorVerificationFilter.RECOVERY_CODE_VERIFIED;
+import static it.infn.mw.iam.authn.multi_factor_authentication.authenticator_app.RecoveryCodeManagementController.RECOVERY_CODE_RESET_URL;
 
 import java.io.IOException;
 
 import javax.servlet.ServletException;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
+import javax.servlet.http.HttpSession;
 
 import org.springframework.security.core.Authentication;
+import org.springframework.security.web.WebAttributes;
 import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
-// import org.springframework.security.web.savedrequest.RequestCache;
 import org.springframework.security.web.savedrequest.HttpSessionRequestCache;
 
 import it.infn.mw.iam.api.account.AccountUtils;
@@ -36,6 +38,10 @@
 import it.infn.mw.iam.authn.RootIsDashboardSuccessHandler;
 import it.infn.mw.iam.persistence.repository.IamAccountRepository;
 
+/**
+ * Determines if a recovery code was used to authenticate. If so, we need to redirect to the page
+ * that asks if the user wants to reset their recovery codes or skip this step to continue onwards.
+ */
 public class MultiFactorVerificationSuccessHandler implements AuthenticationSuccessHandler {
 
   private final AccountUtils accountUtils;
@@ -56,15 +62,17 @@ public MultiFactorVerificationSuccessHandler(AccountUtils accountUtils,
   public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response,
       Authentication authentication) throws IOException, ServletException {
     handle(request, response, authentication);
+    clearAuthenticationAttributes(request);
   }
 
-  protected void handle(HttpServletRequest request, HttpServletResponse response,
+  private void handle(HttpServletRequest request, HttpServletResponse response,
       Authentication authentication) throws IOException, ServletException {
     if (response.isCommitted()) {
       System.out
         .println("Response has already been committed. Unable to redirect to " + MFA_VERIFY_URL);
       return;
     } else {
+      // If a recovery code was used, RECOVERY_CODE_VERIFIED attribute will exist in the request
       Object recoveryCodeVerifiedAttribute = request.getAttribute(RECOVERY_CODE_VERIFIED);
       if (recoveryCodeVerifiedAttribute != null
           && (boolean) recoveryCodeVerifiedAttribute == Boolean.TRUE) {
@@ -75,7 +83,7 @@ protected void handle(HttpServletRequest request, HttpServletResponse response,
     }
   }
 
-  public void continueWithDefaultSuccessHandler(HttpServletRequest request,
+  private void continueWithDefaultSuccessHandler(HttpServletRequest request,
       HttpServletResponse response, Authentication auth) throws IOException, ServletException {
 
     AuthenticationSuccessHandler delegate =
@@ -85,5 +93,15 @@ public void continueWithDefaultSuccessHandler(HttpServletRequest request,
         aupSignatureCheckService, accountUtils, accountRepo);
     handler.onAuthenticationSuccess(request, response, auth);
   }
+
+  protected void clearAuthenticationAttributes(HttpServletRequest request) {
+    HttpSession session = request.getSession(false);
+    if (session == null) {
+      return;
+    }
+    session.removeAttribute(WebAttributes.AUTHENTICATION_EXCEPTION);
+    request.removeAttribute(TOTP_VERIFIED);
+    request.removeAttribute(RECOVERY_CODE_VERIFIED);
+  }
 }
 
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/ResetOrSkipRecoveryCodesFilter.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/ResetOrSkipRecoveryCodesFilter.java
index 2225119be..f66ea7f75 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/ResetOrSkipRecoveryCodesFilter.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/ResetOrSkipRecoveryCodesFilter.java
@@ -44,6 +44,10 @@
 import it.infn.mw.iam.persistence.model.IamAccount;
 import it.infn.mw.iam.persistence.repository.IamAccountRepository;
 
+/**
+ * Filter for handling user response from page that asks user to reset recovery codes or skip this
+ * step. This is received through a POST request and then the request is redirected appropriately
+ */
 public class ResetOrSkipRecoveryCodesFilter extends GenericFilterBean {
 
   public static final String RESET_KEY = "reset";
@@ -87,11 +91,14 @@ private void doFilter(HttpServletRequest request, HttpServletResponse response,
     String skip = request.getParameter(skipParameter);
 
     if (reset != null) {
+      // User chose to reset, retrieve authenticated account so we can reset its codes then redirect
+      // to the recovery code view page
       IamAccount account =
           accountUtils.getAuthenticatedUserAccount().orElseThrow(NoAuthenticatedUserError::new);
       recoveryCodeResetService.resetRecoveryCodes(account);
       response.sendRedirect(RECOVERY_CODE_VIEW_URL);
     } else if (skip != null) {
+      // User chose not to reset, continue with normal success handler
       chain.doFilter(request, response);
       Authentication auth = SecurityContextHolder.getContext().getAuthentication();
       continueWithDefaultSuccessHandler(request, response, auth);
@@ -101,7 +108,7 @@ private void doFilter(HttpServletRequest request, HttpServletResponse response,
     }
   }
 
-  protected boolean requiresProcessing(HttpServletRequest request, HttpServletResponse response) {
+  private boolean requiresProcessing(HttpServletRequest request, HttpServletResponse response) {
     if (DEFAULT_ANT_PATH_REQUEST_MATCHER.matches(request)) {
       return true;
     }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/ViewRecoveryCodesFilter.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/ViewRecoveryCodesFilter.java
index 69c271918..238fef722 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/ViewRecoveryCodesFilter.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/ViewRecoveryCodesFilter.java
@@ -40,6 +40,10 @@
 import it.infn.mw.iam.authn.RootIsDashboardSuccessHandler;
 import it.infn.mw.iam.persistence.repository.IamAccountRepository;
 
+/**
+ * Filter for handling user response from page to view recovery codes post-authentication and
+ * post-reset. Only response is to continue with the normal success handler.
+ */
 public class ViewRecoveryCodesFilter extends GenericFilterBean {
 
   private static final AntPathRequestMatcher DEFAULT_ANT_PATH_REQUEST_MATCHER =
@@ -76,7 +80,7 @@ private void doFilter(HttpServletRequest request, HttpServletResponse response,
     continueWithDefaultSuccessHandler(request, response, auth);
   }
 
-  protected boolean requiresProcessing(HttpServletRequest request, HttpServletResponse response) {
+  private boolean requiresProcessing(HttpServletRequest request, HttpServletResponse response) {
     if (DEFAULT_ANT_PATH_REQUEST_MATCHER.matches(request)) {
       return true;
     }
@@ -87,7 +91,7 @@ protected boolean requiresProcessing(HttpServletRequest request, HttpServletResp
     return false;
   }
 
-  protected void continueWithDefaultSuccessHandler(HttpServletRequest request,
+  private void continueWithDefaultSuccessHandler(HttpServletRequest request,
       HttpServletResponse response, Authentication auth) throws IOException, ServletException {
 
     AuthenticationSuccessHandler delegate =
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/RecoveryCodeManagementController.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/RecoveryCodeManagementController.java
index 8f79cec54..77db9460d 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/RecoveryCodeManagementController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/authenticator_app/RecoveryCodeManagementController.java
@@ -42,11 +42,11 @@
 import it.infn.mw.iam.persistence.model.IamTotpRecoveryCode;
 import it.infn.mw.iam.persistence.repository.IamTotpMfaRepository;
 
-// TODO if the resetting of recovery codes after use is a requirement, we need to prevent the user
-// from accessing IAM webpages after authenticating. This may require an additional ROLE for
-// handling this. Should also try and tie this in with a generic page for resetting recovery codes
-// for anyone who is logged in
-
+/**
+ * Provides webpages related to recovery codes. Most of this appears if the user chooses to use a
+ * recovery code in the MFA login flow. Also partially used in the multi-factor settings menu on the
+ * dashboard.
+ */
 @Controller
 public class RecoveryCodeManagementController {
 
@@ -67,12 +67,21 @@ public RecoveryCodeManagementController(AccountUtils accountUtils,
     this.recoveryCodeResetService = recoveryCodeResetService;
   }
 
+  /**
+   * @return page for asking if the user wishes to reset their recovery codes or skip this step
+   */
   @PreAuthorize("hasRole('USER')")
   @RequestMapping(method = RequestMethod.GET, path = RECOVERY_CODE_RESET_URL)
   public String getResetRecoveryCodesResetView() {
     return RECOVERY_CODE_RESET_URL;
   }
 
+  /**
+   * Calls method to fetch account MFA recovery codes to display on returned page
+   * 
+   * @param model to add recovery codes array to
+   * @return page for viewing account MFA recovery codes post-reset
+   */
   @PreAuthorize("hasRole('USER')")
   @RequestMapping(method = RequestMethod.GET, path = RECOVERY_CODE_VIEW_URL)
   public String viewRecoveryCodes(ModelMap model) {
@@ -82,6 +91,12 @@ public String viewRecoveryCodes(ModelMap model) {
     return RECOVERY_CODE_VIEW_URL;
   }
 
+  /**
+   * Populates and returns the array of recovery codes attached to the authenticated user account
+   * Also called in the MFA settings menu for display
+   * 
+   * @return the array of recovery codes
+   */
   @PreAuthorize("hasRole('USER')")
   @RequestMapping(method = RequestMethod.GET, path = RECOVERY_CODE_GET_URL)
   public @ResponseBody String[] getRecoveryCodes() {
@@ -108,6 +123,12 @@ public String viewRecoveryCodes(ModelMap model) {
     return codes;
   }
 
+  /**
+   * Request to reset the recovery codes on the authenticated account. TODO may wish to protect this
+   * endpoint a bit more to prevent this being done outside of the regular flow
+   * 
+   * @return 200 response upon success
+   */
   @PreAuthorize("hasRole('USER')")
   @RequestMapping(method = RequestMethod.PUT, path = RECOVERY_CODE_RESET_URL)
   public ResponseEntity resetRecoveryCodes() {
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/util/Authorities.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/util/Authorities.java
index 5586ebfe4..20aa75445 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/util/Authorities.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/util/Authorities.java
@@ -24,6 +24,8 @@ public class Authorities {
   public static final GrantedAuthority ROLE_ADMIN = new SimpleGrantedAuthority("ROLE_ADMIN");
   public static final GrantedAuthority ROLE_USER = new SimpleGrantedAuthority("ROLE_USER");
   public static final GrantedAuthority ROLE_CLIENT = new SimpleGrantedAuthority("ROLE_CLIENT");
+  public static final GrantedAuthority ROLE_PRE_AUTHENTICATED =
+      new SimpleGrantedAuthority("ROLE_PRE_AUTHENTICATED");
 
   private Authorities() {
     // prevent instantiation
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/IamTotpMfaConfig.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/IamTotpMfaConfig.java
index 4e85af3f9..27762b038 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/IamTotpMfaConfig.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/IamTotpMfaConfig.java
@@ -151,6 +151,13 @@ public ViewRecoveryCodesFilter viewRecoveryCodesFilter() {
     return filter;
   }
 
+  /**
+   * Authentication manager for the MFA verification process
+   * 
+   * @param totpCheckProvider checks a provided TOTP
+   * @param recoveryCodeCheckProvider checks a provided recovery code
+   * @return a new provider manager
+   */
   @Bean(name = "MultiFactorVerificationAuthenticationManager")
   public AuthenticationManager authenticationManager(MultiFactorTotpCheckProvider totpCheckProvider,
       MultiFactorRecoveryCodeCheckProvider recoveryCodeCheckProvider) {
@@ -162,6 +169,12 @@ public AuthenticationSuccessHandler successHandler() {
         accountRepo, iamBaseUrl);
   }
 
+  /**
+   * If we can't verify the user in step-up authentication, redirect back to the /verify endpoint
+   * with an error param
+   * 
+   * @return failure handler to redirect to /verify endpoint
+   */
   public AuthenticationFailureHandler failureHandler() {
     return new SimpleUrlAuthenticationFailureHandler("/iam/verify?error=failure");
   }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/multi_factor_authentication/VerifyButtonProperties.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/multi_factor_authentication/VerifyButtonProperties.java
index 1f51e1182..24dca1e20 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/multi_factor_authentication/VerifyButtonProperties.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/multi_factor_authentication/VerifyButtonProperties.java
@@ -20,6 +20,9 @@
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonInclude.Include;
 
+/**
+ * Verify button that appears on the MFA verification page
+ */
 @JsonInclude(Include.NON_EMPTY)
 public class VerifyButtonProperties {
   private String text;
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java
index 35563f692..3ecebb677 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java
@@ -78,8 +78,6 @@
 @EnableWebSecurity
 public class IamWebSecurityConfig {
 
-
-
   @Bean
   public SecurityEvaluationContextExtension contextExtension() {
     return new SecurityEvaluationContextExtension();
@@ -180,14 +178,18 @@ protected void configure(final HttpSecurity http) throws Exception {
         .and()
           .formLogin()
             .loginPage("/login")
-            .failureUrl("/login?error=failure") // this line and line below it now may not be used. They act upon the UsernamePasswordAuthenticationFilter, which has been replaced
+            .failureUrl("/login?error=failure")
             .successHandler(successHandler())
         .and()
           .exceptionHandling()
             .authenticationEntryPoint(entryPoint())
         .and()
-          .addFilterAt(new ExtendedAuthenticationFilter(this.authenticationManager(), successHandler(), failureHandler()), UsernamePasswordAuthenticationFilter.class)
           .addFilterBefore(authorizationRequestFilter, SecurityContextPersistenceFilter.class)
+
+          // Need to replace the UsernamePasswordAuthenticationFilter because we are now making use of the ExtendedAuthenticationToken globally
+          .addFilterAt(extendedAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class)
+
+          // Applied in the OAuth2 login flow
           .addFilterAfter(extendedHttpServletRequestFilter(), UsernamePasswordAuthenticationFilter.class)
         .logout()
           .logoutUrl("/logout")
@@ -204,7 +206,11 @@ public OAuth2WebSecurityExpressionHandler oAuth2WebSecurityExpressionHandler() {
       return new OAuth2WebSecurityExpressionHandler();
     }
 
-    @Bean
+    public ExtendedAuthenticationFilter extendedAuthenticationFilter() throws Exception {
+      return new ExtendedAuthenticationFilter(this.authenticationManager(), successHandler(),
+          failureHandler());
+    }
+
     public ExtendedHttpServletRequestFilter extendedHttpServletRequestFilter() {
       return new ExtendedHttpServletRequestFilter();
     }
@@ -347,6 +353,10 @@ public void configure(final WebSecurity builder) throws Exception {
     }
   }
 
+  /**
+   * Configure the login flow for the step-up authentication. This takes place at the /iam/verify
+   * endpoint
+   */
   @Configuration
   @Order(102)
   public static class MultiFactorConfigurationAdapter extends WebSecurityConfigurerAdapter {
@@ -359,7 +369,6 @@ public static class MultiFactorConfigurationAdapter extends WebSecurityConfigure
     @Qualifier("ResetOrSkipRecoveryCodesFilter")
     private ResetOrSkipRecoveryCodesFilter resetOrSkipRecoveryCodesFilter;
 
-    @Bean
     public AuthenticationEntryPoint mfaAuthenticationEntryPoint() {
       LoginUrlAuthenticationEntryPoint entryPoint =
           new LoginUrlAuthenticationEntryPoint("/iam/verify");
@@ -383,6 +392,10 @@ protected void configure(HttpSecurity http) throws Exception {
     }
   }
 
+  /**
+   * Configure the endpoint where users choose to either reset their recovery codes or continue with
+   * authentication process. Only used when a user provides a recovery code as verification
+   */
   @Configuration
   @Order(103)
   public static class RecoveryCodeConfigurationAdapter extends WebSecurityConfigurerAdapter {
@@ -402,6 +415,10 @@ protected void configure(HttpSecurity http) throws Exception {
     }
   }
 
+  /**
+   * Configure the endpoint for viewing recovery codes during the auth flow, following a recovery
+   * code reset
+   */
   @Configuration
   @Order(104)
   public static class RecoveryCodeViewConfigurationAdapter extends WebSecurityConfigurerAdapter {
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/ExtendedAuthenticationToken.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/ExtendedAuthenticationToken.java
index 6c0194151..4250992cf 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/ExtendedAuthenticationToken.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/ExtendedAuthenticationToken.java
@@ -24,6 +24,26 @@
 
 import it.infn.mw.iam.authn.multi_factor_authentication.IamAuthenticationMethodReference;
 
+/**
+ * 

+ * An extended auth token that functions the same as a {@code UsernamePasswordAuthenticationToken}
+ * but with some additional fields detailing more information about the methods of authentication
+ * used.
+ * 
+ * 

+ * The additional information includes:
+ * 
+ * 
    
+ * 
  • {@code Set
+ * 
  • {@code String totp} - if authenticating with a TOTP, this field is set
    • 
+ * 
  • {@code String recoveryCode} - if authenticating with a recovery code, this field is set
    • 
+ * 
  • {@code fullyAuthenticatedAuthorities} - the authorities the user will be granted if full
+ * authentication takes place. If an MFA user has only authenticated with a username and password so
+ * far, they will only officially have an authority of PRE_AUTHENTICATED
+ * 

+ */
 public class ExtendedAuthenticationToken extends AbstractAuthenticationToken {
 
   private final Object principal;
@@ -31,6 +51,7 @@ public class ExtendedAuthenticationToken extends AbstractAuthenticationToken {
   private Set authenticationMethodReferences = new HashSet<>();
   private String totp;
   private String recoveryCode;
+  private Set fullyAuthenticatedAuthorities;
 
   public ExtendedAuthenticationToken(Object principal, Object credentials) {
     super(null);
@@ -45,22 +66,22 @@ public ExtendedAuthenticationToken(Object principal, Object credentials,
     this.credentials = credentials;
   }
 
-  public ExtendedAuthenticationToken(Object principal, Object credentials,
-      Set authenticationMethodReferences) {
-    super(null);
-    this.principal = principal;
-    this.credentials = credentials;
-    this.authenticationMethodReferences = authenticationMethodReferences;
-  }
-
-  public ExtendedAuthenticationToken(Object principal, Object credentials,
-      Collection authorities,
-      Set authenticationMethodReferences) {
-    super(authorities);
-    this.principal = principal;
-    this.credentials = credentials;
-    this.authenticationMethodReferences = authenticationMethodReferences;
-  }
+  // public ExtendedAuthenticationToken(Object principal, Object credentials,
+  // Set authenticationMethodReferences) {
+  // super(null);
+  // this.principal = principal;
+  // this.credentials = credentials;
+  // this.authenticationMethodReferences = authenticationMethodReferences;
+  // }
+
+  // public ExtendedAuthenticationToken(Object principal, Object credentials,
+  // Collection authorities,
+  // Set authenticationMethodReferences) {
+  // super(authorities);
+  // this.principal = principal;
+  // this.credentials = credentials;
+  // this.authenticationMethodReferences = authenticationMethodReferences;
+  // }
 
   public ExtendedAuthenticationToken(ExtendedAuthenticationToken other) {
     super(other.getAuthorities());
@@ -69,6 +90,16 @@ public ExtendedAuthenticationToken(ExtendedAuthenticationToken other) {
     this.authenticationMethodReferences = other.getAuthenticationMethodReferences();
     this.totp = other.getTotp();
     this.recoveryCode = other.getRecoveryCode();
+    this.fullyAuthenticatedAuthorities = other.getFullyAuthenticatedAuthorities();
+  }
+
+  public Set getFullyAuthenticatedAuthorities() {
+    return fullyAuthenticatedAuthorities;
+  }
+
+  public void setFullyAuthenticatedAuthorities(
+      Set fullyAuthenticatedAuthorities) {
+    this.fullyAuthenticatedAuthorities = fullyAuthenticatedAuthorities;
   }
 
   public Set getAuthenticationMethodReferences() {
@@ -116,6 +147,8 @@ public String toString() {
     sb.append("Details=").append(getDetails()).append(", ");
     sb.append("Granted Authorities=").append(this.getAuthorities()).append(", ");
     sb.append("Authentication Method References=").append(this.getAuthenticationMethodReferences());
+    sb.append("TOTP=").append(this.getTotp());
+    sb.append("Recovery code=").append(this.getRecoveryCode());
     sb.append("]");
     return sb.toString();
   }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/IamLocalAuthenticationProvider.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/IamLocalAuthenticationProvider.java
index 73449f04b..aa782a5dd 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/IamLocalAuthenticationProvider.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/IamLocalAuthenticationProvider.java
@@ -31,12 +31,12 @@
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.AuthenticationException;
 import org.springframework.security.core.GrantedAuthority;
-import org.springframework.security.core.authority.SimpleGrantedAuthority;
 import org.springframework.security.core.userdetails.UserDetails;
 import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.crypto.password.PasswordEncoder;
 
 import it.infn.mw.iam.authn.multi_factor_authentication.IamAuthenticationMethodReference;
+import it.infn.mw.iam.authn.util.Authorities;
 import it.infn.mw.iam.config.IamProperties;
 import it.infn.mw.iam.config.IamProperties.LocalAuthenticationAllowedUsers;
 import it.infn.mw.iam.persistence.model.IamAccount;
@@ -65,36 +65,64 @@ public IamLocalAuthenticationProvider(IamProperties properties, UserDetailsServi
     this.totpMfaRepository = totpMfaRepository;
   }
 
+  /**
+   * 

+   * Overriding this to accommodate the ExtendedAuthenticationToken.
+   * 
+   * 

+   * First, we authenticate the username and password. Then we check if MFA is enabled on the
+   * account. If so, we set a {@code PRE_AUTHENTICATED} role on the user so they may be navigated to
+   * an additional authentication step. Otherwise, create a full authentication object.
+   */
   @Override
   public Authentication authenticate(Authentication authentication) throws AuthenticationException {
+
+    // The first step is to validate the default login credentials. Therefore, we convert the
+    // authentication to a UsernamePasswordAuthenticationToken and super(authenticate) in the
+    // default manner
     UsernamePasswordAuthenticationToken userpassToken = new UsernamePasswordAuthenticationToken(
         authentication.getPrincipal(), authentication.getCredentials());
     authentication = super.authenticate(userpassToken);
 
-    IamAuthenticationMethodReference pwd =
-        new IamAuthenticationMethodReference(PASSWORD.getValue());
-    Set refs = new HashSet<>();
-    refs.add(pwd);
-
     IamAccount account = accountRepo.findByUsername(authentication.getName())
       .orElseThrow(() -> new BadCredentialsException("Invalid login details"));
 
     ExtendedAuthenticationToken token;
 
+    // We have just completed an authentication with the user's password. Therefore, we add "pwd" to
+    // the list of authentication method references.
+    IamAuthenticationMethodReference pwd =
+        new IamAuthenticationMethodReference(PASSWORD.getValue());
+    Set refs = new HashSet<>();
+    refs.add(pwd);
+
     Optional totpMfaOptional = totpMfaRepository.findByAccount(account);
+
+    // Checking to see if we can find an active MFA secret attached to the user's account. If so,
+    // MFA is enabled on the account
     if (totpMfaOptional.isPresent() && totpMfaOptional.get().isActive()) {
       List currentAuthorities = new ArrayList<>();
-      for (GrantedAuthority authority : authentication.getAuthorities()) {
-        currentAuthorities.add(new SimpleGrantedAuthority(authority.getAuthority()));
+      // Add PRE_AUTHENTICATED role to the user. This grants them access to the /iam/verify endpoint
+      currentAuthorities.add(Authorities.ROLE_PRE_AUTHENTICATED);
+
+      // Retrieve the authorities that are assigned to this user when they are fully authenticated
+      Set fullyAuthenticatedAuthorities = new HashSet<>();
+      for (GrantedAuthority a : authentication.getAuthorities()) {
+        fullyAuthenticatedAuthorities.add(a);
       }
-      currentAuthorities.add(new SimpleGrantedAuthority("ROLE_PRE_AUTHENTICATED"));
 
+      // Construct a new authentication object for the PRE_AUTHENTICATED user.
       token = new ExtendedAuthenticationToken(authentication.getPrincipal(),
-          authentication.getCredentials(), currentAuthorities, refs);
+          authentication.getCredentials(), currentAuthorities);
       token.setAuthenticated(false);
+      token.setAuthenticationMethodReferences(refs);
+      token.setFullyAuthenticatedAuthorities(fullyAuthenticatedAuthorities);
     } else {
+      // MFA is not enabled on this account, construct a new authentication object for the FULLY
+      // AUTHENTICATED user, granting their normal authorities
       token = new ExtendedAuthenticationToken(authentication.getPrincipal(),
-          authentication.getCredentials(), authentication.getAuthorities(), refs);
+          authentication.getCredentials(), authentication.getAuthorities());
+      token.setAuthenticationMethodReferences(refs);
       token.setAuthenticated(true);
     }
 
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/iam/IamJWTProfileIdTokenCustomizer.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/iam/IamJWTProfileIdTokenCustomizer.java
index 8730c06ed..edf81b7b7 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/iam/IamJWTProfileIdTokenCustomizer.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/oauth/profile/iam/IamJWTProfileIdTokenCustomizer.java
@@ -15,8 +15,8 @@
  */
 package it.infn.mw.iam.core.oauth.profile.iam;
 
-import static it.infn.mw.iam.core.oauth.profile.iam.ClaimValueHelper.ADDITIONAL_CLAIMS;
 import static it.infn.mw.iam.authn.multi_factor_authentication.IamAuthenticationMethodReference.AUTHENTICATION_METHOD_REFERENCE_CLAIM_STRING;
+import static it.infn.mw.iam.core.oauth.profile.iam.ClaimValueHelper.ADDITIONAL_CLAIMS;
 
 import java.util.Set;
 
@@ -25,8 +25,6 @@
 import org.mitre.oauth2.model.ClientDetailsEntity;
 import org.mitre.oauth2.model.OAuth2AccessTokenEntity;
 import org.mitre.openid.connect.service.ScopeClaimTranslationService;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 import org.springframework.security.oauth2.provider.OAuth2Request;
 
 import it.infn.mw.iam.config.IamProperties;
@@ -41,8 +39,6 @@ public class IamJWTProfileIdTokenCustomizer extends BaseIdTokenCustomizer {
   protected final ScopeClaimTranslationService scopeClaimConverter;
   protected final ClaimValueHelper claimValueHelper;
 
-  public static final Logger LOG = LoggerFactory.getLogger(IamJWTProfileIdTokenCustomizer.class);
-
   public IamJWTProfileIdTokenCustomizer(IamAccountRepository accountRepo,
       ScopeClaimTranslationService scopeClaimConverter, ClaimValueHelper claimValueHelper,
       IamProperties properties) {
@@ -64,7 +60,8 @@ public void customizeIdTokenClaims(Builder idClaims, ClientDetailsEntity client,
       .filter(ADDITIONAL_CLAIMS::contains)
       .forEach(c -> idClaims.claim(c, claimValueHelper.getClaimValueFromUserInfo(c, info)));
 
-    // Add the methods of authentication to the id_token
+    // Add the methods of authentication to the id_token. These were added to the OAuth2 request
+    // from the ExtendedHttpServletRequest
     String amrParam =
         request.getRequestParameters().get(AUTHENTICATION_METHOD_REFERENCE_CLAIM_STRING);
     if (amrParam != null) {
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/MfaSecretAlreadyBoundException.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/MfaSecretAlreadyBoundException.java
index 5d6078358..6da0bd856 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/MfaSecretAlreadyBoundException.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/MfaSecretAlreadyBoundException.java
@@ -17,10 +17,7 @@
 
 public class MfaSecretAlreadyBoundException extends IamAccountException {
 
-  /**
-   * TODO assign serialVersionUID
-   */
-  // private static final long serialVersionUID = 4103663720620113509L;
+  private static final long serialVersionUID = 1L;
 
   public MfaSecretAlreadyBoundException(String message) {
     super(message);
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/MfaSecretNotFoundException.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/MfaSecretNotFoundException.java
index 9d1581ca3..a81c49db5 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/MfaSecretNotFoundException.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/MfaSecretNotFoundException.java
@@ -17,10 +17,7 @@
 
 public class MfaSecretNotFoundException extends IamAccountException {
 
-  /**
-   * TODO assign serialVersionUID
-   */
-  // private static final long serialVersionUID = 4103663720620113509L;
+  private static final long serialVersionUID = 1L;
 
   public MfaSecretNotFoundException(String message) {
     super(message);
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/TotpMfaAlreadyEnabledException.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/TotpMfaAlreadyEnabledException.java
index a44a50938..32b83f501 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/TotpMfaAlreadyEnabledException.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/TotpMfaAlreadyEnabledException.java
@@ -17,10 +17,7 @@
 
 public class TotpMfaAlreadyEnabledException extends IamAccountException {
 
-  /**
-   * TODO assign serialVersionUID
-   */
-  // private static final long serialVersionUID = 4103663720620113509L;
+  private static final long serialVersionUID = 1L;
 
   public TotpMfaAlreadyEnabledException(String message) {
     super(message);
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/web/multi_factor_authentication/DefaultMultiFactorVerificationPageConfiguration.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/web/multi_factor_authentication/DefaultMultiFactorVerificationPageConfiguration.java
index 2d6fb92cb..cf0d39708 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/web/multi_factor_authentication/DefaultMultiFactorVerificationPageConfiguration.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/web/multi_factor_authentication/DefaultMultiFactorVerificationPageConfiguration.java
@@ -23,6 +23,9 @@
 
 import com.google.common.base.Strings;
 
+/**
+ * Config for the Verify button that appears at the /iam/verify MFA endpoint
+ */
 @Component
 public class DefaultMultiFactorVerificationPageConfiguration
     implements MultiFactorVerificationPageConfiguration {
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/web/multi_factor_authentication/MultiFactorVerificationPageConfiguration.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/web/multi_factor_authentication/MultiFactorVerificationPageConfiguration.java
index 46ac650e9..8cf3f49a5 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/web/multi_factor_authentication/MultiFactorVerificationPageConfiguration.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/web/multi_factor_authentication/MultiFactorVerificationPageConfiguration.java
@@ -17,6 +17,9 @@
 
 import it.infn.mw.iam.config.IamProperties.Logo;
 
+/**
+ * Config for the Verify button that appears at the /iam/verify MFA endpoint
+ */
 public interface MultiFactorVerificationPageConfiguration {
 
   String getVerifyButtonText();
diff --git a/iam-login-service/src/main/webapp/WEB-INF/views/iam/authenticator-app/verify-authenticator-app-form.jsp b/iam-login-service/src/main/webapp/WEB-INF/views/iam/authenticator-app/verify-authenticator-app-form.jsp
index 910c5d6eb..c82772112 100644
--- a/iam-login-service/src/main/webapp/WEB-INF/views/iam/authenticator-app/verify-authenticator-app-form.jsp
+++ b/iam-login-service/src/main/webapp/WEB-INF/views/iam/authenticator-app/verify-authenticator-app-form.jsp
@@ -1,21 +1,10 @@
-<%--
-
-    Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
-
-    Licensed under the Apache License, Version 2.0 (the "License");
-    you may not use this file except in compliance with the License.
-    You may obtain a copy of the License at
-
-        http://www.apache.org/licenses/LICENSE-2.0
-
-    Unless required by applicable law or agreed to in writing, software
-    distributed under the License is distributed on an "AS IS" BASIS,
-    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-    See the License for the specific language governing permissions and
-    limitations under the License.
-
---%>
-
+<%-- Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021 Licensed under the Apache License, Version
+  2.0 (the "License" ); you may not use this file except in compliance with the License. You may obtain a copy of the
+  License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing,
+  software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+  KIND, either express or implied. See the License for the specific language governing permissions and limitations under
+  the License. --%>
+  
   

     

       

@@ -26,36 +15,38 @@
           
             
           
-          
+          
         

       

-        
-        
-      
-    
-    

-      

-        Lost access to your authenticator app? Enter a recovery code to regain access
-      

-      

-        

-          
-            
-          
-          
-        

-      

-        
-        
+      
+      
+  
+  

+  

+    

+      Lost access to your authenticator app? Enter a recovery code to regain access
+    

+    

+      

+        
+          
+        
+        
+        
       

-    
-    

-      
-    

     

+    
+    
+    
+  
+  

+    
+  

   
-
+  
+
+  
\ No newline at end of file
diff --git a/iam-login-service/src/main/webapp/WEB-INF/views/iam/verify-mfa.jsp b/iam-login-service/src/main/webapp/WEB-INF/views/iam/verify-mfa.jsp
index 02764e527..070abefb5 100644
--- a/iam-login-service/src/main/webapp/WEB-INF/views/iam/verify-mfa.jsp
+++ b/iam-login-service/src/main/webapp/WEB-INF/views/iam/verify-mfa.jsp
@@ -32,15 +32,13 @@
           
             
           
-          
-          
Bad code

-          
+          
${SPRING_SECURITY_LAST_EXCEPTION.message}

         
       
     
 
-    
-     
+    
+    
     
       

         
diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/components/user/mfa/user.mfa.component.html b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/components/user/mfa/user.mfa.component.html
index 740e9d16e..536bc853d 100644
--- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/components/user/mfa/user.mfa.component.html
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/components/user/mfa/user.mfa.component.html
@@ -15,12 +15,9 @@
     limitations under the License.
 
 -->
-
-
\ No newline at end of file
diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/services/authenticator-app.service.js b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/services/authenticator-app.service.js
index f4833100e..316253f01 100644
--- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/services/authenticator-app.service.js
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/services/authenticator-app.service.js
@@ -35,7 +35,6 @@ function AuthenticatorAppService($http, $httpParamSerializerJQLike) {
 		return $http.put('/iam/authenticator-app/add-secret');
 	}
 
-	// TODO two functions are broadly similar. This could be simplified into the foundations for step-up authentication
 	function enableAuthenticatorApp(code) {
 
 		var data = $httpParamSerializerJQLike({
diff --git a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/editmfasettings.html b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/editmfasettings.html
index c9a4f9543..533dba222 100644
--- a/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/editmfasettings.html
+++ b/iam-login-service/src/main/webapp/resources/iam/apps/dashboard-app/templates/home/editmfasettings.html
@@ -17,36 +17,41 @@
 -->
 

 
-    

-        
Edit multi-factor authentication settings for {{userMfaCtrl.userToEdit.name.formatted}}

+  

+    
Edit multi-factor authentication settings for {{userMfaCtrl.userToEdit.name.formatted}}

+  

+
+  

+    
+
+    

+      
+      
+        
+          
+             Enabled
+          
+          
+          
+             Disabled
+          
+          
+        
+        
+          
+        
+      
     

+  

 
-    

-        
-
-        

-          
-          
-          
-            
-              
-              
-                 Enabled
-              
-              
-              
-                 Disabled
-              
-              
-            
-            
-              
-            
-          
-        

-    

-
-    

-        
-    

-
+  

+    
+  

+
\ No newline at end of file

From e6750ec5083c6bbc536063a18cd6879663ba9e09 Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Tue, 8 Mar 2022 15:54:02 +0000
Subject: [PATCH 73/76] Fixing license header in verify JSP

---
 .../verify-authenticator-app-form.jsp         | 81 +++++++++++--------
 1 file changed, 46 insertions(+), 35 deletions(-)

diff --git a/iam-login-service/src/main/webapp/WEB-INF/views/iam/authenticator-app/verify-authenticator-app-form.jsp b/iam-login-service/src/main/webapp/WEB-INF/views/iam/authenticator-app/verify-authenticator-app-form.jsp
index c82772112..90119f9bf 100644
--- a/iam-login-service/src/main/webapp/WEB-INF/views/iam/authenticator-app/verify-authenticator-app-form.jsp
+++ b/iam-login-service/src/main/webapp/WEB-INF/views/iam/authenticator-app/verify-authenticator-app-form.jsp
@@ -1,52 +1,63 @@
-<%-- Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021 Licensed under the Apache License, Version
-  2.0 (the "License" ); you may not use this file except in compliance with the License. You may obtain a copy of the
-  License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing,
-  software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-  KIND, either express or implied. See the License for the specific language governing permissions and limitations under
-  the License. --%>
-  
-  

-    

-      

-        For your security, please enter a code from your authenticator app
-      

-      

-        

-          
-            
-          
-          
-        

-      

-      
-      
-  

-  
+<%--
+
+    Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
+
+        http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
+
+--%>
+
+

   

     

-      Lost access to your authenticator app? Enter a recovery code to regain access
+      For your security, please enter a code from your authenticator app
     

     

       

         
           
         
-        
-        
+        
       

     

     
     
+

+
+

+  

+    Lost access to your authenticator app? Enter a recovery code to regain access
+  

+  

+    

+      
+        
+      
+      
+      
     

-  
-  

-    
-  

   

+  
+  
   

+
+

+  
+

+

+
 
-  
\ No newline at end of file
+
\ No newline at end of file

From 566b1f33ae92c7c273cb04a1b4c292a26efa7505 Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Thu, 10 Mar 2022 17:07:42 +0000
Subject: [PATCH 74/76] Fixing existing MFA tests, improving controller
 functionality

All existing tests relating to MFA are being fixed. These tests all relate to MFA work prior to OAuth2 integration, IamAuthenticationMethodReference, ExtendedAuthenticationToken, etc.

Some tests are still broken and these seem to relate to the inclusion of ExtendedAuthenticationToken being adopted as the default global Authentication object. Because of this, it is coming into conflict with some OAuth functionality I haven't touched.
---
 .../DefaultIamTotpMfaService.java             |  90 +++-
 ...efaultIamTotpRecoveryCodeResetService.java |  10 +-
 .../IamTotpMfaService.java                    |  18 +
 .../IamTotpRecoveryCodeResetService.java      |   2 +-
 .../AuthenticatorAppSettingsController.java   |  65 ++-
 .../{CodeDTO.java => TotpDTO.java}            |  18 +-
 .../AuthenticatorAppDisabledEvent.java        |   5 +-
 .../AuthenticatorAppEnabledEvent.java         |   5 +-
 .../MultiFactorEvent.java                     |  10 +-
 .../RecoveryCodeVerifiedEvent.java            |  30 ++
 .../RecoveryCodesResetEvent.java              |   5 +-
 .../TotpVerifiedEvent.java                    |  30 ++
 .../MultiFactorRecoveryCodeCheckProvider.java |  34 +-
 .../MultiFactorTotpCheckProvider.java         |  34 +-
 .../MultiFactorVerificationFilter.java        |   4 +-
 .../infn/mw/iam/config/IamTotpMfaConfig.java  |  14 +-
 .../config/security/IamWebSecurityConfig.java |   7 +-
 .../exception/MfaSecretNotFoundException.java |   4 +-
 ...thenticatorAppSettingsControllerTests.java | 321 +++++++++++++
 .../AuthenticatorAppSettingsTests.java        | 428 ------------------
 .../IamTotpMfaServiceTestSupport.java         | 131 ++++++
 .../IamTotpMfaServiceTests.java               | 231 ++++++++++
 .../MfaVerifyControllerTests.java             |  47 +-
 .../MultiFactorTestSupport.java               |  93 ++--
 ...AuthenticatorAppVerifyControllerTests.java | 214 ---------
 ...RecoveryCodeManagementControllerTests.java | 126 ++----
 .../service/IamAccountServiceTestSupport.java |  88 +---
 .../test/service/IamAccountServiceTests.java  | 151 +-----
 .../mw/iam/test/util/WithMockMfaUser.java     |  32 ++
 .../util/WithMockPreAuthenticatedUser.java    |   2 +-
 ...WithMockMfaUserSecurityContextFactory.java |  55 +++
 ...thenticatedUserSecurityContextFactory.java |  23 +-
 32 files changed, 1182 insertions(+), 1145 deletions(-)
 rename iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/{CodeDTO.java => TotpDTO.java} (75%)
 create mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/RecoveryCodeVerifiedEvent.java
 create mode 100644 iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/TotpVerifiedEvent.java
 create mode 100644 iam-login-service/src/test/java/it/infn/mw/iam/test/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppSettingsControllerTests.java
 delete mode 100644 iam-login-service/src/test/java/it/infn/mw/iam/test/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppSettingsTests.java
 create mode 100644 iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/IamTotpMfaServiceTestSupport.java
 create mode 100644 iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/IamTotpMfaServiceTests.java
 delete mode 100644 iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/authenticator_app/AuthenticatorAppVerifyControllerTests.java
 create mode 100644 iam-login-service/src/test/java/it/infn/mw/iam/test/util/WithMockMfaUser.java
 create mode 100644 iam-login-service/src/test/java/it/infn/mw/iam/test/util/multi_factor_authentication/WithMockMfaUserSecurityContextFactory.java

diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/DefaultIamTotpMfaService.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/DefaultIamTotpMfaService.java
index 9dd7e276b..ddad5ffc8 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/DefaultIamTotpMfaService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/DefaultIamTotpMfaService.java
@@ -24,10 +24,13 @@
 import org.springframework.context.ApplicationEventPublisherAware;
 import org.springframework.stereotype.Service;
 
+import dev.samstevens.totp.code.CodeVerifier;
 import dev.samstevens.totp.recovery.RecoveryCodeGenerator;
 import dev.samstevens.totp.secret.SecretGenerator;
 import it.infn.mw.iam.audit.events.account.multi_factor_authentication.AuthenticatorAppDisabledEvent;
 import it.infn.mw.iam.audit.events.account.multi_factor_authentication.AuthenticatorAppEnabledEvent;
+import it.infn.mw.iam.audit.events.account.multi_factor_authentication.RecoveryCodeVerifiedEvent;
+import it.infn.mw.iam.audit.events.account.multi_factor_authentication.TotpVerifiedEvent;
 import it.infn.mw.iam.core.user.IamAccountService;
 import it.infn.mw.iam.core.user.exception.MfaSecretAlreadyBoundException;
 import it.infn.mw.iam.core.user.exception.MfaSecretNotFoundException;
@@ -46,25 +49,36 @@ public class DefaultIamTotpMfaService implements IamTotpMfaService, ApplicationE
   private final IamTotpMfaRepository totpMfaRepository;
   private final SecretGenerator secretGenerator;
   private final RecoveryCodeGenerator recoveryCodeGenerator;
+  private final CodeVerifier codeVerifier;
   private ApplicationEventPublisher eventPublisher;
 
   @Autowired
   public DefaultIamTotpMfaService(IamAccountService iamAccountService,
       IamTotpMfaRepository totpMfaRepository, SecretGenerator secretGenerator,
-      RecoveryCodeGenerator recoveryCodeGenerator, ApplicationEventPublisher eventPublisher) {
+      RecoveryCodeGenerator recoveryCodeGenerator, CodeVerifier codeVerifier,
+      ApplicationEventPublisher eventPublisher) {
     this.iamAccountService = iamAccountService;
     this.totpMfaRepository = totpMfaRepository;
     this.secretGenerator = secretGenerator;
     this.recoveryCodeGenerator = recoveryCodeGenerator;
+    this.codeVerifier = codeVerifier;
     this.eventPublisher = eventPublisher;
   }
 
-  private void authenticatorAppEnabledEvent(IamAccount account) {
-    eventPublisher.publishEvent(new AuthenticatorAppEnabledEvent(this, account));
+  private void authenticatorAppEnabledEvent(IamAccount account, IamTotpMfa totpMfa) {
+    eventPublisher.publishEvent(new AuthenticatorAppEnabledEvent(this, account, totpMfa));
   }
 
-  private void authenticatorAppDisabledEvent(IamAccount account) {
-    eventPublisher.publishEvent(new AuthenticatorAppDisabledEvent(this, account));
+  private void authenticatorAppDisabledEvent(IamAccount account, IamTotpMfa totpMfa) {
+    eventPublisher.publishEvent(new AuthenticatorAppDisabledEvent(this, account, totpMfa));
+  }
+
+  private void totpVerifiedEvent(IamAccount account, IamTotpMfa totpMfa) {
+    eventPublisher.publishEvent(new TotpVerifiedEvent(this, account, totpMfa));
+  }
+
+  private void recoveryCodeVerifiedEvent(IamAccount account, IamTotpMfa totpMfa) {
+    eventPublisher.publishEvent(new RecoveryCodeVerifiedEvent(this, account, totpMfa));
   }
 
   @Override
@@ -145,7 +159,7 @@ public IamTotpMfa enableTotpMfa(IamAccount account) {
     totpMfa.touch();
     totpMfaRepository.save(totpMfa);
     iamAccountService.saveAccount(account);
-    authenticatorAppEnabledEvent(account);
+    authenticatorAppEnabledEvent(account, totpMfa);
     return totpMfa;
   }
 
@@ -168,10 +182,72 @@ public IamTotpMfa disableTotpMfa(IamAccount account) {
     totpMfaRepository.delete(totpMfa);
 
     iamAccountService.saveAccount(account);
-    authenticatorAppDisabledEvent(account);
+    authenticatorAppDisabledEvent(account, totpMfa);
     return totpMfa;
   }
 
+  /**
+   * Verifies a provided TOTP against an account multi-factor secret
+   * 
+   * @param account the account whose secret we will check against
+   * @param totp the TOTP to validate
+   * @return true if valid, false otherwise
+   */
+  @Override
+  public boolean verifyTotp(IamAccount account, String totp) {
+    Optional totpMfaOptional = totpMfaRepository.findByAccount(account);
+    if (!totpMfaOptional.isPresent()) {
+      throw new MfaSecretNotFoundException("No multi-factor secret is attached to this account");
+    }
+
+    IamTotpMfa totpMfa = totpMfaOptional.get();
+    if (!totpMfa.isActive()) {
+      throw new MfaSecretNotFoundException("No multi-factor secret is attached to this account");
+    }
+
+    String mfaSecret = totpMfa.getSecret();
+
+    // Verify provided TOTP
+    if (codeVerifier.isValidCode(mfaSecret, totp)) {
+      totpVerifiedEvent(account, totpMfa);
+      return true;
+    }
+
+    return false;
+  }
+
+  /**
+   * Verifies a provided recovery code against an account
+   * 
+   * @param account the account we will check against
+   * @param recoveryCode the recovery code to validate
+   * @return true if valid, false otherwise
+   */
+  @Override
+  public boolean verifyRecoveryCode(IamAccount account, String recoveryCode) {
+    Optional totpMfaOptional = totpMfaRepository.findByAccount(account);
+    if (!totpMfaOptional.isPresent()) {
+      throw new MfaSecretNotFoundException("No multi-factor secret is attached to this account");
+    }
+
+    IamTotpMfa totpMfa = totpMfaOptional.get();
+    if (!totpMfa.isActive()) {
+      throw new MfaSecretNotFoundException("No multi-factor secret is attached to this account");
+    }
+
+    // Check for a matching recovery code
+    Set accountRecoveryCodes = totpMfa.getRecoveryCodes();
+    for (IamTotpRecoveryCode recoveryCodeObject : accountRecoveryCodes) {
+      String recoveryCodeString = recoveryCodeObject.getCode();
+      if (recoveryCode.equals(recoveryCodeString)) {
+        recoveryCodeVerifiedEvent(account, totpMfa);
+        return true;
+      }
+    }
+
+    return false;
+  }
+
   private Set generateRecoveryCodes(IamTotpMfa totpMfa) {
     String[] recoveryCodeStrings = recoveryCodeGenerator.generateCodes(RECOVERY_CODE_QUANTITY);
     Set recoveryCodes = new HashSet<>();
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/DefaultIamTotpRecoveryCodeResetService.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/DefaultIamTotpRecoveryCodeResetService.java
index 44e95aa5a..3df21b730 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/DefaultIamTotpRecoveryCodeResetService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/DefaultIamTotpRecoveryCodeResetService.java
@@ -52,6 +52,10 @@ public DefaultIamTotpRecoveryCodeResetService(IamAccountRepository accountReposi
     this.recoveryCodeGenerator = recoveryCodeGenerator;
   }
 
+  private void recoveryCodesResetEvent(IamAccount account, IamTotpMfa totpMfa) {
+    eventPublisher.publishEvent(new RecoveryCodesResetEvent(this, account, totpMfa));
+  }
+
   @Override
   public void setApplicationEventPublisher(ApplicationEventPublisher applicationEventPublisher) {
     this.eventPublisher = applicationEventPublisher;
@@ -63,7 +67,7 @@ public void setApplicationEventPublisher(ApplicationEventPublisher applicationEv
    * @param account - the account to regenerate codes on
    */
   @Override
-  public void resetRecoveryCodes(IamAccount account) {
+  public IamAccount resetRecoveryCodes(IamAccount account) {
     Optional totpMfaOptional = totpMfaRepository.findByAccount(account);
     if (!totpMfaOptional.isPresent()) {
       throw new MfaSecretNotFoundException("No multi-factor secret is attached to this account");
@@ -84,7 +88,9 @@ public void resetRecoveryCodes(IamAccount account) {
     account.touch();
     accountRepository.save(account);
     totpMfaRepository.save(totpMfa);
-    eventPublisher.publishEvent(new RecoveryCodesResetEvent(this, account));
+    recoveryCodesResetEvent(account, totpMfa);
+
+    return account;
   }
 
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/IamTotpMfaService.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/IamTotpMfaService.java
index 09f551b5a..04ca64383 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/IamTotpMfaService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/IamTotpMfaService.java
@@ -56,4 +56,22 @@ public interface IamTotpMfaService {
    * @return the newly-disabled TOTP MFA
    */
   IamTotpMfa disableTotpMfa(IamAccount account);
+
+  /**
+   * Verifies a provided TOTP against an account multi-factor secret
+   * 
+   * @param account the account whose secret we will check against
+   * @param totp the TOTP to validate
+   * @return true if valid, false otherwise
+   */
+  boolean verifyTotp(IamAccount account, String totp);
+
+  /**
+   * Verifies a provided recovery code against an account
+   * 
+   * @param account the account we will check against
+   * @param recoveryCode the recovery code to validate
+   * @return true if valid, false otherwise
+   */
+  boolean verifyRecoveryCode(IamAccount account, String recoveryCode);
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/IamTotpRecoveryCodeResetService.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/IamTotpRecoveryCodeResetService.java
index d0b63f789..0b77262ef 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/IamTotpRecoveryCodeResetService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/IamTotpRecoveryCodeResetService.java
@@ -24,5 +24,5 @@ public interface IamTotpRecoveryCodeResetService {
    * 
    * @param account - the account to regenerate codes on
    */
-  public void resetRecoveryCodes(IamAccount account);
+  public IamAccount resetRecoveryCodes(IamAccount account);
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppSettingsController.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppSettingsController.java
index 8b1d2fc49..2f7fe526d 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppSettingsController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppSettingsController.java
@@ -17,8 +17,6 @@
 
 import static dev.samstevens.totp.util.Utils.getDataUriForImage;
 
-import java.util.Optional;
-
 import javax.validation.Valid;
 
 import org.springframework.beans.factory.annotation.Autowired;
@@ -37,7 +35,6 @@
 import org.springframework.web.bind.annotation.ResponseBody;
 import org.springframework.web.bind.annotation.ResponseStatus;
 
-import dev.samstevens.totp.code.CodeVerifier;
 import dev.samstevens.totp.code.HashingAlgorithm;
 import dev.samstevens.totp.exceptions.QrGenerationException;
 import dev.samstevens.totp.qr.QrData;
@@ -52,7 +49,6 @@
 import it.infn.mw.iam.persistence.model.IamAccount;
 import it.infn.mw.iam.persistence.model.IamTotpMfa;
 import it.infn.mw.iam.persistence.repository.IamAccountRepository;
-import it.infn.mw.iam.persistence.repository.IamTotpMfaRepository;
 
 /**
  * Controller for customising user's authenticator app MFA settings Can enable or disable the
@@ -67,21 +63,16 @@ public class AuthenticatorAppSettingsController {
   public static final String ENABLE_URL = BASE_URL + "/enable";
   public static final String DISABLE_URL = BASE_URL + "/disable";
 
-  final IamTotpMfaService service;
-  final IamAccountRepository accountRepository;
-  final IamTotpMfaRepository totpMfaRepository;
-  private QrGenerator qrGenerator;
-  private CodeVerifier codeVerifier;
+  private final IamTotpMfaService service;
+  private final IamAccountRepository accountRepository;
+  private final QrGenerator qrGenerator;
 
   @Autowired
   public AuthenticatorAppSettingsController(IamTotpMfaService service,
-      IamAccountRepository accountRepository, IamTotpMfaRepository totpMfaRepository,
-      QrGenerator qrGenerator, CodeVerifier codeVerifier) {
+      IamAccountRepository accountRepository, QrGenerator qrGenerator) {
     this.service = service;
     this.accountRepository = accountRepository;
-    this.totpMfaRepository = totpMfaRepository;
     this.qrGenerator = qrGenerator;
-    this.codeVerifier = codeVerifier;
   }
 
 
@@ -126,23 +117,26 @@ public SecretAndDataUriDTO addSecret() {
   @RequestMapping(value = ENABLE_URL, method = RequestMethod.POST,
       produces = MediaType.TEXT_PLAIN_VALUE)
   @ResponseBody
-  public void enableAuthenticatorApp(@ModelAttribute @Valid CodeDTO code,
+  public void enableAuthenticatorApp(@ModelAttribute @Valid TotpDTO code,
       BindingResult validationResult) {
     if (validationResult.hasErrors()) {
-      throw new BadMfaCodeError("Bad MFA code");
+      throw new BadMfaCodeError("Bad code");
     }
 
     final String username = getUsernameFromSecurityContext();
     IamAccount account = accountRepository.findByUsername(username)
       .orElseThrow(() -> NoSuchAccountError.forUsername(username));
-    Optional totpMfaOptional = totpMfaRepository.findByAccount(account);
-    if (totpMfaOptional.isPresent()) {
-      IamTotpMfa totpMfa = totpMfaOptional.get();
-      if (!codeVerifier.isValidCode(totpMfa.getSecret(), code.getCode())) {
-        throw new BadMfaCodeError("Bad MFA code");
-      }
-    } else {
-      throw new MfaSecretNotFoundException("No multi-factor secret is attached to this account");
+
+    boolean valid = false;
+
+    try {
+      valid = service.verifyTotp(account, code.getCode());
+    } catch (MfaSecretNotFoundException e) {
+      throw e;
+    }
+
+    if (!valid) {
+      throw new BadMfaCodeError("Bad code");
     }
 
     service.enableTotpMfa(account);
@@ -161,29 +155,30 @@ public void enableAuthenticatorApp(@ModelAttribute @Valid CodeDTO code,
   @RequestMapping(value = DISABLE_URL, method = RequestMethod.POST,
       produces = MediaType.TEXT_PLAIN_VALUE)
   @ResponseBody
-  public void disableAuthenticatorApp(@Valid CodeDTO code, BindingResult validationResult) {
+  public void disableAuthenticatorApp(@Valid TotpDTO code, BindingResult validationResult) {
     if (validationResult.hasErrors()) {
-      throw new BadMfaCodeError("Bad MFA code");
+      throw new BadMfaCodeError("Bad code");
     }
 
     final String username = getUsernameFromSecurityContext();
     IamAccount account = accountRepository.findByUsername(username)
       .orElseThrow(() -> NoSuchAccountError.forUsername(username));
-    Optional totpMfaOptional = totpMfaRepository.findByAccount(account);
-
-    if (totpMfaOptional.isPresent()) {
-      IamTotpMfa totpMfa = totpMfaOptional.get();
-      if (!codeVerifier.isValidCode(totpMfa.getSecret(), code.getCode())) {
-        throw new BadMfaCodeError("Bad MFA code");
-      }
-    } else {
-      throw new MfaSecretNotFoundException("No multi-factor secret is attached to this account");
+
+    boolean valid = false;
+
+    try {
+      valid = service.verifyTotp(account, code.getCode());
+    } catch (MfaSecretNotFoundException e) {
+      throw e;
+    }
+
+    if (!valid) {
+      throw new BadMfaCodeError("Bad code");
     }
 
     service.disableTotpMfa(account);
   }
 
-
   /**
    * Fetch and return the logged-in username from security context
    * 
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/CodeDTO.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/TotpDTO.java
similarity index 75%
rename from iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/CodeDTO.java
rename to iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/TotpDTO.java
index 5264458f9..17b193abf 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/CodeDTO.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/TotpDTO.java
@@ -23,26 +23,26 @@
 /**
  * DTO containing a TOTP for MFA secrets
  */
-public class CodeDTO {
+public class TotpDTO {
 
-  @NotEmpty(message = "Code cannot be empty")
-  @Length(min = 6, max = 6, message = "Code must be six characters in length")
-  @Min(value = 0L, message = "Code must be a numerical value")
-  private String code;
+  @NotEmpty(message = "Totp cannot be empty")
+  @Length(min = 6, max = 6, message = "Totp must be six characters in length")
+  @Min(value = 0L, message = "Totp must be a numerical value")
+  private String totp;
 
 
   /**
    * @return the code
    */
   public String getCode() {
-    return code;
+    return totp;
   }
 
 
   /**
-   * @param code new code
+   * @param totp new code
    */
-  public void setCode(final String code) {
-    this.code = code;
+  public void setTotp(final String totp) {
+    this.totp = totp;
   }
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/AuthenticatorAppDisabledEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/AuthenticatorAppDisabledEvent.java
index 76a5ae64a..895e6b431 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/AuthenticatorAppDisabledEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/AuthenticatorAppDisabledEvent.java
@@ -16,6 +16,7 @@
 package it.infn.mw.iam.audit.events.account.multi_factor_authentication;
 
 import it.infn.mw.iam.persistence.model.IamAccount;
+import it.infn.mw.iam.persistence.model.IamTotpMfa;
 
 public class AuthenticatorAppDisabledEvent extends MultiFactorEvent {
 
@@ -23,7 +24,7 @@ public class AuthenticatorAppDisabledEvent extends MultiFactorEvent {
 
   private static final long serialVersionUID = 1L;
 
-  public AuthenticatorAppDisabledEvent(Object source, IamAccount account) {
-    super(source, account, String.format(TEMPLATE, account.getUsername()));
+  public AuthenticatorAppDisabledEvent(Object source, IamAccount account, IamTotpMfa totpMfa) {
+    super(source, account, totpMfa, String.format(TEMPLATE, account.getUsername()));
   }
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/AuthenticatorAppEnabledEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/AuthenticatorAppEnabledEvent.java
index e39caf571..b2ecf1e4d 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/AuthenticatorAppEnabledEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/AuthenticatorAppEnabledEvent.java
@@ -16,6 +16,7 @@
 package it.infn.mw.iam.audit.events.account.multi_factor_authentication;
 
 import it.infn.mw.iam.persistence.model.IamAccount;
+import it.infn.mw.iam.persistence.model.IamTotpMfa;
 
 public class AuthenticatorAppEnabledEvent extends MultiFactorEvent {
 
@@ -23,7 +24,7 @@ public class AuthenticatorAppEnabledEvent extends MultiFactorEvent {
 
   private static final long serialVersionUID = 1L;
 
-  public AuthenticatorAppEnabledEvent(Object source, IamAccount account) {
-    super(source, account, String.format(TEMPLATE, account.getUsername()));
+  public AuthenticatorAppEnabledEvent(Object source, IamAccount account, IamTotpMfa totpMfa) {
+    super(source, account, totpMfa, String.format(TEMPLATE, account.getUsername()));
   }
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/MultiFactorEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/MultiFactorEvent.java
index 67a8b12c6..61008b65f 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/MultiFactorEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/MultiFactorEvent.java
@@ -17,12 +17,20 @@
 
 import it.infn.mw.iam.audit.events.account.AccountEvent;
 import it.infn.mw.iam.persistence.model.IamAccount;
+import it.infn.mw.iam.persistence.model.IamTotpMfa;
 
 public class MultiFactorEvent extends AccountEvent {
 
   private static final long serialVersionUID = 1L;
+  private final IamTotpMfa totpMfa;
 
-  protected MultiFactorEvent(Object source, IamAccount account, String message) {
+  protected MultiFactorEvent(Object source, IamAccount account, IamTotpMfa totpMfa,
+      String message) {
     super(source, account, message);
+    this.totpMfa = totpMfa;
+  }
+
+  public IamTotpMfa getTotpMfa() {
+    return totpMfa;
   }
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/RecoveryCodeVerifiedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/RecoveryCodeVerifiedEvent.java
new file mode 100644
index 000000000..f24a371e6
--- /dev/null
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/RecoveryCodeVerifiedEvent.java
@@ -0,0 +1,30 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.infn.mw.iam.audit.events.account.multi_factor_authentication;
+
+import it.infn.mw.iam.persistence.model.IamAccount;
+import it.infn.mw.iam.persistence.model.IamTotpMfa;
+
+public class RecoveryCodeVerifiedEvent extends MultiFactorEvent {
+
+  public static final String TEMPLATE = "MFA recovery code verified for account '%s'";
+
+  private static final long serialVersionUID = 1L;
+
+  public RecoveryCodeVerifiedEvent(Object source, IamAccount account, IamTotpMfa totpMfa) {
+    super(source, account, totpMfa, String.format(TEMPLATE, account.getUsername()));
+  }
+}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/RecoveryCodesResetEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/RecoveryCodesResetEvent.java
index b8ab53731..c9282842e 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/RecoveryCodesResetEvent.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/RecoveryCodesResetEvent.java
@@ -16,6 +16,7 @@
 package it.infn.mw.iam.audit.events.account.multi_factor_authentication;
 
 import it.infn.mw.iam.persistence.model.IamAccount;
+import it.infn.mw.iam.persistence.model.IamTotpMfa;
 
 public class RecoveryCodesResetEvent extends MultiFactorEvent {
 
@@ -23,7 +24,7 @@ public class RecoveryCodesResetEvent extends MultiFactorEvent {
 
   private static final long serialVersionUID = 1L;
 
-  public RecoveryCodesResetEvent(Object source, IamAccount account) {
-    super(source, account, String.format(TEMPLATE, account.getUsername()));
+  public RecoveryCodesResetEvent(Object source, IamAccount account, IamTotpMfa totpMfa) {
+    super(source, account, totpMfa, String.format(TEMPLATE, account.getUsername()));
   }
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/TotpVerifiedEvent.java b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/TotpVerifiedEvent.java
new file mode 100644
index 000000000..8ff5e8c32
--- /dev/null
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/audit/events/account/multi_factor_authentication/TotpVerifiedEvent.java
@@ -0,0 +1,30 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.infn.mw.iam.audit.events.account.multi_factor_authentication;
+
+import it.infn.mw.iam.persistence.model.IamAccount;
+import it.infn.mw.iam.persistence.model.IamTotpMfa;
+
+public class TotpVerifiedEvent extends MultiFactorEvent {
+
+  public static final String TEMPLATE = "MFA TOTP verified for account '%s'";
+
+  private static final long serialVersionUID = 1L;
+
+  public TotpVerifiedEvent(Object source, IamAccount account, IamTotpMfa totpMfa) {
+    super(source, account, totpMfa, String.format(TEMPLATE, account.getUsername()));
+  }
+}
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorRecoveryCodeCheckProvider.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorRecoveryCodeCheckProvider.java
index 4c6f7cfc2..5bd27567c 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorRecoveryCodeCheckProvider.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorRecoveryCodeCheckProvider.java
@@ -17,7 +17,6 @@
 
 import static it.infn.mw.iam.authn.multi_factor_authentication.IamAuthenticationMethodReference.AuthenticationMethodReferenceValues.ONE_TIME_PASSWORD;
 
-import java.util.Optional;
 import java.util.Set;
 
 import org.springframework.security.authentication.AuthenticationProvider;
@@ -25,13 +24,11 @@
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.AuthenticationException;
 
+import it.infn.mw.iam.api.account.multi_factor_authentication.IamTotpMfaService;
 import it.infn.mw.iam.core.ExtendedAuthenticationToken;
 import it.infn.mw.iam.core.user.exception.MfaSecretNotFoundException;
 import it.infn.mw.iam.persistence.model.IamAccount;
-import it.infn.mw.iam.persistence.model.IamTotpMfa;
-import it.infn.mw.iam.persistence.model.IamTotpRecoveryCode;
 import it.infn.mw.iam.persistence.repository.IamAccountRepository;
-import it.infn.mw.iam.persistence.repository.IamTotpMfaRepository;
 
 /**
  * Grants full authentication by verifying a provided MFA recovery code. Only comes into play in the
@@ -40,12 +37,12 @@
 public class MultiFactorRecoveryCodeCheckProvider implements AuthenticationProvider {
 
   private final IamAccountRepository accountRepo;
-  private final IamTotpMfaRepository totpMfaRepository;
+  private final IamTotpMfaService totpMfaService;
 
   public MultiFactorRecoveryCodeCheckProvider(IamAccountRepository accountRepo,
-      IamTotpMfaRepository totpMfaRepository) {
+      IamTotpMfaService totpMfaService) {
     this.accountRepo = accountRepo;
-    this.totpMfaRepository = totpMfaRepository;
+    this.totpMfaService = totpMfaService;
   }
 
   @Override
@@ -60,26 +57,19 @@ public Authentication authenticate(Authentication authentication) throws Authent
     IamAccount account = accountRepo.findByUsername(authentication.getName())
       .orElseThrow(() -> new BadCredentialsException("Invalid login details"));
 
-    Optional totpMfaOptional = totpMfaRepository.findByAccount(account);
-    if (!totpMfaOptional.isPresent()) {
-      throw new MfaSecretNotFoundException("No multi-factor secret is attached to this account");
-    }
+    boolean valid = false;
 
-    IamTotpMfa totpMfa = totpMfaOptional.get();
-    if (!totpMfa.isActive()) {
-      throw new MfaSecretNotFoundException("No multi-factor secret is attached to this account");
+    try {
+      valid = totpMfaService.verifyRecoveryCode(account, recoveryCode);
+    } catch (MfaSecretNotFoundException e) {
+      throw e;
     }
 
-    // Check for a matching recovery code
-    Set accountRecoveryCodes = totpMfa.getRecoveryCodes();
-    for (IamTotpRecoveryCode recoveryCodeObject : accountRecoveryCodes) {
-      String recoveryCodeString = recoveryCodeObject.getCode();
-      if (recoveryCode.equals(recoveryCodeString)) {
-        return createSuccessfulAuthentication(token);
-      }
+    if (!valid) {
+      throw new BadCredentialsException("Bad recovery code");
     }
 
-    throw new BadCredentialsException("Bad recovery code");
+    return createSuccessfulAuthentication(token);
   }
 
   protected Authentication createSuccessfulAuthentication(ExtendedAuthenticationToken token) {
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorTotpCheckProvider.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorTotpCheckProvider.java
index e250e9087..5849a0446 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorTotpCheckProvider.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorTotpCheckProvider.java
@@ -17,7 +17,6 @@
 
 import static it.infn.mw.iam.authn.multi_factor_authentication.IamAuthenticationMethodReference.AuthenticationMethodReferenceValues.ONE_TIME_PASSWORD;
 
-import java.util.Optional;
 import java.util.Set;
 
 import org.springframework.security.authentication.AuthenticationProvider;
@@ -25,13 +24,11 @@
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.AuthenticationException;
 
-import dev.samstevens.totp.code.CodeVerifier;
+import it.infn.mw.iam.api.account.multi_factor_authentication.IamTotpMfaService;
 import it.infn.mw.iam.core.ExtendedAuthenticationToken;
 import it.infn.mw.iam.core.user.exception.MfaSecretNotFoundException;
 import it.infn.mw.iam.persistence.model.IamAccount;
-import it.infn.mw.iam.persistence.model.IamTotpMfa;
 import it.infn.mw.iam.persistence.repository.IamAccountRepository;
-import it.infn.mw.iam.persistence.repository.IamTotpMfaRepository;
 
 /**
  * Grants full authentication by verifying a provided MFA TOTP. Only comes into play in the step-up
@@ -40,14 +37,12 @@
 public class MultiFactorTotpCheckProvider implements AuthenticationProvider {
 
   private final IamAccountRepository accountRepo;
-  private final IamTotpMfaRepository totpMfaRepository;
-  private final CodeVerifier codeVerifier;
+  private final IamTotpMfaService totpMfaService;
 
   public MultiFactorTotpCheckProvider(IamAccountRepository accountRepo,
-      IamTotpMfaRepository totpMfaRepository, CodeVerifier codeVerifier) {
+      IamTotpMfaService totpMfaService) {
     this.accountRepo = accountRepo;
-    this.totpMfaRepository = totpMfaRepository;
-    this.codeVerifier = codeVerifier;
+    this.totpMfaService = totpMfaService;
   }
 
   @Override
@@ -62,24 +57,19 @@ public Authentication authenticate(Authentication authentication) throws Authent
     IamAccount account = accountRepo.findByUsername(authentication.getName())
       .orElseThrow(() -> new BadCredentialsException("Invalid login details"));
 
-    Optional totpMfaOptional = totpMfaRepository.findByAccount(account);
-    if (!totpMfaOptional.isPresent()) {
-      throw new MfaSecretNotFoundException("No multi-factor secret is attached to this account");
-    }
+    boolean valid = false;
 
-    IamTotpMfa totpMfa = totpMfaOptional.get();
-    if (!totpMfa.isActive()) {
-      throw new MfaSecretNotFoundException("No multi-factor secret is attached to this account");
+    try {
+      valid = totpMfaService.verifyTotp(account, totp);
+    } catch (MfaSecretNotFoundException e) {
+      throw e;
     }
 
-    String mfaSecret = totpMfa.getSecret();
-
-    // Verify provided TOTP
-    if (codeVerifier.isValidCode(mfaSecret, totp)) {
-      return createSuccessfulAuthentication(token);
+    if (!valid) {
+      throw new BadCredentialsException("Bad code");
     }
 
-    throw new BadCredentialsException("Bad code");
+    return createSuccessfulAuthentication(token);
   }
 
   protected Authentication createSuccessfulAuthentication(ExtendedAuthenticationToken token) {
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorVerificationFilter.java b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorVerificationFilter.java
index fa40554a7..f29829a83 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorVerificationFilter.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/authn/multi_factor_authentication/MultiFactorVerificationFilter.java
@@ -15,6 +15,8 @@
  */
 package it.infn.mw.iam.authn.multi_factor_authentication;
 
+import static it.infn.mw.iam.authn.multi_factor_authentication.MfaVerifyController.MFA_VERIFY_URL;
+
 import java.io.IOException;
 import java.nio.file.ProviderNotFoundException;
 
@@ -47,7 +49,7 @@ public class MultiFactorVerificationFilter extends AbstractAuthenticationProcess
   public static final String RECOVERY_CODE_VERIFIED = "RECOVERY_CODE_VERIFIED";
 
   public static final AntPathRequestMatcher DEFAULT_MFA_VERIFY_ANT_PATH_REQUEST_MATCHER =
-      new AntPathRequestMatcher("/iam/verify", "POST");
+      new AntPathRequestMatcher(MFA_VERIFY_URL, "POST");
 
   private final boolean postOnly = true;
 
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/IamTotpMfaConfig.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/IamTotpMfaConfig.java
index 27762b038..12495d849 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/IamTotpMfaConfig.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/IamTotpMfaConfig.java
@@ -15,6 +15,8 @@
  */
 package it.infn.mw.iam.config;
 
+import static it.infn.mw.iam.authn.multi_factor_authentication.MfaVerifyController.MFA_VERIFY_URL;
+
 import java.util.Arrays;
 
 import org.springframework.beans.factory.annotation.Autowired;
@@ -38,6 +40,7 @@
 import dev.samstevens.totp.secret.SecretGenerator;
 import dev.samstevens.totp.time.SystemTimeProvider;
 import it.infn.mw.iam.api.account.AccountUtils;
+import it.infn.mw.iam.api.account.multi_factor_authentication.IamTotpMfaService;
 import it.infn.mw.iam.api.account.multi_factor_authentication.IamTotpRecoveryCodeResetService;
 import it.infn.mw.iam.api.aup.AUPSignatureCheckService;
 import it.infn.mw.iam.authn.multi_factor_authentication.MultiFactorRecoveryCodeCheckProvider;
@@ -47,7 +50,6 @@
 import it.infn.mw.iam.authn.multi_factor_authentication.ResetOrSkipRecoveryCodesFilter;
 import it.infn.mw.iam.authn.multi_factor_authentication.ViewRecoveryCodesFilter;
 import it.infn.mw.iam.persistence.repository.IamAccountRepository;
-import it.infn.mw.iam.persistence.repository.IamTotpMfaRepository;
 
 // TODO add admin config options from properties file
 
@@ -64,7 +66,7 @@ public class IamTotpMfaConfig {
   private IamAccountRepository accountRepo;
 
   @Autowired
-  private IamTotpMfaRepository totpMfaRepository;
+  private IamTotpMfaService totpMfaService;
 
   @Autowired
   private AUPSignatureCheckService aupSignatureCheckService;
@@ -176,16 +178,16 @@ public AuthenticationSuccessHandler successHandler() {
    * @return failure handler to redirect to /verify endpoint
    */
   public AuthenticationFailureHandler failureHandler() {
-    return new SimpleUrlAuthenticationFailureHandler("/iam/verify?error=failure");
+    return new SimpleUrlAuthenticationFailureHandler(MFA_VERIFY_URL + "?error=failure");
   }
 
   @Bean
-  public MultiFactorTotpCheckProvider totpCheckProvider(CodeVerifier codeVerifier) {
-    return new MultiFactorTotpCheckProvider(accountRepo, totpMfaRepository, codeVerifier);
+  public MultiFactorTotpCheckProvider totpCheckProvider() {
+    return new MultiFactorTotpCheckProvider(accountRepo, totpMfaService);
   }
 
   @Bean
   public MultiFactorRecoveryCodeCheckProvider recoveryCodeCheckProvider() {
-    return new MultiFactorRecoveryCodeCheckProvider(accountRepo, totpMfaRepository);
+    return new MultiFactorRecoveryCodeCheckProvider(accountRepo, totpMfaService);
   }
 }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java b/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java
index 3ecebb677..a09055e5c 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/config/security/IamWebSecurityConfig.java
@@ -19,6 +19,7 @@
 import static it.infn.mw.iam.authn.ExternalAuthenticationRegistrationInfo.ExternalAuthenticationType.OIDC;
 import static it.infn.mw.iam.authn.multi_factor_authentication.authenticator_app.RecoveryCodeManagementController.RECOVERY_CODE_RESET_URL;
 import static it.infn.mw.iam.authn.multi_factor_authentication.authenticator_app.RecoveryCodeManagementController.RECOVERY_CODE_VIEW_URL;
+import static it.infn.mw.iam.authn.multi_factor_authentication.MfaVerifyController.MFA_VERIFY_URL;
 
 import javax.servlet.RequestDispatcher;
 
@@ -371,19 +372,19 @@ public static class MultiFactorConfigurationAdapter extends WebSecurityConfigure
 
     public AuthenticationEntryPoint mfaAuthenticationEntryPoint() {
       LoginUrlAuthenticationEntryPoint entryPoint =
-          new LoginUrlAuthenticationEntryPoint("/iam/verify");
+          new LoginUrlAuthenticationEntryPoint(MFA_VERIFY_URL);
       return entryPoint;
     }
 
     @Override
     protected void configure(HttpSecurity http) throws Exception {
-      http.antMatcher("/iam/verify**")
+      http.antMatcher(MFA_VERIFY_URL + "**")
         .authorizeRequests()
         .anyRequest()
         .hasRole("PRE_AUTHENTICATED")
         .and()
         .formLogin()
-        .failureUrl("/iam/verify?error=failure")
+        .failureUrl(MFA_VERIFY_URL + "?error=failure")
         .and()
         .exceptionHandling()
         .authenticationEntryPoint(mfaAuthenticationEntryPoint())
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/MfaSecretNotFoundException.java b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/MfaSecretNotFoundException.java
index a81c49db5..10c80adcb 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/MfaSecretNotFoundException.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/core/user/exception/MfaSecretNotFoundException.java
@@ -15,7 +15,9 @@
  */
 package it.infn.mw.iam.core.user.exception;
 
-public class MfaSecretNotFoundException extends IamAccountException {
+import org.springframework.security.core.AuthenticationException;
+
+public class MfaSecretNotFoundException extends AuthenticationException {
 
   private static final long serialVersionUID = 1L;
 
diff --git a/iam-login-service/src/test/java/it/infn/mw/iam/test/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppSettingsControllerTests.java b/iam-login-service/src/test/java/it/infn/mw/iam/test/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppSettingsControllerTests.java
new file mode 100644
index 000000000..e7ec9ed96
--- /dev/null
+++ b/iam-login-service/src/test/java/it/infn/mw/iam/test/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppSettingsControllerTests.java
@@ -0,0 +1,321 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.infn.mw.iam.test.api.account.multi_factor_authentication.authenticator_app;
+
+import static it.infn.mw.iam.api.account.multi_factor_authentication.authenticator_app.AuthenticatorAppSettingsController.ADD_SECRET_URL;
+import static it.infn.mw.iam.api.account.multi_factor_authentication.authenticator_app.AuthenticatorAppSettingsController.ENABLE_URL;
+import static it.infn.mw.iam.api.account.multi_factor_authentication.authenticator_app.AuthenticatorAppSettingsController.DISABLE_URL;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+import static org.springframework.security.test.web.servlet.setup.SecurityMockMvcConfigurers.springSecurity;
+import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
+import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.put;
+import static org.springframework.test.web.servlet.result.MockMvcResultHandlers.log;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
+
+import java.util.Optional;
+
+import org.junit.Before;
+import org.junit.BeforeClass;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.test.mock.mockito.MockBean;
+import org.springframework.security.test.context.support.WithMockUser;
+import org.springframework.test.context.junit4.SpringRunner;
+import org.springframework.test.web.servlet.MockMvc;
+import org.springframework.test.web.servlet.setup.MockMvcBuilders;
+import org.springframework.web.context.WebApplicationContext;
+
+import it.infn.mw.iam.api.account.multi_factor_authentication.IamTotpMfaService;
+import it.infn.mw.iam.persistence.model.IamAccount;
+import it.infn.mw.iam.persistence.model.IamTotpMfa;
+import it.infn.mw.iam.persistence.repository.IamAccountRepository;
+import it.infn.mw.iam.test.TestUtils;
+import it.infn.mw.iam.test.multi_factor_authentication.MultiFactorTestSupport;
+import it.infn.mw.iam.test.util.WithAnonymousUser;
+import it.infn.mw.iam.test.util.WithMockMfaUser;
+import it.infn.mw.iam.test.util.WithMockPreAuthenticatedUser;
+import it.infn.mw.iam.test.util.annotation.IamMockMvcIntegrationTest;
+
+@RunWith(SpringRunner.class)
+@IamMockMvcIntegrationTest
+public class AuthenticatorAppSettingsControllerTests extends MultiFactorTestSupport {
+
+  private MockMvc mvc;
+
+  @Autowired
+  private WebApplicationContext context;
+
+  @MockBean
+  private IamAccountRepository accountRepository;
+
+  @MockBean
+  private IamTotpMfaService totpMfaService;
+
+  @BeforeClass
+  public static void init() {
+    TestUtils.initRestAssured();
+  }
+
+  @Before
+  public void setup() {
+    when(accountRepository.findByUsername(TEST_USERNAME)).thenReturn(Optional.of(TEST_ACCOUNT));
+    when(accountRepository.findByUsername(TOTP_USERNAME)).thenReturn(Optional.of(TOTP_MFA_ACCOUNT));
+
+    mvc =
+        MockMvcBuilders.webAppContextSetup(context).apply(springSecurity()).alwaysDo(log()).build();
+  }
+
+  @Test
+  @WithMockUser(username = TEST_USERNAME)
+  public void testAddSecret() throws Exception {
+    IamAccount account = cloneAccount(TEST_ACCOUNT);
+    IamTotpMfa totpMfa = cloneTotpMfa(TOTP_MFA);
+    totpMfa.setActive(false);
+    totpMfa.setAccount(null);
+    totpMfa.setSecret("secret");
+    when(totpMfaService.addTotpMfaSecret(account)).thenReturn(totpMfa);
+
+    mvc.perform(put(ADD_SECRET_URL)).andExpect(status().isOk());
+
+    // TODO called twice for some reason?
+    verify(accountRepository, times(2)).findByUsername(TEST_USERNAME);
+    verify(totpMfaService, times(1)).addTotpMfaSecret(account);
+  }
+
+  @Test
+  @WithAnonymousUser
+  public void testAddSecretNoAuthenticationIsUnauthorized() throws Exception {
+    mvc.perform(put(ADD_SECRET_URL)).andExpect(status().isUnauthorized());
+  }
+
+  @Test
+  @WithMockPreAuthenticatedUser
+  public void testAddSecretPreAuthenticationIsUnauthorized() throws Exception {
+    mvc.perform(put(ADD_SECRET_URL)).andExpect(status().isUnauthorized());
+  }
+
+  @Test
+  @WithMockUser(username = TEST_USERNAME)
+  public void testEnableAuthenticatorApp() throws Exception {
+    IamAccount account = cloneAccount(TEST_ACCOUNT);
+
+    IamTotpMfa totpMfa = cloneTotpMfa(TOTP_MFA);
+    totpMfa.setActive(true);
+    totpMfa.setAccount(TEST_ACCOUNT);
+    totpMfa.setSecret("secret");
+    String totp = "123456";
+
+    when(totpMfaService.verifyTotp(account, totp)).thenReturn(true);
+    when(totpMfaService.enableTotpMfa(account)).thenReturn(totpMfa);
+
+    mvc.perform(post(ENABLE_URL).param("totp", totp)).andExpect(status().isOk());
+
+    verify(accountRepository, times(2)).findByUsername(TEST_USERNAME);
+    verify(totpMfaService, times(1)).verifyTotp(account, totp);
+    verify(totpMfaService, times(1)).enableTotpMfa(account);
+  }
+
+  @Test
+  @WithMockUser(username = TEST_USERNAME)
+  public void testEnableAuthenticatorAppIncorrectCode() throws Exception {
+    IamAccount account = cloneAccount(TEST_ACCOUNT);
+    String totp = "123456";
+
+    when(totpMfaService.verifyTotp(account, totp)).thenReturn(false);
+
+    mvc.perform(post(ENABLE_URL).param("totp", totp)).andExpect(status().is4xxClientError());
+
+    verify(totpMfaService, times(1)).verifyTotp(account, totp);
+    verify(totpMfaService, never()).enableTotpMfa(account);
+  }
+
+  @Test
+  @WithMockUser(username = TEST_USERNAME)
+  public void testEnableAuthenticatorAppInvalidCharactersInCode() throws Exception {
+    IamAccount account = cloneAccount(TEST_ACCOUNT);
+    String totp = "abcdef";
+
+    mvc.perform(post(ENABLE_URL).param("totp", totp)).andExpect(status().is4xxClientError());
+
+    verify(totpMfaService, never()).enableTotpMfa(account);
+  }
+
+  @Test
+  @WithMockUser(username = TEST_USERNAME)
+  public void testEnableAuthenticatorAppCodeTooShort() throws Exception {
+    IamAccount account = cloneAccount(TEST_ACCOUNT);
+    String totp = "12345";
+
+    mvc.perform(post(ENABLE_URL).param("totp", totp)).andExpect(status().is4xxClientError());
+
+    verify(totpMfaService, never()).enableTotpMfa(account);
+  }
+
+  @Test
+  @WithMockUser(username = TEST_USERNAME)
+  public void testEnableAuthenticatorAppCodeTooLong() throws Exception {
+    IamAccount account = cloneAccount(TEST_ACCOUNT);
+    String totp = "1234567";
+
+    mvc.perform(post(ENABLE_URL).param("totp", totp)).andExpect(status().is4xxClientError());
+
+    verify(totpMfaService, never()).enableTotpMfa(account);
+  }
+
+  @Test
+  @WithMockUser(username = TEST_USERNAME)
+  public void testEnableAuthenticatorAppNullCode() throws Exception {
+    IamAccount account = cloneAccount(TEST_ACCOUNT);
+    String totp = null;
+
+    mvc.perform(post(ENABLE_URL).param("totp", totp)).andExpect(status().is4xxClientError());
+
+    verify(totpMfaService, never()).enableTotpMfa(account);
+  }
+
+  @Test
+  @WithMockUser(username = TEST_USERNAME)
+  public void testEnableAuthenticatorAppEmptyCode() throws Exception {
+    IamAccount account = cloneAccount(TEST_ACCOUNT);
+    String totp = "";
+
+    mvc.perform(post(ENABLE_URL).param("totp", totp)).andExpect(status().is4xxClientError());
+
+    verify(totpMfaService, never()).enableTotpMfa(account);
+  }
+
+  @Test
+  @WithAnonymousUser
+  public void testEnableAuthenticatorAppNoAuthenticationIsUnauthorized() throws Exception {
+    String totp = "123456";
+
+    mvc.perform(post(ENABLE_URL).param("totp", totp)).andExpect(status().isUnauthorized());
+  }
+
+  @Test
+  @WithMockPreAuthenticatedUser
+  public void testEnableAuthenticatorAppPreAuthenticationIsUnauthorized() throws Exception {
+    String totp = "123456";
+
+    mvc.perform(post(ENABLE_URL).param("totp", totp)).andExpect(status().isUnauthorized());
+  }
+
+  @Test
+  @WithMockMfaUser
+  public void testDisableAuthenticatorApp() throws Exception {
+    IamAccount account = cloneAccount(TOTP_MFA_ACCOUNT);
+    IamTotpMfa totpMfa = cloneTotpMfa(TOTP_MFA);
+    String totp = "123456";
+
+    when(totpMfaService.verifyTotp(account, totp)).thenReturn(true);
+    when(totpMfaService.disableTotpMfa(account)).thenReturn(totpMfa);
+
+    mvc.perform(post(DISABLE_URL).param("totp", totp)).andExpect(status().isOk());
+
+    verify(accountRepository, times(2)).findByUsername(TOTP_USERNAME);
+    verify(totpMfaService, times(1)).verifyTotp(account, totp);
+    verify(totpMfaService, times(1)).disableTotpMfa(account);
+  }
+
+  @Test
+  @WithMockMfaUser
+  public void testDisableAuthenticatorAppIncorrectCode() throws Exception {
+    IamAccount account = cloneAccount(TOTP_MFA_ACCOUNT);
+    String totp = "123456";
+
+    when(totpMfaService.verifyTotp(account, totp)).thenReturn(false);
+
+    mvc.perform(post(DISABLE_URL).param("totp", totp)).andExpect(status().is4xxClientError());
+
+    verify(totpMfaService, times(1)).verifyTotp(account, totp);
+    verify(totpMfaService, never()).disableTotpMfa(account);
+  }
+
+  @Test
+  @WithMockMfaUser
+  public void testDisableAuthenticatorAppInvalidCharactersInCode() throws Exception {
+    IamAccount account = cloneAccount(TOTP_MFA_ACCOUNT);
+    String totp = "123456";
+
+    mvc.perform(post(DISABLE_URL).param("totp", totp)).andExpect(status().is4xxClientError());
+
+    verify(totpMfaService, never()).disableTotpMfa(account);
+  }
+
+  @Test
+  @WithMockMfaUser
+  public void testDisableAuthenticatorAppCodeTooShort() throws Exception {
+    IamAccount account = cloneAccount(TOTP_MFA_ACCOUNT);
+    String totp = "12345";
+
+    mvc.perform(post(DISABLE_URL).param("totp", totp)).andExpect(status().is4xxClientError());
+
+    verify(totpMfaService, never()).disableTotpMfa(account);
+  }
+
+  @Test
+  @WithMockMfaUser
+  public void testDisableAuthenticatorAppCodeTooLong() throws Exception {
+    IamAccount account = cloneAccount(TOTP_MFA_ACCOUNT);
+    String totp = "1234567";
+
+    mvc.perform(post(DISABLE_URL).param("totp", totp)).andExpect(status().is4xxClientError());
+
+    verify(totpMfaService, never()).disableTotpMfa(account);
+  }
+
+  @Test
+  @WithMockMfaUser
+  public void testDisableAuthenticatorAppNullCode() throws Exception {
+    IamAccount account = cloneAccount(TOTP_MFA_ACCOUNT);
+    String totp = null;
+
+    mvc.perform(post(DISABLE_URL).param("totp", totp)).andExpect(status().is4xxClientError());
+
+    verify(totpMfaService, never()).disableTotpMfa(account);
+  }
+
+  @Test
+  @WithMockMfaUser
+  public void testDisableAuthenticatorAppEmptyCode() throws Exception {
+    IamAccount account = cloneAccount(TOTP_MFA_ACCOUNT);
+    String totp = "";
+
+    mvc.perform(post(DISABLE_URL).param("totp", totp)).andExpect(status().is4xxClientError());
+
+    verify(totpMfaService, never()).disableTotpMfa(account);
+  }
+
+  @Test
+  @WithAnonymousUser
+  public void testDisableAuthenticatorAppNoAuthenticationIsUnauthorized() throws Exception {
+    String totp = "123456";
+
+    mvc.perform(post(DISABLE_URL).param("totp", totp)).andExpect(status().isUnauthorized());
+  }
+
+  @Test
+  @WithMockPreAuthenticatedUser
+  public void testDisableAuthenticatorAppPreAuthenticationIsUnauthorized() throws Exception {
+    String totp = "123456";
+
+    mvc.perform(post(DISABLE_URL).param("totp", totp)).andExpect(status().isUnauthorized());
+  }
+}
diff --git a/iam-login-service/src/test/java/it/infn/mw/iam/test/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppSettingsTests.java b/iam-login-service/src/test/java/it/infn/mw/iam/test/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppSettingsTests.java
deleted file mode 100644
index a8cc590aa..000000000
--- a/iam-login-service/src/test/java/it/infn/mw/iam/test/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppSettingsTests.java
+++ /dev/null
@@ -1,428 +0,0 @@
-/**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package it.infn.mw.iam.test.api.account.multi_factor_authentication.authenticator_app;
-
-import static it.infn.mw.iam.test.TestUtils.passwordTokenGetter;
-import static org.hamcrest.Matchers.equalTo;
-import static org.hamcrest.Matchers.containsString;
-import static org.mockito.ArgumentMatchers.anyString;
-import static org.mockito.Mockito.when;
-
-import org.junit.After;
-import org.junit.Before;
-import org.junit.BeforeClass;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.mockito.Mockito;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.beans.factory.annotation.Value;
-import org.springframework.boot.test.mock.mockito.MockBean;
-import org.springframework.http.HttpStatus;
-import org.springframework.test.context.junit4.SpringRunner;
-
-import dev.samstevens.totp.code.CodeVerifier;
-import io.restassured.RestAssured;
-import io.restassured.response.ValidatableResponse;
-import it.infn.mw.iam.api.account.multi_factor_authentication.authenticator_app.AuthenticatorAppSettingsController;
-import it.infn.mw.iam.api.scim.model.ScimEmail;
-import it.infn.mw.iam.api.scim.model.ScimName;
-import it.infn.mw.iam.api.scim.model.ScimUser;
-import it.infn.mw.iam.api.scim.provisioning.ScimUserProvisioning;
-import it.infn.mw.iam.persistence.model.IamAccount;
-import it.infn.mw.iam.persistence.model.IamTotpMfa;
-import it.infn.mw.iam.persistence.repository.IamAccountRepository;
-import it.infn.mw.iam.test.TestUtils;
-import it.infn.mw.iam.test.util.annotation.IamRandomPortIntegrationTest;
-
-// TODO update these to reflect customisation properties for authenticator app, e.g. code length
-
-@RunWith(SpringRunner.class)
-@IamRandomPortIntegrationTest
-public class AuthenticatorAppSettingsTests {
-
-  @Value("${local.server.port}")
-  private Integer iamPort;
-
-  private ScimUser testUser;
-
-  private final String USER_USERNAME = "test_user";
-  private final String USER_PASSWORD = "password";
-  private final ScimName USER_NAME =
-      ScimName.builder().givenName("TESTER").familyName("USER").build();
-  private final ScimEmail USER_EMAIL = ScimEmail.builder().email("test_user@test.org").build();
-
-  @Autowired
-  private ScimUserProvisioning userService;
-  @Autowired
-  private IamAccountRepository accountRepository;
-
-  @MockBean
-  private CodeVerifier codeVerifier;
-
-  @BeforeClass
-  public static void init() {
-    TestUtils.initRestAssured();
-  }
-
-  @Before
-  public void setup() {
-
-    testUser = userService.create(ScimUser.builder()
-      .active(true)
-      .addEmail(USER_EMAIL)
-      .name(USER_NAME)
-      .displayName(USER_USERNAME)
-      .userName(USER_USERNAME)
-      .password(USER_PASSWORD)
-      .build());
-  }
-
-  @After
-  public void tearDown() {
-    userService.delete(testUser.getId());
-    Mockito.reset(codeVerifier);
-  }
-
-  private ValidatableResponse doPut(String accessToken) {
-    return RestAssured.given()
-      .port(iamPort)
-      .auth()
-      .preemptive()
-      .oauth2(accessToken)
-      .log()
-      .all(true)
-      .when()
-      .put(AuthenticatorAppSettingsController.ADD_SECRET_URL)
-      .then()
-      .log()
-      .all(true);
-  }
-
-  private ValidatableResponse doPut() {
-    return RestAssured.given()
-      .port(iamPort)
-      .log()
-      .all(true)
-      .when()
-      .put(AuthenticatorAppSettingsController.ADD_SECRET_URL)
-      .then()
-      .log()
-      .all(true);
-  }
-
-  private ValidatableResponse doPost(String accessToken, String url, String code) {
-    return RestAssured.given()
-      .port(iamPort)
-      .formParam("code", code)
-      .auth()
-      .preemptive()
-      .oauth2(accessToken)
-      .log()
-      .all(true)
-      .when()
-      .post(url)
-      .then()
-      .log()
-      .all(true);
-  }
-
-  private ValidatableResponse doPost(String url, String code) {
-    return RestAssured.given()
-      .port(iamPort)
-      .formParam("code", code)
-      .log()
-      .all(true)
-      .when()
-      .post(url)
-      .then()
-      .log()
-      .all(true);
-  }
-
-  @Test
-  public void testAddSecret() {
-    String accessToken = passwordTokenGetter().port(iamPort)
-      .username(testUser.getUserName())
-      .password(USER_PASSWORD)
-      .getAccessToken();
-
-    doPut(accessToken).statusCode(HttpStatus.OK.value());
-  }
-
-  @Test
-  public void testAddSecretFullAuthenticationRequired() {
-    doPut().statusCode(HttpStatus.UNAUTHORIZED.value())
-      .body("error", equalTo("unauthorized"))
-      .body("error_description",
-          equalTo("Full authentication is required to access this resource"));
-  }
-
-  @Test
-  public void testEnableAuthenticatorApp() throws Exception {
-    String accessToken = passwordTokenGetter().port(iamPort)
-      .username(testUser.getUserName())
-      .password(USER_PASSWORD)
-      .getAccessToken();
-
-    String code = "123456";
-
-    IamAccount account = accountRepository.findByUsername(testUser.getUserName())
-      .orElseThrow(() -> new Exception("Test user not found"));
-    IamTotpMfa totpMfa = new IamTotpMfa(account);
-    totpMfa.setSecret("test");
-    totpMfa.setActive(false);
-    account.setTotpMfa(totpMfa);
-    accountRepository.save(account);
-
-    when(codeVerifier.isValidCode(anyString(), anyString())).thenReturn(true);
-
-    doPost(accessToken, AuthenticatorAppSettingsController.ENABLE_URL, code)
-      .statusCode(HttpStatus.OK.value());
-  }
-
-  @Test
-  public void testEnableAuthenticatorAppIncorrectCode() throws Exception {
-    String accessToken = passwordTokenGetter().port(iamPort)
-      .username(testUser.getUserName())
-      .password(USER_PASSWORD)
-      .getAccessToken();
-
-    String code = "123456";
-
-    IamAccount account = accountRepository.findByUsername(testUser.getUserName())
-      .orElseThrow(() -> new Exception("Test user not found"));
-    IamTotpMfa totpMfa = new IamTotpMfa(account);
-    totpMfa.setSecret("test");
-    totpMfa.setActive(false);
-    account.setTotpMfa(totpMfa);
-    accountRepository.save(account);
-
-    when(codeVerifier.isValidCode(anyString(), anyString())).thenReturn(false);
-
-    doPost(accessToken, AuthenticatorAppSettingsController.ENABLE_URL, code)
-      .statusCode(HttpStatus.BAD_REQUEST.value())
-      .body(containsString("Bad MFA code"));
-  }
-
-  @Test
-  public void testEnableAuthenticatorAppInvalidCharactersInCode() throws Exception {
-    String accessToken = passwordTokenGetter().port(iamPort)
-      .username(testUser.getUserName())
-      .password(USER_PASSWORD)
-      .getAccessToken();
-
-    String code = "abcdef";
-
-    doPost(accessToken, AuthenticatorAppSettingsController.ENABLE_URL, code)
-      .statusCode(HttpStatus.BAD_REQUEST.value())
-      .body(containsString("Bad MFA code"));
-  }
-
-  @Test
-  public void testEnableAuthenticatorAppCodeTooShort() throws Exception {
-    String accessToken = passwordTokenGetter().port(iamPort)
-      .username(testUser.getUserName())
-      .password(USER_PASSWORD)
-      .getAccessToken();
-
-    String code = "12345";
-
-    doPost(accessToken, AuthenticatorAppSettingsController.ENABLE_URL, code)
-      .statusCode(HttpStatus.BAD_REQUEST.value())
-      .body(containsString("Bad MFA code"));
-  }
-
-  @Test
-  public void testEnableAuthenticatorAppCodeTooLong() throws Exception {
-    String accessToken = passwordTokenGetter().port(iamPort)
-      .username(testUser.getUserName())
-      .password(USER_PASSWORD)
-      .getAccessToken();
-
-    String code = "1234567";
-
-    doPost(accessToken, AuthenticatorAppSettingsController.ENABLE_URL, code)
-      .statusCode(HttpStatus.BAD_REQUEST.value())
-      .body(containsString("Bad MFA code"));
-  }
-
-  @Test
-  public void testEnableAuthenticatorAppNullCode() throws Exception {
-    String accessToken = passwordTokenGetter().port(iamPort)
-      .username(testUser.getUserName())
-      .password(USER_PASSWORD)
-      .getAccessToken();
-
-    String code = null;
-
-    doPost(accessToken, AuthenticatorAppSettingsController.ENABLE_URL, code)
-      .statusCode(HttpStatus.BAD_REQUEST.value())
-      .body(containsString("Bad MFA code"));
-  }
-
-  @Test
-  public void testEnableAuthenticatorAppEmptyCode() throws Exception {
-    String accessToken = passwordTokenGetter().port(iamPort)
-      .username(testUser.getUserName())
-      .password(USER_PASSWORD)
-      .getAccessToken();
-
-    String code = "";
-
-    doPost(accessToken, AuthenticatorAppSettingsController.ENABLE_URL, code)
-      .statusCode(HttpStatus.BAD_REQUEST.value())
-      .body(containsString("Bad MFA code"));
-  }
-
-  @Test
-  public void testEnableAuthenticatorAppFullAuthenticationRequired() {
-    String code = "123456";
-
-    doPost(AuthenticatorAppSettingsController.ENABLE_URL, code)
-      .statusCode(HttpStatus.UNAUTHORIZED.value())
-      .body("error", equalTo("unauthorized"))
-      .body("error_description",
-          equalTo("Full authentication is required to access this resource"));
-  }
-
-  @Test
-  public void testDisableAuthenticatorApp() throws Exception {
-    String accessToken = passwordTokenGetter().port(iamPort)
-      .username(testUser.getUserName())
-      .password(USER_PASSWORD)
-      .getAccessToken();
-
-    String code = "123456";
-
-    IamAccount account = accountRepository.findByUsername(testUser.getUserName())
-      .orElseThrow(() -> new Exception("Test user not found"));
-    IamTotpMfa totpMfa = new IamTotpMfa(account);
-    totpMfa.setSecret("test");
-    totpMfa.setActive(true);
-    account.setTotpMfa(totpMfa);
-    accountRepository.save(account);
-
-    when(codeVerifier.isValidCode(anyString(), anyString())).thenReturn(true);
-
-    doPost(accessToken, AuthenticatorAppSettingsController.DISABLE_URL, code)
-      .statusCode(HttpStatus.OK.value());
-  }
-
-  @Test
-  public void testDisableAuthenticatorAppIncorrectCode() throws Exception {
-    String accessToken = passwordTokenGetter().port(iamPort)
-      .username(testUser.getUserName())
-      .password(USER_PASSWORD)
-      .getAccessToken();
-
-    String code = "123456";
-
-    IamAccount account = accountRepository.findByUsername(testUser.getUserName())
-      .orElseThrow(() -> new Exception("Test user not found"));
-    IamTotpMfa totpMfa = new IamTotpMfa(account);
-    totpMfa.setSecret("test");
-    totpMfa.setActive(true);
-    account.setTotpMfa(totpMfa);
-    accountRepository.save(account);
-
-    when(codeVerifier.isValidCode(anyString(), anyString())).thenReturn(false);
-
-    doPost(accessToken, AuthenticatorAppSettingsController.DISABLE_URL, code)
-      .statusCode(HttpStatus.BAD_REQUEST.value())
-      .body(containsString("Bad MFA code"));
-  }
-
-  @Test
-  public void testDisableAuthenticatorAppInvalidCharactersInCode() throws Exception {
-    String accessToken = passwordTokenGetter().port(iamPort)
-      .username(testUser.getUserName())
-      .password(USER_PASSWORD)
-      .getAccessToken();
-
-    String code = "abcdef";
-
-    doPost(accessToken, AuthenticatorAppSettingsController.DISABLE_URL, code)
-      .statusCode(HttpStatus.BAD_REQUEST.value())
-      .body(containsString("Bad MFA code"));
-  }
-
-  @Test
-  public void testDisableAuthenticatorAppCodeTooShort() throws Exception {
-    String accessToken = passwordTokenGetter().port(iamPort)
-      .username(testUser.getUserName())
-      .password(USER_PASSWORD)
-      .getAccessToken();
-
-    String code = "12345";
-
-    doPost(accessToken, AuthenticatorAppSettingsController.DISABLE_URL, code)
-      .statusCode(HttpStatus.BAD_REQUEST.value())
-      .body(containsString("Bad MFA code"));
-  }
-
-  @Test
-  public void testDisableAuthenticatorAppCodeTooLong() throws Exception {
-    String accessToken = passwordTokenGetter().port(iamPort)
-      .username(testUser.getUserName())
-      .password(USER_PASSWORD)
-      .getAccessToken();
-
-    String code = "1234567";
-
-    doPost(accessToken, AuthenticatorAppSettingsController.DISABLE_URL, code)
-      .statusCode(HttpStatus.BAD_REQUEST.value())
-      .body(containsString("Bad MFA code"));
-  }
-
-  @Test
-  public void testDisableAuthenticatorAppNullCode() throws Exception {
-    String accessToken = passwordTokenGetter().port(iamPort)
-      .username(testUser.getUserName())
-      .password(USER_PASSWORD)
-      .getAccessToken();
-
-    String code = null;
-
-    doPost(accessToken, AuthenticatorAppSettingsController.DISABLE_URL, code)
-      .statusCode(HttpStatus.BAD_REQUEST.value())
-      .body(containsString("Bad MFA code"));
-  }
-
-  @Test
-  public void testDisableAuthenticatorAppEmptyCode() throws Exception {
-    String accessToken = passwordTokenGetter().port(iamPort)
-      .username(testUser.getUserName())
-      .password(USER_PASSWORD)
-      .getAccessToken();
-
-    String code = "";
-
-    doPost(accessToken, AuthenticatorAppSettingsController.DISABLE_URL, code)
-      .statusCode(HttpStatus.BAD_REQUEST.value())
-      .body(containsString("Bad MFA code"));
-  }
-
-  @Test
-  public void testDisableAuthenticatorAppFullAuthenticationRequired() {
-    String code = "123456";
-
-    doPost(AuthenticatorAppSettingsController.DISABLE_URL, code)
-      .statusCode(HttpStatus.UNAUTHORIZED.value())
-      .body("error", equalTo("unauthorized"))
-      .body("error_description",
-          equalTo("Full authentication is required to access this resource"));
-  }
-}
diff --git a/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/IamTotpMfaServiceTestSupport.java b/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/IamTotpMfaServiceTestSupport.java
new file mode 100644
index 000000000..060c3c444
--- /dev/null
+++ b/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/IamTotpMfaServiceTestSupport.java
@@ -0,0 +1,131 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.infn.mw.iam.test.multi_factor_authentication;
+
+import java.util.Arrays;
+import java.util.HashSet;
+import java.util.Set;
+
+import it.infn.mw.iam.persistence.model.IamAccount;
+import it.infn.mw.iam.persistence.model.IamAuthority;
+import it.infn.mw.iam.persistence.model.IamTotpMfa;
+import it.infn.mw.iam.persistence.model.IamTotpRecoveryCode;
+
+public class IamTotpMfaServiceTestSupport {
+
+  public static final String PASSWORD = "password";
+
+  public static final String TOTP_MFA_ACCOUNT_UUID = "b3e7dd7f-a1ac-eda0-371d-b902a6c5cee2";
+  public static final String TOTP_MFA_ACCOUNT_USERNAME = "totp";
+  public static final String TOTP_MFA_ACCOUNT_EMAIL = "totp@example.org";
+  public static final String TOTP_MFA_ACCOUNT_GIVEN_NAME = "Totp";
+  public static final String TOTP_MFA_ACCOUNT_FAMILY_NAME = "Mfa";
+
+  public static final String TOTP_MFA_SECRET = "secret";
+
+  public static final String TOTP_RECOVERY_CODE_STRING_1 = "code-1";
+  public static final String TOTP_RECOVERY_CODE_STRING_2 = "code-2";
+  public static final String TOTP_RECOVERY_CODE_STRING_3 = "code-3";
+  public static final String TOTP_RECOVERY_CODE_STRING_4 = "code-4";
+  public static final String TOTP_RECOVERY_CODE_STRING_5 = "code-5";
+  public static final String TOTP_RECOVERY_CODE_STRING_6 = "code-6";
+  public static final String TOTP_RECOVERY_CODE_STRING_7 = "code-7";
+  public static final String TOTP_RECOVERY_CODE_STRING_8 = "code-8";
+  public static final String TOTP_RECOVERY_CODE_STRING_9 = "code-9";
+  public static final String TOTP_RECOVERY_CODE_STRING_10 = "code-10";
+  public static final String TOTP_RECOVERY_CODE_STRING_11 = "code-11";
+  public static final String TOTP_RECOVERY_CODE_STRING_12 = "code-12";
+
+  protected final IamAccount TOTP_MFA_ACCOUNT;
+  protected final IamAuthority ROLE_USER_AUTHORITY;
+
+  protected final IamTotpMfa TOTP_MFA;
+
+  protected final IamTotpRecoveryCode TOTP_RECOVERY_CODE_1;
+  protected final IamTotpRecoveryCode TOTP_RECOVERY_CODE_2;
+  protected final IamTotpRecoveryCode TOTP_RECOVERY_CODE_3;
+  protected final IamTotpRecoveryCode TOTP_RECOVERY_CODE_4;
+  protected final IamTotpRecoveryCode TOTP_RECOVERY_CODE_5;
+  protected final IamTotpRecoveryCode TOTP_RECOVERY_CODE_6;
+
+  public IamTotpMfaServiceTestSupport() {
+    ROLE_USER_AUTHORITY = new IamAuthority("ROLE_USER");
+
+    TOTP_MFA_ACCOUNT = IamAccount.newAccount();
+    TOTP_MFA_ACCOUNT.setUuid(TOTP_MFA_ACCOUNT_UUID);
+    TOTP_MFA_ACCOUNT.setUsername(TOTP_MFA_ACCOUNT_USERNAME);
+    TOTP_MFA_ACCOUNT.getUserInfo().setEmail(TOTP_MFA_ACCOUNT_EMAIL);
+    TOTP_MFA_ACCOUNT.getUserInfo().setGivenName(TOTP_MFA_ACCOUNT_GIVEN_NAME);
+    TOTP_MFA_ACCOUNT.getUserInfo().setFamilyName(TOTP_MFA_ACCOUNT_FAMILY_NAME);
+
+    TOTP_MFA = new IamTotpMfa();
+    TOTP_MFA.setAccount(TOTP_MFA_ACCOUNT);
+    TOTP_MFA.setSecret(TOTP_MFA_SECRET);
+    TOTP_MFA.setActive(true);
+
+    TOTP_RECOVERY_CODE_1 = new IamTotpRecoveryCode(TOTP_MFA);
+    TOTP_RECOVERY_CODE_2 = new IamTotpRecoveryCode(TOTP_MFA);
+    TOTP_RECOVERY_CODE_3 = new IamTotpRecoveryCode(TOTP_MFA);
+    TOTP_RECOVERY_CODE_4 = new IamTotpRecoveryCode(TOTP_MFA);
+    TOTP_RECOVERY_CODE_5 = new IamTotpRecoveryCode(TOTP_MFA);
+    TOTP_RECOVERY_CODE_6 = new IamTotpRecoveryCode(TOTP_MFA);
+
+    TOTP_RECOVERY_CODE_1.setCode(TOTP_RECOVERY_CODE_STRING_1);
+    TOTP_RECOVERY_CODE_2.setCode(TOTP_RECOVERY_CODE_STRING_2);
+    TOTP_RECOVERY_CODE_3.setCode(TOTP_RECOVERY_CODE_STRING_3);
+    TOTP_RECOVERY_CODE_4.setCode(TOTP_RECOVERY_CODE_STRING_4);
+    TOTP_RECOVERY_CODE_5.setCode(TOTP_RECOVERY_CODE_STRING_5);
+    TOTP_RECOVERY_CODE_6.setCode(TOTP_RECOVERY_CODE_STRING_6);
+
+    TOTP_MFA
+      .setRecoveryCodes(new HashSet<>(Arrays.asList(TOTP_RECOVERY_CODE_1, TOTP_RECOVERY_CODE_2,
+          TOTP_RECOVERY_CODE_3, TOTP_RECOVERY_CODE_4, TOTP_RECOVERY_CODE_5, TOTP_RECOVERY_CODE_6)));
+
+    TOTP_MFA.touch();
+  }
+
+  public IamAccount cloneAccount(IamAccount account) {
+    IamAccount newAccount = IamAccount.newAccount();
+    newAccount.setUuid(account.getUuid());
+    newAccount.setUsername(account.getUsername());
+    newAccount.getUserInfo().setEmail(account.getUserInfo().getEmail());
+    newAccount.getUserInfo().setGivenName(account.getUserInfo().getGivenName());
+    newAccount.getUserInfo().setFamilyName(account.getUserInfo().getFamilyName());
+
+    newAccount.touch();
+
+    return newAccount;
+  }
+
+  public IamTotpMfa cloneTotpMfa(IamTotpMfa totpMfa) {
+    IamTotpMfa newTotpMfa = new IamTotpMfa();
+    newTotpMfa.setAccount(totpMfa.getAccount());
+    newTotpMfa.setSecret(totpMfa.getSecret());
+    newTotpMfa.setActive(totpMfa.isActive());
+
+    Set newCodes = new HashSet<>();
+    for (IamTotpRecoveryCode recoveryCode : totpMfa.getRecoveryCodes()) {
+      IamTotpRecoveryCode newCode = new IamTotpRecoveryCode(newTotpMfa);
+      newCode.setCode(recoveryCode.getCode());
+      newCodes.add(newCode);
+    }
+    newTotpMfa.setRecoveryCodes(newCodes);
+
+    newTotpMfa.touch();
+
+    return newTotpMfa;
+  }
+}
diff --git a/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/IamTotpMfaServiceTests.java b/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/IamTotpMfaServiceTests.java
new file mode 100644
index 000000000..89a18b2de
--- /dev/null
+++ b/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/IamTotpMfaServiceTests.java
@@ -0,0 +1,231 @@
+package it.infn.mw.iam.test.multi_factor_authentication;
+
+import static org.hamcrest.CoreMatchers.instanceOf;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.equalTo;
+import static org.hamcrest.Matchers.not;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.ArgumentMatchers.anyInt;
+import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.Mockito.reset;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.util.Optional;
+import java.util.Set;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.ArgumentCaptor;
+import org.mockito.Captor;
+import org.mockito.Mock;
+import org.mockito.junit.MockitoJUnitRunner;
+import org.springframework.context.ApplicationEvent;
+import org.springframework.context.ApplicationEventPublisher;
+
+import dev.samstevens.totp.code.CodeVerifier;
+import dev.samstevens.totp.recovery.RecoveryCodeGenerator;
+import dev.samstevens.totp.secret.SecretGenerator;
+import it.infn.mw.iam.api.account.multi_factor_authentication.DefaultIamTotpMfaService;
+import it.infn.mw.iam.api.account.multi_factor_authentication.IamTotpMfaService;
+import it.infn.mw.iam.audit.events.account.multi_factor_authentication.AuthenticatorAppDisabledEvent;
+import it.infn.mw.iam.audit.events.account.multi_factor_authentication.AuthenticatorAppEnabledEvent;
+import it.infn.mw.iam.core.user.IamAccountService;
+import it.infn.mw.iam.core.user.exception.MfaSecretAlreadyBoundException;
+import it.infn.mw.iam.core.user.exception.MfaSecretNotFoundException;
+import it.infn.mw.iam.core.user.exception.TotpMfaAlreadyEnabledException;
+import it.infn.mw.iam.persistence.model.IamAccount;
+import it.infn.mw.iam.persistence.model.IamTotpMfa;
+import it.infn.mw.iam.persistence.model.IamTotpRecoveryCode;
+import it.infn.mw.iam.persistence.repository.IamTotpMfaRepository;
+
+@RunWith(MockitoJUnitRunner.class)
+public class IamTotpMfaServiceTests extends IamTotpMfaServiceTestSupport {
+
+  private IamTotpMfaService service;
+
+  @Mock
+  private IamTotpMfaRepository repository;
+
+  @Mock
+  private SecretGenerator secretGenerator;
+
+  @Mock
+  private RecoveryCodeGenerator recoveryCodeGenerator;
+
+  @Mock
+  private IamAccountService iamAccountService;
+
+  @Mock
+  private CodeVerifier codeVerifier;
+
+  @Mock
+  private ApplicationEventPublisher eventPublisher;
+
+  @Captor
+  private ArgumentCaptor eventCaptor;
+
+  @Before
+  public void setup() {
+    when(secretGenerator.generate()).thenReturn("test_secret");
+    when(repository.findByAccount(TOTP_MFA_ACCOUNT)).thenReturn(Optional.of(TOTP_MFA));
+    when(iamAccountService.saveAccount(TOTP_MFA_ACCOUNT)).thenAnswer(i -> i.getArguments()[0]);
+    when(codeVerifier.isValidCode(anyString(), anyString())).thenReturn(true);
+
+    String[] testArray = {TOTP_RECOVERY_CODE_STRING_7, TOTP_RECOVERY_CODE_STRING_8,
+        TOTP_RECOVERY_CODE_STRING_9, TOTP_RECOVERY_CODE_STRING_10, TOTP_RECOVERY_CODE_STRING_11,
+        TOTP_RECOVERY_CODE_STRING_12};
+    when(recoveryCodeGenerator.generateCodes(anyInt())).thenReturn(testArray);
+
+    service = new DefaultIamTotpMfaService(iamAccountService, repository, secretGenerator,
+        recoveryCodeGenerator, codeVerifier, eventPublisher);
+  }
+
+  @After
+  public void tearDown() {
+    reset(secretGenerator, repository, iamAccountService, codeVerifier, recoveryCodeGenerator);
+  }
+
+  @Test
+  public void testAssignsTotpMfaToAccount() {
+    when(repository.findByAccount(TOTP_MFA_ACCOUNT)).thenReturn(Optional.empty());
+
+    IamAccount account = cloneAccount(TOTP_MFA_ACCOUNT);
+    IamTotpMfa totpMfa = service.addTotpMfaSecret(account);
+    verify(repository, times(1)).save(totpMfa);
+    verify(secretGenerator, times(1)).generate();
+    verify(recoveryCodeGenerator, times(1)).generateCodes(anyInt());
+
+    assertNotNull(totpMfa.getSecret());
+    assertFalse(totpMfa.isActive());
+    assertThat(totpMfa.getAccount(), equalTo(account));
+  }
+
+  @Test(expected = MfaSecretAlreadyBoundException.class)
+  public void testAddMfaSecret_whenMfaSecretAssignedFails() {
+    IamAccount account = cloneAccount(TOTP_MFA_ACCOUNT);
+
+    try {
+      service.addTotpMfaSecret(account);
+    } catch (MfaSecretAlreadyBoundException e) {
+      assertThat(e.getMessage(),
+          equalTo("A multi-factor secret is already assigned to this account"));
+      throw e;
+    }
+  }
+
+  @Test
+  public void testAddsMfaRecoveryCodesToAccount() {
+    IamAccount account = cloneAccount(TOTP_MFA_ACCOUNT);
+    IamTotpMfa totpMfa = cloneTotpMfa(TOTP_MFA);
+    Set originalCodes = totpMfa.getRecoveryCodes();
+
+    try {
+      totpMfa = service.addTotpMfaRecoveryCodes(account);
+    } catch (MfaSecretNotFoundException e) {
+      assertThat(e.getMessage(), equalTo("No multi-factor secret is attached to this account"));
+      throw e;
+    }
+
+    Set newCodes = totpMfa.getRecoveryCodes();
+    assertThat(originalCodes.toArray(), not(equalTo(newCodes.toArray())));
+  }
+
+  @Test(expected = MfaSecretNotFoundException.class)
+  public void testAddsMfaRecoveryCode_whenNoMfaSecretAssignedFails() {
+    when(repository.findByAccount(TOTP_MFA_ACCOUNT)).thenReturn(Optional.empty());
+
+    IamAccount account = cloneAccount(TOTP_MFA_ACCOUNT);
+
+    try {
+      service.addTotpMfaRecoveryCodes(account);
+    } catch (MfaSecretNotFoundException e) {
+      assertThat(e.getMessage(), equalTo("No multi-factor secret is attached to this account"));
+      throw e;
+    }
+  }
+
+  @Test
+  public void testEnablesTotpMfa() {
+    IamAccount account = cloneAccount(TOTP_MFA_ACCOUNT);
+    IamTotpMfa totpMfa = cloneTotpMfa(TOTP_MFA);
+    totpMfa.setSecret("secret");
+    totpMfa.setActive(false);
+    totpMfa.setAccount(account);
+
+    when(repository.findByAccount(TOTP_MFA_ACCOUNT)).thenReturn(Optional.of(totpMfa));
+
+    service.enableTotpMfa(account);
+    verify(repository, times(1)).save(totpMfa);
+    verify(eventPublisher, times(1)).publishEvent(eventCaptor.capture());
+
+    ApplicationEvent event = eventCaptor.getValue();
+    assertThat(event, instanceOf(AuthenticatorAppEnabledEvent.class));
+
+    AuthenticatorAppEnabledEvent e = (AuthenticatorAppEnabledEvent) event;
+    assertTrue(e.getTotpMfa().isActive());
+    assertThat(e.getTotpMfa().getAccount(), equalTo(account));
+  }
+
+  @Test(expected = TotpMfaAlreadyEnabledException.class)
+  public void testEnableTotpMfa_whenTotpMfaEnabledFails() {
+    IamAccount account = cloneAccount(TOTP_MFA_ACCOUNT);
+
+    try {
+      service.enableTotpMfa(account);
+    } catch (TotpMfaAlreadyEnabledException e) {
+      assertThat(e.getMessage(), equalTo("TOTP MFA is already enabled on this account"));
+      throw e;
+    }
+  }
+
+  @Test(expected = MfaSecretNotFoundException.class)
+  public void testEnablesTotpMfa_whenNoMfaSecretAssignedFails() {
+    when(repository.findByAccount(TOTP_MFA_ACCOUNT)).thenReturn(Optional.empty());
+
+    IamAccount account = cloneAccount(TOTP_MFA_ACCOUNT);
+
+    try {
+      service.enableTotpMfa(account);
+    } catch (MfaSecretNotFoundException e) {
+      assertThat(e.getMessage(), equalTo("No multi-factor secret is attached to this account"));
+      throw e;
+    }
+  }
+
+  @Test
+  public void testDisablesTotpMfa() {
+    IamAccount account = cloneAccount(TOTP_MFA_ACCOUNT);
+    IamTotpMfa totpMfa = cloneTotpMfa(TOTP_MFA);
+
+    service.disableTotpMfa(account);
+    verify(repository, times(1)).delete(totpMfa);
+    verify(iamAccountService, times(1)).saveAccount(account);
+    verify(eventPublisher, times(1)).publishEvent(eventCaptor.capture());
+
+    ApplicationEvent event = eventCaptor.getValue();
+    assertThat(event, instanceOf(AuthenticatorAppDisabledEvent.class));
+
+    AuthenticatorAppDisabledEvent e = (AuthenticatorAppDisabledEvent) event;
+    assertThat(e.getTotpMfa().getAccount(), equalTo(account));
+  }
+
+  @Test(expected = MfaSecretNotFoundException.class)
+  public void testDisablesTotpMfa_whenNoMfaSecretAssignedFails() {
+    when(repository.findByAccount(TOTP_MFA_ACCOUNT)).thenReturn(Optional.empty());
+
+    IamAccount account = cloneAccount(TOTP_MFA_ACCOUNT);
+
+    try {
+      service.disableTotpMfa(account);
+    } catch (MfaSecretNotFoundException e) {
+      assertThat(e.getMessage(), equalTo("No multi-factor secret is attached to this account"));
+      throw e;
+    }
+  }
+}
diff --git a/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/MfaVerifyControllerTests.java b/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/MfaVerifyControllerTests.java
index 137fe2262..4995dbe01 100644
--- a/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/MfaVerifyControllerTests.java
+++ b/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/MfaVerifyControllerTests.java
@@ -15,21 +15,21 @@
  */
 package it.infn.mw.iam.test.multi_factor_authentication;
 
-import static org.mockito.Mockito.reset;
+import static it.infn.mw.iam.authn.multi_factor_authentication.MfaVerifyController.MFA_VERIFY_URL;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
+import static org.springframework.security.test.web.servlet.setup.SecurityMockMvcConfigurers.springSecurity;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
+import static org.springframework.test.web.servlet.result.MockMvcResultHandlers.log;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.model;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
-import static org.springframework.security.test.web.servlet.setup.SecurityMockMvcConfigurers.springSecurity;
-import static org.springframework.test.web.servlet.result.MockMvcResultHandlers.log;
 
 import java.util.Optional;
 
-import org.junit.After;
 import org.junit.Before;
 import org.junit.Test;
 import org.junit.runner.RunWith;
-import org.mockito.InjectMocks;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.test.mock.mockito.MockBean;
 import org.springframework.security.test.context.support.WithMockUser;
@@ -38,8 +38,8 @@
 import org.springframework.test.web.servlet.setup.MockMvcBuilders;
 import org.springframework.web.context.WebApplicationContext;
 
-import it.infn.mw.iam.authn.multi_factor_authentication.MfaVerifyController;
 import it.infn.mw.iam.persistence.repository.IamAccountRepository;
+import it.infn.mw.iam.persistence.repository.IamTotpMfaRepository;
 import it.infn.mw.iam.test.util.WithAnonymousUser;
 import it.infn.mw.iam.test.util.WithMockPreAuthenticatedUser;
 import it.infn.mw.iam.test.util.annotation.IamMockMvcIntegrationTest;
@@ -54,47 +54,40 @@ public class MfaVerifyControllerTests extends MultiFactorTestSupport {
   private WebApplicationContext context;
 
   @MockBean
-  private IamAccountRepository accountRepo;
+  private IamAccountRepository accountRepository;
 
-  @InjectMocks
-  MfaVerifyController controller;
+  @MockBean
+  private IamTotpMfaRepository totpMfaRepository;
 
   @Before
   public void setup() {
-    when(accountRepo.findByUsername(TEST_USERNAME)).thenReturn(Optional.of(TEST_ACCOUNT));
+    when(accountRepository.findByUsername(TEST_USERNAME)).thenReturn(Optional.of(TOTP_MFA_ACCOUNT));
+    when(totpMfaRepository.findByAccount(TOTP_MFA_ACCOUNT)).thenAnswer(i -> i.getArguments()[0]);
 
     mvc =
         MockMvcBuilders.webAppContextSetup(context).apply(springSecurity()).alwaysDo(log()).build();
   }
 
-  @After
-  public void tearDown() {
-    reset(accountRepo);
-  }
-
   @Test
-  @WithMockPreAuthenticatedUser(username = TEST_USERNAME)
-  public void testGetMfaVerifyView() throws Exception {
-    mvc.perform(get(MfaVerifyController.MFA_VERIFY_URL))
+  @WithMockPreAuthenticatedUser
+  public void testGetVerifyMfaView() throws Exception {
+    mvc.perform(get(MFA_VERIFY_URL))
       .andExpect(status().isOk())
       .andExpect(model().attributeExists("factors"));
+
+    verify(accountRepository, times(1)).findByUsername(TEST_USERNAME);
+    verify(totpMfaRepository, times(1)).findByAccount(TOTP_MFA_ACCOUNT);
   }
 
   @Test
   @WithAnonymousUser
   public void testGetMfaVerifyViewNoAuthenticationIsUnauthorized() throws Exception {
-    mvc.perform(get(MfaVerifyController.MFA_VERIFY_URL)).andExpect(status().isUnauthorized());
+    mvc.perform(get(MFA_VERIFY_URL)).andExpect(status().isUnauthorized());
   }
 
   @Test
-  @WithMockUser(username = "test", authorities = {"USER"})
+  @WithMockUser
   public void testGetMfaVerifyViewWithFullAuthenticationIsForbidden() throws Exception {
-    mvc.perform(get(MfaVerifyController.MFA_VERIFY_URL)).andExpect(status().isForbidden());
-  }
-
-  @Test
-  @WithMockPreAuthenticatedUser(username = "bad_user")
-  public void testGetMfaVerifyViewWhenUserNotFoundIsBadRequest() throws Exception {
-    mvc.perform(get(MfaVerifyController.MFA_VERIFY_URL)).andExpect(status().isBadRequest());
+    mvc.perform(get(MFA_VERIFY_URL)).andExpect(status().isForbidden());
   }
 }
diff --git a/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/MultiFactorTestSupport.java b/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/MultiFactorTestSupport.java
index fd9d238c1..8550a82d5 100644
--- a/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/MultiFactorTestSupport.java
+++ b/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/MultiFactorTestSupport.java
@@ -24,11 +24,16 @@
 import it.infn.mw.iam.persistence.model.IamTotpRecoveryCode;
 
 public class MultiFactorTestSupport {
-  public static final String TEST_USERNAME = "test-pre-authenticated-user";
-  public static final String TEST_UUID = "ceb173b4-28e3-43ad-aaf7-15d3730e2b90";
+  public static final String TEST_USERNAME = "test-user";
+  public static final String TEST_UUID = "a23deabf-88a7-47af-84b5-1d535a1b267c";
   public static final String TEST_EMAIL = "test@example.org";
   public static final String TEST_GIVEN_NAME = "Test";
   public static final String TEST_FAMILY_NAME = "User";
+  public static final String TOTP_USERNAME = "test-mfa-user";
+  public static final String TOTP_UUID = "ceb173b4-28e3-43ad-aaf7-15d3730e2b90";
+  public static final String TOTP_EMAIL = "test-mfa@example.org";
+  public static final String TOTP_GIVEN_NAME = "Test";
+  public static final String TOTP_FAMILY_NAME = "Mfa";
   public static final String TOTP_MFA_SECRET = "secret";
   public static final String TOTP_RECOVERY_CODE_STRING_1 = "code-1";
   public static final String TOTP_RECOVERY_CODE_STRING_2 = "code-2";
@@ -44,6 +49,7 @@ public class MultiFactorTestSupport {
   public static final String TOTP_RECOVERY_CODE_STRING_12 = "code-12";
 
   protected final IamAccount TEST_ACCOUNT;
+  protected final IamAccount TOTP_MFA_ACCOUNT;
   protected final IamTotpMfa TOTP_MFA;
   protected final IamTotpRecoveryCode TOTP_RECOVERY_CODE_1;
   protected final IamTotpRecoveryCode TOTP_RECOVERY_CODE_2;
@@ -62,9 +68,29 @@ public class MultiFactorTestSupport {
   protected final Set RECOVERY_CODE_SET_SECOND;
 
   public MultiFactorTestSupport() {
+    TEST_ACCOUNT = IamAccount.newAccount();
+    TEST_ACCOUNT.setUsername(TEST_USERNAME);
+    TEST_ACCOUNT.setUuid(TEST_UUID);
+    TEST_ACCOUNT.getUserInfo().setEmail(TEST_EMAIL);
+    TEST_ACCOUNT.getUserInfo().setGivenName(TEST_GIVEN_NAME);
+    TEST_ACCOUNT.getUserInfo().setFamilyName(TEST_FAMILY_NAME);
+
+    TEST_ACCOUNT.touch();
+
+    TOTP_MFA_ACCOUNT = IamAccount.newAccount();
+    TOTP_MFA_ACCOUNT.setUsername(TOTP_USERNAME);
+    TOTP_MFA_ACCOUNT.setUuid(TOTP_UUID);
+    TOTP_MFA_ACCOUNT.getUserInfo().setEmail(TOTP_EMAIL);
+    TOTP_MFA_ACCOUNT.getUserInfo().setGivenName(TOTP_GIVEN_NAME);
+    TOTP_MFA_ACCOUNT.getUserInfo().setFamilyName(TOTP_FAMILY_NAME);
+
+    TOTP_MFA_ACCOUNT.touch();
+
     TOTP_MFA = new IamTotpMfa();
+    TOTP_MFA.setAccount(TOTP_MFA_ACCOUNT);
     TOTP_MFA.setSecret(TOTP_MFA_SECRET);
     TOTP_MFA.setActive(true);
+    TOTP_MFA.touch();
 
     TOTP_RECOVERY_CODE_1 = new IamTotpRecoveryCode(TOTP_MFA);
     TOTP_RECOVERY_CODE_2 = new IamTotpRecoveryCode(TOTP_MFA);
@@ -100,20 +126,31 @@ public MultiFactorTestSupport() {
             TOTP_RECOVERY_CODE_10, TOTP_RECOVERY_CODE_11, TOTP_RECOVERY_CODE_12));
 
     TOTP_MFA.setRecoveryCodes(RECOVERY_CODE_SET_FIRST);
-    TEST_ACCOUNT = IamAccount.newAccount();
+  }
+
+  protected void resetTestAccount() {
     TEST_ACCOUNT.setUsername(TEST_USERNAME);
     TEST_ACCOUNT.setUuid(TEST_UUID);
     TEST_ACCOUNT.getUserInfo().setEmail(TEST_EMAIL);
     TEST_ACCOUNT.getUserInfo().setGivenName(TEST_GIVEN_NAME);
     TEST_ACCOUNT.getUserInfo().setFamilyName(TEST_FAMILY_NAME);
-    TEST_ACCOUNT.setTotpMfa(TOTP_MFA);
 
     TEST_ACCOUNT.touch();
   }
 
-  protected void resetTestAccount() {
+  protected void resetTotpAccount() {
+    TOTP_MFA_ACCOUNT.setUsername(TOTP_USERNAME);
+    TOTP_MFA_ACCOUNT.setUuid(TOTP_UUID);
+    TOTP_MFA_ACCOUNT.getUserInfo().setEmail(TOTP_EMAIL);
+    TOTP_MFA_ACCOUNT.getUserInfo().setGivenName(TOTP_GIVEN_NAME);
+    TOTP_MFA_ACCOUNT.getUserInfo().setFamilyName(TOTP_FAMILY_NAME);
+
+    TOTP_MFA_ACCOUNT.touch();
+
+    TOTP_MFA.setAccount(TOTP_MFA_ACCOUNT);
     TOTP_MFA.setSecret(TOTP_MFA_SECRET);
     TOTP_MFA.setActive(true);
+    TOTP_MFA.touch();
 
     TOTP_RECOVERY_CODE_1.setCode(TOTP_RECOVERY_CODE_STRING_1);
     TOTP_RECOVERY_CODE_2.setCode(TOTP_RECOVERY_CODE_STRING_2);
@@ -129,15 +166,6 @@ protected void resetTestAccount() {
     TOTP_RECOVERY_CODE_12.setCode(TOTP_RECOVERY_CODE_STRING_12);
 
     TOTP_MFA.setRecoveryCodes(RECOVERY_CODE_SET_FIRST);
-
-    TEST_ACCOUNT.setUsername(TEST_USERNAME);
-    TEST_ACCOUNT.setUuid(TEST_UUID);
-    TEST_ACCOUNT.getUserInfo().setEmail(TEST_EMAIL);
-    TEST_ACCOUNT.getUserInfo().setGivenName(TEST_GIVEN_NAME);
-    TEST_ACCOUNT.getUserInfo().setFamilyName(TEST_FAMILY_NAME);
-    TEST_ACCOUNT.setTotpMfa(TOTP_MFA);
-
-    TEST_ACCOUNT.touch();
   }
 
   protected IamAccount cloneAccount(IamAccount account) {
@@ -148,26 +176,27 @@ protected IamAccount cloneAccount(IamAccount account) {
     newAccount.getUserInfo().setGivenName(account.getUserInfo().getGivenName());
     newAccount.getUserInfo().setFamilyName(account.getUserInfo().getFamilyName());
 
-    if (account.getTotpMfa() != null) {
-      IamTotpMfa totpMfa = new IamTotpMfa();
-      totpMfa.setSecret(account.getTotpMfa().getSecret());
-      totpMfa.setActive(account.getTotpMfa().isActive());
-
-      if (account.getTotpMfa().getRecoveryCodes() != null) {
-        Set newCodes = new HashSet<>();
-        for (IamTotpRecoveryCode recoveryCode : account.getTotpMfa().getRecoveryCodes()) {
-          IamTotpRecoveryCode newCode = new IamTotpRecoveryCode(totpMfa);
-          newCode.setCode(recoveryCode.getCode());
-          newCodes.add(newCode);
-        }
-        totpMfa.setRecoveryCodes(newCodes);
-      }
-
-      newAccount.setTotpMfa(totpMfa);
-    }
-
     newAccount.touch();
 
     return newAccount;
   }
+
+  protected IamTotpMfa cloneTotpMfa(IamTotpMfa totpMfa) {
+    IamTotpMfa newTotpMfa = new IamTotpMfa();
+    newTotpMfa.setAccount(totpMfa.getAccount());
+    newTotpMfa.setSecret(totpMfa.getSecret());
+    newTotpMfa.setActive(totpMfa.isActive());
+
+    Set newCodes = new HashSet<>();
+    for (IamTotpRecoveryCode recoveryCode : totpMfa.getRecoveryCodes()) {
+      IamTotpRecoveryCode newCode = new IamTotpRecoveryCode(newTotpMfa);
+      newCode.setCode(recoveryCode.getCode());
+      newCodes.add(newCode);
+    }
+    newTotpMfa.setRecoveryCodes(newCodes);
+
+    newTotpMfa.touch();
+
+    return newTotpMfa;
+  }
 }
diff --git a/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/authenticator_app/AuthenticatorAppVerifyControllerTests.java b/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/authenticator_app/AuthenticatorAppVerifyControllerTests.java
deleted file mode 100644
index ab8bf8bd2..000000000
--- a/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/authenticator_app/AuthenticatorAppVerifyControllerTests.java
+++ /dev/null
@@ -1,214 +0,0 @@
-/**
- * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package it.infn.mw.iam.test.multi_factor_authentication.authenticator_app;
-
-import static it.infn.mw.iam.authn.multi_factor_authentication.authenticator_app.AuthenticatorAppVerifyController.VERIFY_CODE_URL;
-import static it.infn.mw.iam.authn.multi_factor_authentication.authenticator_app.AuthenticatorAppVerifyController.VERIFY_RECOVERY_CODE_URL;
-
-import static org.hamcrest.MatcherAssert.assertThat;
-import static org.hamcrest.Matchers.instanceOf;
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-import static org.mockito.ArgumentMatchers.any;
-import static org.mockito.ArgumentMatchers.anyString;
-import static org.mockito.Mockito.reset;
-import static org.mockito.Mockito.verify;
-import static org.mockito.Mockito.when;
-import static org.springframework.security.test.web.servlet.setup.SecurityMockMvcConfigurers.springSecurity;
-import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
-import static org.springframework.test.web.servlet.result.MockMvcResultHandlers.log;
-import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
-
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Optional;
-
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.mockito.ArgumentCaptor;
-import org.mockito.Captor;
-import org.mockito.InjectMocks;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.test.mock.mockito.MockBean;
-import org.springframework.http.MediaType;
-import org.springframework.security.authentication.AuthenticationEventPublisher;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.core.AuthenticationException;
-import org.springframework.security.core.GrantedAuthority;
-import org.springframework.security.core.authority.SimpleGrantedAuthority;
-import org.springframework.test.context.junit4.SpringRunner;
-import org.springframework.test.web.servlet.MockMvc;
-import org.springframework.test.web.servlet.setup.MockMvcBuilders;
-import org.springframework.web.context.WebApplicationContext;
-
-import dev.samstevens.totp.code.CodeVerifier;
-import it.infn.mw.iam.api.account.AccountUtils;
-import it.infn.mw.iam.authn.multi_factor_authentication.authenticator_app.AuthenticatorAppVerifyController;
-import it.infn.mw.iam.authn.multi_factor_authentication.error.MultiFactorAuthenticationError;
-import it.infn.mw.iam.test.multi_factor_authentication.MultiFactorTestSupport;
-import it.infn.mw.iam.test.util.WithAnonymousUser;
-import it.infn.mw.iam.test.util.WithMockPreAuthenticatedUser;
-import it.infn.mw.iam.test.util.annotation.IamMockMvcIntegrationTest;
-
-@RunWith(SpringRunner.class)
-@IamMockMvcIntegrationTest
-public class AuthenticatorAppVerifyControllerTests extends MultiFactorTestSupport {
-
-  private MockMvc mvc;
-
-  @Autowired
-  private WebApplicationContext context;
-
-  @MockBean
-  private AccountUtils accountUtils;
-
-  @MockBean
-  private CodeVerifier codeVerifier;
-
-  @MockBean
-  private AuthenticationEventPublisher eventPublisher;
-
-  @Captor
-  private ArgumentCaptor authEventCaptor;
-
-  @Captor
-  private ArgumentCaptor authExceptionCaptor;
-
-  @InjectMocks
-  private AuthenticatorAppVerifyController controller;
-
-  @Before
-  public void setup() {
-    when(accountUtils.getAuthenticatedUserAccount()).thenReturn(Optional.of(TEST_ACCOUNT));
-    when(codeVerifier.isValidCode(anyString(), anyString())).thenReturn(true);
-
-    mvc =
-        MockMvcBuilders.webAppContextSetup(context).apply(springSecurity()).alwaysDo(log()).build();
-  }
-
-  @After
-  public void tearDown() {
-    reset(accountUtils);
-    reset(codeVerifier);
-    reset(eventPublisher);
-  }
-
-  @Test
-  @WithMockPreAuthenticatedUser(username = TEST_USERNAME)
-  public void testVerifyCodeValidCode() throws Exception {
-    mvc
-      .perform(post(VERIFY_CODE_URL).param("code", "123456")
-        .contentType(MediaType.APPLICATION_FORM_URLENCODED))
-      .andExpect(status().is3xxRedirection());
-
-    verify(eventPublisher).publishAuthenticationSuccess(authEventCaptor.capture());
-    Authentication newAuth = authEventCaptor.getValue();
-    List authorities = new ArrayList<>(newAuth.getAuthorities());
-    assertTrue(authorities.contains(new SimpleGrantedAuthority("ROLE_USER")));
-  }
-
-  @Test
-  @WithMockPreAuthenticatedUser(username = TEST_USERNAME)
-  public void testVerifyCodeWrongCodeFails() throws Exception {
-    when(codeVerifier.isValidCode(anyString(), anyString())).thenReturn(false);
-
-    mvc
-      .perform(post(VERIFY_CODE_URL).param("code", "123456")
-        .contentType(MediaType.APPLICATION_FORM_URLENCODED))
-      .andExpect(status().is3xxRedirection());
-
-    verify(eventPublisher).publishAuthenticationFailure(authExceptionCaptor.capture(), any());
-    AuthenticationException e = authExceptionCaptor.getValue();
-    assertThat(e, instanceOf(MultiFactorAuthenticationError.class));
-    assertEquals(e.getMessage(), "Bad MFA code");
-  }
-
-  @Test
-  @WithMockPreAuthenticatedUser(username = TEST_USERNAME)
-  public void testVerifyCodeInvalidCodeFormatFails() throws Exception {
-    mvc
-      .perform(post(VERIFY_CODE_URL).param("code", "invalid-code")
-        .contentType(MediaType.APPLICATION_FORM_URLENCODED))
-      .andExpect(status().is3xxRedirection());
-
-    verify(eventPublisher).publishAuthenticationFailure(authExceptionCaptor.capture(), any());
-    AuthenticationException e = authExceptionCaptor.getValue();
-    assertThat(e, instanceOf(MultiFactorAuthenticationError.class));
-    assertEquals(e.getMessage(), "Bad MFA code");
-  }
-
-  @Test
-  @WithAnonymousUser
-  public void testVerifyCodeNoPreAuthenticationFails() throws Exception {
-    mvc
-      .perform(post(VERIFY_CODE_URL).param("code", "123456")
-        .contentType(MediaType.APPLICATION_FORM_URLENCODED))
-      .andExpect(status().is4xxClientError());
-  }
-
-  @Test
-  @WithMockPreAuthenticatedUser(username = TEST_USERNAME)
-  public void testVerifyRecoveryCodeValidRecoveryCode() throws Exception {
-    mvc
-      .perform(post(VERIFY_RECOVERY_CODE_URL).param("recoveryCode", TOTP_RECOVERY_CODE_1.getCode())
-        .contentType(MediaType.APPLICATION_FORM_URLENCODED))
-      .andExpect(status().is3xxRedirection());
-
-    verify(eventPublisher).publishAuthenticationSuccess(authEventCaptor.capture());
-    Authentication newAuth = authEventCaptor.getValue();
-    List authorities = new ArrayList<>(newAuth.getAuthorities());
-    assertTrue(authorities.contains(new SimpleGrantedAuthority("ROLE_USER")));
-  }
-
-  @Test
-  @WithMockPreAuthenticatedUser(username = TEST_USERNAME)
-  public void testVerifyRecoveryCodeEmptyRecoveryCodeFails() throws Exception {
-    mvc
-      .perform(post(VERIFY_RECOVERY_CODE_URL).param("recoveryCode", "")
-        .contentType(MediaType.APPLICATION_FORM_URLENCODED))
-      .andExpect(status().is3xxRedirection());
-
-    verify(eventPublisher).publishAuthenticationFailure(authExceptionCaptor.capture(), any());
-    AuthenticationException e = authExceptionCaptor.getValue();
-    assertThat(e, instanceOf(MultiFactorAuthenticationError.class));
-    assertEquals(e.getMessage(), "Bad recovery code");
-  }
-
-  @Test
-  @WithMockPreAuthenticatedUser(username = TEST_USERNAME)
-  public void testVerifyRecoveryCodeWrongRecoveryCodeFails() throws Exception {
-    mvc
-      .perform(post(VERIFY_RECOVERY_CODE_URL).param("recoveryCode", "wrong-code")
-        .contentType(MediaType.APPLICATION_FORM_URLENCODED))
-      .andExpect(status().is3xxRedirection());
-
-    verify(eventPublisher).publishAuthenticationFailure(authExceptionCaptor.capture(), any());
-    AuthenticationException e = authExceptionCaptor.getValue();
-    assertThat(e, instanceOf(MultiFactorAuthenticationError.class));
-    assertEquals(e.getMessage(), "Bad recovery code");
-  }
-
-  @Test
-  @WithAnonymousUser
-  public void testVerifyRecoveryCodeNoPreAuthenticationFails() throws Exception {
-    mvc
-      .perform(post(VERIFY_RECOVERY_CODE_URL).param("recoveryCode", TOTP_RECOVERY_CODE_1.getCode())
-        .contentType(MediaType.APPLICATION_FORM_URLENCODED))
-      .andExpect(status().is4xxClientError());
-  }
-}
diff --git a/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/authenticator_app/RecoveryCodeManagementControllerTests.java b/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/authenticator_app/RecoveryCodeManagementControllerTests.java
index 6678d81d7..7d03ee299 100644
--- a/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/authenticator_app/RecoveryCodeManagementControllerTests.java
+++ b/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/authenticator_app/RecoveryCodeManagementControllerTests.java
@@ -15,30 +15,25 @@
  */
 package it.infn.mw.iam.test.multi_factor_authentication.authenticator_app;
 
-import static it.infn.mw.iam.authn.multi_factor_authentication.authenticator_app.RecoveryCodeManagementController.GET_URL;
-import static it.infn.mw.iam.authn.multi_factor_authentication.authenticator_app.RecoveryCodeManagementController.RESET_URL;
-import static it.infn.mw.iam.authn.multi_factor_authentication.authenticator_app.RecoveryCodeManagementController.VIEW_URL;
+import static it.infn.mw.iam.authn.multi_factor_authentication.authenticator_app.RecoveryCodeManagementController.RECOVERY_CODE_GET_URL;
+import static it.infn.mw.iam.authn.multi_factor_authentication.authenticator_app.RecoveryCodeManagementController.RECOVERY_CODE_RESET_URL;
+import static it.infn.mw.iam.authn.multi_factor_authentication.authenticator_app.RecoveryCodeManagementController.RECOVERY_CODE_VIEW_URL;
 import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.Matchers.equalTo;
-import static org.hamcrest.Matchers.instanceOf;
-import static org.hamcrest.Matchers.not;
-import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.Mockito.reset;
+import static org.mockito.Mockito.times;
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
 import static org.springframework.security.test.web.servlet.setup.SecurityMockMvcConfigurers.springSecurity;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
-import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.put;
 import static org.springframework.test.web.servlet.result.MockMvcResultHandlers.log;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.model;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
 
 import java.util.ArrayList;
-import java.util.HashSet;
 import java.util.List;
 import java.util.Optional;
-import java.util.Set;
 
 import org.junit.After;
 import org.junit.Before;
@@ -46,27 +41,25 @@
 import org.junit.runner.RunWith;
 import org.mockito.ArgumentCaptor;
 import org.mockito.Captor;
-import org.mockito.InjectMocks;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.test.mock.mockito.MockBean;
 import org.springframework.context.ApplicationEvent;
 import org.springframework.context.ApplicationEventPublisher;
 import org.springframework.security.core.AuthenticationException;
-import org.springframework.security.test.context.support.WithMockUser;
 import org.springframework.test.context.junit4.SpringRunner;
 import org.springframework.test.web.servlet.MockMvc;
 import org.springframework.test.web.servlet.MvcResult;
 import org.springframework.test.web.servlet.setup.MockMvcBuilders;
 import org.springframework.web.context.WebApplicationContext;
 
+import dev.samstevens.totp.recovery.RecoveryCodeGenerator;
 import it.infn.mw.iam.api.account.AccountUtils;
-import it.infn.mw.iam.audit.events.account.multi_factor_authentication.RecoveryCodesResetEvent;
-import it.infn.mw.iam.authn.multi_factor_authentication.authenticator_app.AuthenticatorAppVerifyController;
-import it.infn.mw.iam.core.user.IamAccountService;
-import it.infn.mw.iam.persistence.model.IamAccount;
+import it.infn.mw.iam.api.account.multi_factor_authentication.IamTotpRecoveryCodeResetService;
 import it.infn.mw.iam.persistence.model.IamTotpRecoveryCode;
+import it.infn.mw.iam.persistence.repository.IamTotpMfaRepository;
 import it.infn.mw.iam.test.multi_factor_authentication.MultiFactorTestSupport;
 import it.infn.mw.iam.test.util.WithAnonymousUser;
+import it.infn.mw.iam.test.util.WithMockMfaUser;
 import it.infn.mw.iam.test.util.WithMockPreAuthenticatedUser;
 import it.infn.mw.iam.test.util.annotation.IamMockMvcIntegrationTest;
 
@@ -79,29 +72,32 @@ public class RecoveryCodeManagementControllerTests extends MultiFactorTestSuppor
   @Autowired
   private WebApplicationContext context;
 
+  @MockBean
+  private IamTotpMfaRepository totpMfaRepository;
+
   @MockBean
   private AccountUtils accountUtils;
 
   @MockBean
-  private IamAccountService service;
+  private IamTotpRecoveryCodeResetService service;
 
   @MockBean
   private ApplicationEventPublisher eventPublisher;
 
+  @MockBean
+  private RecoveryCodeGenerator generator;
+
   @Captor
   private ArgumentCaptor authEventCaptor;
 
   @Captor
   private ArgumentCaptor authExceptionCaptor;
 
-  @InjectMocks
-  private AuthenticatorAppVerifyController controller;
-
   @Before
   public void setup() {
-    when(accountUtils.getAuthenticatedUserAccount()).thenReturn(Optional.of(TEST_ACCOUNT));
-    when(service.addTotpMfaRecoveryCodes(TEST_ACCOUNT)).thenAnswer(i -> i.getArguments()[0]);
-    when(service.saveAccount(TEST_ACCOUNT)).thenAnswer(i -> i.getArguments()[0]);
+    when(accountUtils.getAuthenticatedUserAccount()).thenReturn(Optional.of(TOTP_MFA_ACCOUNT));
+    when(totpMfaRepository.findByAccount(TOTP_MFA_ACCOUNT)).thenReturn(Optional.of(TOTP_MFA));
+    when(service.resetRecoveryCodes(TOTP_MFA_ACCOUNT)).thenAnswer(i -> i.getArguments()[0]);
 
     mvc =
         MockMvcBuilders.webAppContextSetup(context).apply(springSecurity()).alwaysDo(log()).build();
@@ -117,90 +113,49 @@ public void tearDown() {
   }
 
   @Test
-  @WithMockUser
+  @WithMockMfaUser
   public void testGetResetView() throws Exception {
-    mvc.perform(get(RESET_URL)).andExpect(status().isOk());
+    mvc.perform(get(RECOVERY_CODE_RESET_URL)).andExpect(status().isOk());
   }
 
   @Test
   @WithAnonymousUser
   public void testGetResetViewNoAuthenticationFails() throws Exception {
-    mvc.perform(get(RESET_URL)).andExpect(status().isUnauthorized());
+    mvc.perform(get(RECOVERY_CODE_RESET_URL)).andExpect(status().isUnauthorized());
   }
 
   @Test
   @WithMockPreAuthenticatedUser
   public void testGetResetViewWithPreAuthenticationFails() throws Exception {
-    mvc.perform(get(RESET_URL)).andExpect(status().isForbidden());
+    mvc.perform(get(RECOVERY_CODE_RESET_URL)).andExpect(status().isUnauthorized());
   }
 
-  @Test
-  @WithMockUser(username = TEST_USERNAME)
-  public void testPostResetRedirectsAndAddsNewCodes() throws Exception {
-    TEST_ACCOUNT.getTotpMfa().setRecoveryCodes(RECOVERY_CODE_SET_SECOND);
-    mvc.perform(post(RESET_URL)).andExpect(status().is3xxRedirection());
-
-    verify(eventPublisher).publishEvent(authEventCaptor.capture());
-    ApplicationEvent e = authEventCaptor.getValue();
-    assertThat(e, instanceOf(RecoveryCodesResetEvent.class));
-  }
-
-  @Test
-  @WithAnonymousUser
-  public void testPostResetNoAuthenticationFails() throws Exception {
-    mvc.perform(post(RESET_URL)).andExpect(status().isUnauthorized());
-  }
+  // TODO test getResetView with user that doesn't have MFA enabled. Currently, I don't think the
+  // user is forbidden in this case
 
   @Test
-  @WithMockPreAuthenticatedUser
-  public void testPostResetWithPreAuthenticationFails() throws Exception {
-    mvc.perform(post(RESET_URL)).andExpect(status().isForbidden());
-  }
-
-  @Test
-  @WithMockUser(username = TEST_USERNAME)
+  @WithMockMfaUser
   public void testPutResetAddsNewCodes() throws Exception {
-
-    // Duplicate original recovery codes for comparison later on
-    Set originalSet = new HashSet<>(RECOVERY_CODE_SET_FIRST);
-
-    // Duplicate original account to be returned from authentication
-    IamAccount originalAccount = cloneAccount(TEST_ACCOUNT);
-    when(accountUtils.getAuthenticatedUserAccount()).thenReturn(Optional.of(originalAccount));
-
-    // An account with new codes is returned. This demonstrates the generation of new codes
-    TEST_ACCOUNT.getTotpMfa().setRecoveryCodes(RECOVERY_CODE_SET_SECOND);
-    when(service.addTotpMfaRecoveryCodes(any())).thenReturn(TEST_ACCOUNT);
-    when(service.saveAccount(any())).thenReturn(TEST_ACCOUNT);
-
-    mvc.perform(put(RESET_URL)).andExpect(status().isOk());
-
-    verify(eventPublisher).publishEvent(authEventCaptor.capture());
-    ApplicationEvent e = authEventCaptor.getValue();
-    assertThat(e, instanceOf(RecoveryCodesResetEvent.class));
-
-    RecoveryCodesResetEvent recoveryCodeEvent = (RecoveryCodesResetEvent) e;
-    Set recoveryCodes =
-        recoveryCodeEvent.getAccount().getTotpMfa().getRecoveryCodes();
-    assertThat(recoveryCodes.toArray(), not(equalTo(originalSet.toArray())));
+    mvc.perform(put(RECOVERY_CODE_RESET_URL)).andExpect(status().isOk());
+    verify(service, times(1)).resetRecoveryCodes(TOTP_MFA_ACCOUNT);
   }
 
   @Test
   @WithAnonymousUser
   public void testPutResetNoAuthenticationFails() throws Exception {
-    mvc.perform(post(RESET_URL)).andExpect(status().isUnauthorized());
+    mvc.perform(put(RECOVERY_CODE_RESET_URL)).andExpect(status().isUnauthorized());
   }
 
   @Test
   @WithMockPreAuthenticatedUser
   public void testPutResetWithPreAuthenticationFails() throws Exception {
-    mvc.perform(post(RESET_URL)).andExpect(status().isForbidden());
+    mvc.perform(put(RECOVERY_CODE_RESET_URL)).andExpect(status().isUnauthorized());
   }
 
   @Test
-  @WithMockUser
+  @WithMockMfaUser
   public void testViewRecoveryCodes() throws Exception {
-    mvc.perform(get(VIEW_URL))
+    mvc.perform(get(RECOVERY_CODE_VIEW_URL))
       .andExpect(status().isOk())
       .andExpect(model().attributeExists("recoveryCodes"));
   }
@@ -208,45 +163,46 @@ public void testViewRecoveryCodes() throws Exception {
   @Test
   @WithAnonymousUser
   public void testViewRecoveryCodesNoAuthenticationFails() throws Exception {
-    mvc.perform(get(VIEW_URL)).andExpect(status().isUnauthorized());
+    mvc.perform(get(RECOVERY_CODE_VIEW_URL)).andExpect(status().isUnauthorized());
   }
 
   @Test
   @WithMockPreAuthenticatedUser
   public void testViewRecoveryCodesWithPreAuthenticationFails() throws Exception {
-    mvc.perform(get(VIEW_URL)).andExpect(status().isForbidden());
+    mvc.perform(get(RECOVERY_CODE_VIEW_URL)).andExpect(status().isUnauthorized());
   }
 
   @Test
-  @WithMockUser
+  @WithMockMfaUser
   public void testGetRecoveryCodes() throws Exception {
-    MvcResult result = mvc.perform(get(GET_URL)).andExpect(status().isOk()).andReturn();
+    MvcResult result =
+        mvc.perform(get(RECOVERY_CODE_GET_URL)).andExpect(status().isOk()).andReturn();
 
     String content = result.getResponse().getContentAsString();
     content = content.substring(1, content.length() - 1);
     String[] arr = content.split(",");
 
-    String[] err = new String[RECOVERY_CODE_SET_FIRST.size()];
+    String[] originalCodes = new String[RECOVERY_CODE_SET_FIRST.size()];
     List recoveryCodes = new ArrayList<>(RECOVERY_CODE_SET_FIRST);
     for (int i = 0; i < recoveryCodes.size(); i++) {
-      err[i] = recoveryCodes.get(i).getCode();
+      originalCodes[i] = recoveryCodes.get(i).getCode();
 
       // This is here because the string.split() method adds backslashed quotes around the separated
       // strings. So this is a hacky method to remove them to allow for the comparison to succeed.
       arr[i] = arr[i].substring(1, arr[i].length() - 1);
     }
-    assertThat(err, equalTo(arr));
+    assertThat(originalCodes, equalTo(arr));
   }
 
   @Test
   @WithAnonymousUser
   public void testGetRecoveryCodesNoAuthenticationFails() throws Exception {
-    mvc.perform(get(GET_URL)).andExpect(status().isUnauthorized());
+    mvc.perform(get(RECOVERY_CODE_GET_URL)).andExpect(status().isUnauthorized());
   }
 
   @Test
   @WithMockPreAuthenticatedUser
   public void testGetRecoveryCodesWithPreAuthenticationFails() throws Exception {
-    mvc.perform(get(GET_URL)).andExpect(status().isForbidden());
+    mvc.perform(get(RECOVERY_CODE_GET_URL)).andExpect(status().isUnauthorized());
   }
 }
diff --git a/iam-login-service/src/test/java/it/infn/mw/iam/test/service/IamAccountServiceTestSupport.java b/iam-login-service/src/test/java/it/infn/mw/iam/test/service/IamAccountServiceTestSupport.java
index 2dd5e1eca..585100abc 100644
--- a/iam-login-service/src/test/java/it/infn/mw/iam/test/service/IamAccountServiceTestSupport.java
+++ b/iam-login-service/src/test/java/it/infn/mw/iam/test/service/IamAccountServiceTestSupport.java
@@ -15,17 +15,11 @@
  */
 package it.infn.mw.iam.test.service;
 
-import java.util.Arrays;
-import java.util.HashSet;
-import java.util.Set;
-
 import it.infn.mw.iam.persistence.model.IamAccount;
 import it.infn.mw.iam.persistence.model.IamAuthority;
 import it.infn.mw.iam.persistence.model.IamOidcId;
 import it.infn.mw.iam.persistence.model.IamSamlId;
 import it.infn.mw.iam.persistence.model.IamSshKey;
-import it.infn.mw.iam.persistence.model.IamTotpMfa;
-import it.infn.mw.iam.persistence.model.IamTotpRecoveryCode;
 import it.infn.mw.iam.persistence.model.IamX509Certificate;
 
 public class IamAccountServiceTestSupport {
@@ -44,12 +38,6 @@ public class IamAccountServiceTestSupport {
   public static final String CICCIO_GIVEN_NAME = "Ciccio";
   public static final String CICCIO_FAMILY_NAME = "Paglia";
 
-  public static final String TOTP_MFA_ACCOUNT_UUID = "b3e7dd7f-a1ac-eda0-371d-b902a6c5cee2";
-  public static final String TOTP_MFA_ACCOUNT_USERNAME = "totp";
-  public static final String TOTP_MFA_ACCOUNT_EMAIL = "totp@example.org";
-  public static final String TOTP_MFA_ACCOUNT_GIVEN_NAME = "Totp";
-  public static final String TOTP_MFA_ACCOUNT_FAMILY_NAME = "Mfa";
-
   public static final String TEST_SAML_ID_IDP_ID = "idpId";
   public static final String TEST_SAML_ID_USER_ID = "userId";
   public static final String TEST_SAML_ID_ATTRIBUTE_ID = "attributeId";
@@ -70,25 +58,9 @@ public class IamAccountServiceTestSupport {
   public static final String TEST_X509_CERTIFICATE_ISSUER_2 = "x509-cert-issuer-2";
   public static final String TEST_X509_CERTIFICATE_LABEL_2 = "x509-cert-label-2";
 
-  public static final String TOTP_MFA_SECRET = "secret";
-
-  public static final String TOTP_RECOVERY_CODE_STRING_1 = "code-1";
-  public static final String TOTP_RECOVERY_CODE_STRING_2 = "code-2";
-  public static final String TOTP_RECOVERY_CODE_STRING_3 = "code-3";
-  public static final String TOTP_RECOVERY_CODE_STRING_4 = "code-4";
-  public static final String TOTP_RECOVERY_CODE_STRING_5 = "code-5";
-  public static final String TOTP_RECOVERY_CODE_STRING_6 = "code-6";
-  public static final String TOTP_RECOVERY_CODE_STRING_7 = "code-7";
-  public static final String TOTP_RECOVERY_CODE_STRING_8 = "code-8";
-  public static final String TOTP_RECOVERY_CODE_STRING_9 = "code-9";
-  public static final String TOTP_RECOVERY_CODE_STRING_10 = "code-10";
-  public static final String TOTP_RECOVERY_CODE_STRING_11 = "code-11";
-  public static final String TOTP_RECOVERY_CODE_STRING_12 = "code-12";
-
 
   protected final IamAccount TEST_ACCOUNT;
   protected final IamAccount CICCIO_ACCOUNT;
-  protected final IamAccount TOTP_MFA_ACCOUNT;
   protected final IamAuthority ROLE_USER_AUTHORITY;
   protected final IamSamlId TEST_SAML_ID;
   protected final IamOidcId TEST_OIDC_ID;
@@ -98,15 +70,6 @@ public class IamAccountServiceTestSupport {
   protected final IamX509Certificate TEST_X509_CERTIFICATE_1;
   protected final IamX509Certificate TEST_X509_CERTIFICATE_2;
 
-  protected final IamTotpMfa TOTP_MFA;
-
-  protected final IamTotpRecoveryCode TOTP_RECOVERY_CODE_1;
-  protected final IamTotpRecoveryCode TOTP_RECOVERY_CODE_2;
-  protected final IamTotpRecoveryCode TOTP_RECOVERY_CODE_3;
-  protected final IamTotpRecoveryCode TOTP_RECOVERY_CODE_4;
-  protected final IamTotpRecoveryCode TOTP_RECOVERY_CODE_5;
-  protected final IamTotpRecoveryCode TOTP_RECOVERY_CODE_6;
-
   public IamAccountServiceTestSupport() {
     TEST_ACCOUNT = IamAccount.newAccount();
     TEST_ACCOUNT.setUuid(TEST_UUID);
@@ -146,37 +109,6 @@ public IamAccountServiceTestSupport() {
     TEST_X509_CERTIFICATE_2.setSubjectDn(TEST_X509_CERTIFICATE_SUBJECT_2);
     TEST_X509_CERTIFICATE_2.setIssuerDn(TEST_X509_CERTIFICATE_ISSUER_2);
     TEST_X509_CERTIFICATE_2.setCertificate(TEST_X509_CERTIFICATE_VALUE_2);
-
-    TOTP_MFA = new IamTotpMfa();
-
-    TOTP_MFA.setSecret(TOTP_MFA_SECRET);
-    TOTP_MFA.setActive(true);
-
-    TOTP_RECOVERY_CODE_1 = new IamTotpRecoveryCode(TOTP_MFA);
-    TOTP_RECOVERY_CODE_2 = new IamTotpRecoveryCode(TOTP_MFA);
-    TOTP_RECOVERY_CODE_3 = new IamTotpRecoveryCode(TOTP_MFA);
-    TOTP_RECOVERY_CODE_4 = new IamTotpRecoveryCode(TOTP_MFA);
-    TOTP_RECOVERY_CODE_5 = new IamTotpRecoveryCode(TOTP_MFA);
-    TOTP_RECOVERY_CODE_6 = new IamTotpRecoveryCode(TOTP_MFA);
-
-    TOTP_RECOVERY_CODE_1.setCode(TOTP_RECOVERY_CODE_STRING_1);
-    TOTP_RECOVERY_CODE_2.setCode(TOTP_RECOVERY_CODE_STRING_2);
-    TOTP_RECOVERY_CODE_3.setCode(TOTP_RECOVERY_CODE_STRING_3);
-    TOTP_RECOVERY_CODE_4.setCode(TOTP_RECOVERY_CODE_STRING_4);
-    TOTP_RECOVERY_CODE_5.setCode(TOTP_RECOVERY_CODE_STRING_5);
-    TOTP_RECOVERY_CODE_6.setCode(TOTP_RECOVERY_CODE_STRING_6);
-
-    TOTP_MFA
-      .setRecoveryCodes(new HashSet<>(Arrays.asList(TOTP_RECOVERY_CODE_1, TOTP_RECOVERY_CODE_2,
-          TOTP_RECOVERY_CODE_3, TOTP_RECOVERY_CODE_4, TOTP_RECOVERY_CODE_5, TOTP_RECOVERY_CODE_6)));
-
-    TOTP_MFA_ACCOUNT = IamAccount.newAccount();
-    TOTP_MFA_ACCOUNT.setUuid(TOTP_MFA_ACCOUNT_UUID);
-    TOTP_MFA_ACCOUNT.setUsername(TOTP_MFA_ACCOUNT_USERNAME);
-    TOTP_MFA_ACCOUNT.getUserInfo().setEmail(TOTP_MFA_ACCOUNT_EMAIL);
-    TOTP_MFA_ACCOUNT.getUserInfo().setGivenName(TOTP_MFA_ACCOUNT_GIVEN_NAME);
-    TOTP_MFA_ACCOUNT.getUserInfo().setFamilyName(TOTP_MFA_ACCOUNT_FAMILY_NAME);
-    TOTP_MFA_ACCOUNT.setTotpMfa(TOTP_MFA);
   }
 
   public IamAccount cloneAccount(IamAccount account) {
@@ -187,26 +119,8 @@ public IamAccount cloneAccount(IamAccount account) {
     newAccount.getUserInfo().setGivenName(account.getUserInfo().getGivenName());
     newAccount.getUserInfo().setFamilyName(account.getUserInfo().getFamilyName());
 
-    if (account.getTotpMfa() != null) {
-      IamTotpMfa totpMfa = new IamTotpMfa();
-      totpMfa.setSecret(account.getTotpMfa().getSecret());
-      totpMfa.setActive(account.getTotpMfa().isActive());
-
-      if (account.getTotpMfa().getRecoveryCodes() != null) {
-        Set newCodes = new HashSet<>();
-        for (IamTotpRecoveryCode recoveryCode : account.getTotpMfa().getRecoveryCodes()) {
-          IamTotpRecoveryCode newCode = new IamTotpRecoveryCode(totpMfa);
-          newCode.setCode(recoveryCode.getCode());
-          newCodes.add(newCode);
-        }
-        totpMfa.setRecoveryCodes(newCodes);
-      }
-
-      newAccount.setTotpMfa(totpMfa);
-    }
+    newAccount.touch();
 
     return newAccount;
   }
-
-
 }
diff --git a/iam-login-service/src/test/java/it/infn/mw/iam/test/service/IamAccountServiceTests.java b/iam-login-service/src/test/java/it/infn/mw/iam/test/service/IamAccountServiceTests.java
index a2e24b890..4e3b2c850 100644
--- a/iam-login-service/src/test/java/it/infn/mw/iam/test/service/IamAccountServiceTests.java
+++ b/iam-login-service/src/test/java/it/infn/mw/iam/test/service/IamAccountServiceTests.java
@@ -23,12 +23,10 @@
 import static org.hamcrest.CoreMatchers.nullValue;
 import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.Matchers.equalTo;
-import static org.hamcrest.Matchers.not;
 import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.assertTrue;
 import static org.mockito.ArgumentMatchers.any;
-import static org.mockito.ArgumentMatchers.anyInt;
 import static org.mockito.ArgumentMatchers.anyString;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.times;
@@ -41,9 +39,7 @@
 import java.util.Arrays;
 import java.util.Calendar;
 import java.util.Date;
-import java.util.HashSet;
 import java.util.Optional;
-import java.util.Set;
 
 import com.google.common.collect.Sets;
 
@@ -62,25 +58,16 @@
 import org.springframework.context.ApplicationEventPublisher;
 import org.springframework.security.crypto.password.PasswordEncoder;
 
-import dev.samstevens.totp.recovery.RecoveryCodeGenerator;
-import dev.samstevens.totp.secret.SecretGenerator;
 import it.infn.mw.iam.audit.events.account.AccountEndTimeUpdatedEvent;
-import it.infn.mw.iam.audit.events.account.multi_factor_authentication.AuthenticatorAppDisabledEvent;
-import it.infn.mw.iam.audit.events.account.multi_factor_authentication.AuthenticatorAppEnabledEvent;
 import it.infn.mw.iam.core.time.TimeProvider;
 import it.infn.mw.iam.core.user.DefaultIamAccountService;
 import it.infn.mw.iam.core.user.exception.CredentialAlreadyBoundException;
 import it.infn.mw.iam.core.user.exception.InvalidCredentialException;
-import it.infn.mw.iam.core.user.exception.MfaSecretAlreadyBoundException;
-import it.infn.mw.iam.core.user.exception.MfaSecretNotFoundException;
-import it.infn.mw.iam.core.user.exception.TotpMfaAlreadyEnabledException;
 import it.infn.mw.iam.core.user.exception.UserAlreadyExistsException;
 import it.infn.mw.iam.persistence.model.IamAccount;
 import it.infn.mw.iam.persistence.model.IamOidcId;
 import it.infn.mw.iam.persistence.model.IamSamlId;
 import it.infn.mw.iam.persistence.model.IamSshKey;
-import it.infn.mw.iam.persistence.model.IamTotpMfa;
-import it.infn.mw.iam.persistence.model.IamTotpRecoveryCode;
 import it.infn.mw.iam.persistence.model.IamX509Certificate;
 import it.infn.mw.iam.persistence.repository.IamAccountRepository;
 import it.infn.mw.iam.persistence.repository.IamAuthoritiesRepository;
@@ -116,12 +103,6 @@ public class IamAccountServiceTests extends IamAccountServiceTestSupport {
   @Mock
   private OAuth2TokenEntityService tokenService;
 
-  @Mock
-  private SecretGenerator secretGenerator;
-
-  @Mock
-  private RecoveryCodeGenerator recoveryCodeGenerator;
-
   private Clock clock = Clock.fixed(NOW, ZoneId.systemDefault());
 
   private DefaultIamAccountService accountService;
@@ -146,16 +127,9 @@ public void setup() {
     when(authoritiesRepo.findByAuthority(anyString())).thenReturn(Optional.empty());
     when(authoritiesRepo.findByAuthority("ROLE_USER")).thenReturn(Optional.of(ROLE_USER_AUTHORITY));
     when(passwordEncoder.encode(any())).thenReturn(PASSWORD);
-    when(secretGenerator.generate()).thenReturn("test_secret");
-
-    String[] testArray = {TOTP_RECOVERY_CODE_STRING_7, TOTP_RECOVERY_CODE_STRING_8,
-        TOTP_RECOVERY_CODE_STRING_9, TOTP_RECOVERY_CODE_STRING_10, TOTP_RECOVERY_CODE_STRING_11,
-        TOTP_RECOVERY_CODE_STRING_12};
-    when(recoveryCodeGenerator.generateCodes(anyInt())).thenReturn(testArray);
 
     accountService = new DefaultIamAccountService(clock, accountRepo, groupRepo, authoritiesRepo,
-        passwordEncoder, eventPublisher, secretGenerator, recoveryCodeGenerator, tokenService,
-        accountClientRepo);
+        passwordEncoder, eventPublisher, tokenService, accountClientRepo);
   }
 
   @Test(expected = NullPointerException.class)
@@ -869,127 +843,4 @@ public void testSetEndTimeWorksForNonNullDate() {
     assertThat(e.getPreviousEndTime(), nullValue());
     assertThat(e.getAccount().getEndTime(), is(newEndTime));
   }
-
-  @Test
-  public void testAssignsTotpMfaToAccount() {
-    IamAccount account = cloneAccount(TEST_ACCOUNT);
-    accountService.addTotpMfaSecret(account);
-    verify(accountRepo, times(1)).save(TEST_ACCOUNT);
-    verify(secretGenerator, times(1)).generate();
-    verify(recoveryCodeGenerator, times(1)).generateCodes(anyInt());
-
-    assertNotNull(account.getTotpMfa().getSecret());
-    assertFalse(account.getTotpMfa().isActive());
-  }
-
-  @Test(expected = MfaSecretAlreadyBoundException.class)
-  public void testAddMfaSecret_whenMfaSecretAssignedFails() {
-    IamAccount account = cloneAccount(TOTP_MFA_ACCOUNT);
-
-    try {
-      accountService.addTotpMfaSecret(account);
-    } catch (MfaSecretAlreadyBoundException e) {
-      assertThat(e.getMessage(),
-          equalTo("A multi-factor secret is already assigned to this account"));
-      throw e;
-    }
-  }
-
-  @Test
-  public void testAddsMfaRecoveryCodesToAccount() {
-    IamAccount account = cloneAccount(TOTP_MFA_ACCOUNT);
-    Set originalCodes = new HashSet<>(account.getTotpMfa().getRecoveryCodes());
-
-    try {
-      account = accountService.addTotpMfaRecoveryCodes(account);
-    } catch (MfaSecretNotFoundException e) {
-      assertThat(e.getMessage(), equalTo("No multi-factor secret is attached to this account"));
-      throw e;
-    }
-
-    Set newCodes = account.getTotpMfa().getRecoveryCodes();
-    assertThat(originalCodes.toArray(), not(equalTo(newCodes.toArray())));
-  }
-
-  @Test(expected = MfaSecretNotFoundException.class)
-  public void testAddsMfaRecoveryCode_whenNoMfaSecretAssignedFails() {
-    IamAccount account = cloneAccount(TEST_ACCOUNT);
-
-    try {
-      accountService.addTotpMfaRecoveryCodes(account);
-    } catch (MfaSecretNotFoundException e) {
-      assertThat(e.getMessage(), equalTo("No multi-factor secret is attached to this account"));
-      throw e;
-    }
-  }
-
-  @Test
-  public void testEnablesTotpMfa() {
-    IamAccount account = cloneAccount(TEST_ACCOUNT);
-    IamTotpMfa totpMfa = new IamTotpMfa(account);
-    totpMfa.setSecret("secret");
-    totpMfa.setActive(false);
-    account.setTotpMfa(totpMfa);
-
-    accountService.enableTotpMfa(account);
-    verify(accountRepo, times(1)).save(TEST_ACCOUNT);
-    verify(eventPublisher, times(1)).publishEvent(eventCaptor.capture());
-
-    ApplicationEvent event = eventCaptor.getValue();
-    assertThat(event, instanceOf(AuthenticatorAppEnabledEvent.class));
-
-    AuthenticatorAppEnabledEvent e = (AuthenticatorAppEnabledEvent) event;
-    assertTrue(e.getAccount().getTotpMfa().isActive());
-  }
-
-  @Test(expected = TotpMfaAlreadyEnabledException.class)
-  public void testEnableTotpMfa_whenTotpMfaEnabledFails() {
-    IamAccount account = cloneAccount(TOTP_MFA_ACCOUNT);
-
-    try {
-      accountService.enableTotpMfa(account);
-    } catch (TotpMfaAlreadyEnabledException e) {
-      assertThat(e.getMessage(), equalTo("TOTP MFA is already enabled on this account"));
-      throw e;
-    }
-  }
-
-  @Test(expected = MfaSecretNotFoundException.class)
-  public void testEnablesTotpMfa_whenNoMfaSecretAssignedFails() {
-    IamAccount account = cloneAccount(TEST_ACCOUNT);
-
-    try {
-      accountService.enableTotpMfa(account);
-    } catch (MfaSecretNotFoundException e) {
-      assertThat(e.getMessage(), equalTo("No multi-factor secret is attached to this account"));
-      throw e;
-    }
-  }
-
-  @Test
-  public void testDisablesTotpMfa() {
-    IamAccount account = cloneAccount(TOTP_MFA_ACCOUNT);
-
-    accountService.disableTotpMfa(account);
-    verify(accountRepo, times(1)).save(TOTP_MFA_ACCOUNT);
-    verify(eventPublisher, times(1)).publishEvent(eventCaptor.capture());
-
-    ApplicationEvent event = eventCaptor.getValue();
-    assertThat(event, instanceOf(AuthenticatorAppDisabledEvent.class));
-
-    AuthenticatorAppDisabledEvent e = (AuthenticatorAppDisabledEvent) event;
-    assertThat(e.getAccount().getTotpMfa(), nullValue());
-  }
-
-  @Test(expected = MfaSecretNotFoundException.class)
-  public void testDisablesTotpMfa_whenNoMfaSecretAssignedFails() {
-    IamAccount account = cloneAccount(TEST_ACCOUNT);
-
-    try {
-      accountService.disableTotpMfa(account);
-    } catch (MfaSecretNotFoundException e) {
-      assertThat(e.getMessage(), equalTo("No multi-factor secret is attached to this account"));
-      throw e;
-    }
-  }
 }
diff --git a/iam-login-service/src/test/java/it/infn/mw/iam/test/util/WithMockMfaUser.java b/iam-login-service/src/test/java/it/infn/mw/iam/test/util/WithMockMfaUser.java
new file mode 100644
index 000000000..556544041
--- /dev/null
+++ b/iam-login-service/src/test/java/it/infn/mw/iam/test/util/WithMockMfaUser.java
@@ -0,0 +1,32 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.infn.mw.iam.test.util;
+
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+
+import org.springframework.security.test.context.support.WithSecurityContext;
+
+import it.infn.mw.iam.test.util.multi_factor_authentication.WithMockMfaUserSecurityContextFactory;
+
+@Retention(RetentionPolicy.RUNTIME)
+@WithSecurityContext(factory = WithMockMfaUserSecurityContextFactory.class)
+public @interface WithMockMfaUser {
+
+  String username() default "test-mfa-user";
+
+  String[] authorities() default {"ROLE_USER"};
+}
diff --git a/iam-login-service/src/test/java/it/infn/mw/iam/test/util/WithMockPreAuthenticatedUser.java b/iam-login-service/src/test/java/it/infn/mw/iam/test/util/WithMockPreAuthenticatedUser.java
index 6a42ceb6e..910a5baff 100644
--- a/iam-login-service/src/test/java/it/infn/mw/iam/test/util/WithMockPreAuthenticatedUser.java
+++ b/iam-login-service/src/test/java/it/infn/mw/iam/test/util/WithMockPreAuthenticatedUser.java
@@ -26,7 +26,7 @@
 @WithSecurityContext(factory = WithMockPreAuthenticatedUserSecurityContextFactory.class)
 public @interface WithMockPreAuthenticatedUser {
 
-  String username() default "test-pre-authenticated-user";
+  String username() default "test-mfa-user";
 
   String[] authorities() default {"ROLE_PRE_AUTHENTICATED"};
 }
diff --git a/iam-login-service/src/test/java/it/infn/mw/iam/test/util/multi_factor_authentication/WithMockMfaUserSecurityContextFactory.java b/iam-login-service/src/test/java/it/infn/mw/iam/test/util/multi_factor_authentication/WithMockMfaUserSecurityContextFactory.java
new file mode 100644
index 000000000..36f1a6c4c
--- /dev/null
+++ b/iam-login-service/src/test/java/it/infn/mw/iam/test/util/multi_factor_authentication/WithMockMfaUserSecurityContextFactory.java
@@ -0,0 +1,55 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.infn.mw.iam.test.util.multi_factor_authentication;
+
+import static it.infn.mw.iam.authn.multi_factor_authentication.IamAuthenticationMethodReference.AuthenticationMethodReferenceValues.PASSWORD;
+import static it.infn.mw.iam.authn.multi_factor_authentication.IamAuthenticationMethodReference.AuthenticationMethodReferenceValues.ONE_TIME_PASSWORD;
+
+import java.util.Arrays;
+import java.util.HashSet;
+import java.util.Set;
+
+import org.springframework.security.core.authority.AuthorityUtils;
+import org.springframework.security.core.context.SecurityContext;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.security.test.context.support.WithSecurityContextFactory;
+
+import it.infn.mw.iam.authn.multi_factor_authentication.IamAuthenticationMethodReference;
+import it.infn.mw.iam.core.ExtendedAuthenticationToken;
+import it.infn.mw.iam.test.util.WithMockMfaUser;
+
+public class WithMockMfaUserSecurityContextFactory
+    implements WithSecurityContextFactory {
+
+  @Override
+  public SecurityContext createSecurityContext(WithMockMfaUser annotation) {
+    SecurityContext context = SecurityContextHolder.createEmptyContext();
+
+    IamAuthenticationMethodReference pwd =
+        new IamAuthenticationMethodReference(PASSWORD.getValue());
+    IamAuthenticationMethodReference otp =
+        new IamAuthenticationMethodReference(ONE_TIME_PASSWORD.getValue());
+    Set refs =
+        new HashSet(Arrays.asList(pwd, otp));
+
+    ExtendedAuthenticationToken token = new ExtendedAuthenticationToken(annotation.username(), "",
+        AuthorityUtils.createAuthorityList(annotation.authorities()));
+    token.setAuthenticated(true);
+    token.setAuthenticationMethodReferences(refs);
+    context.setAuthentication(token);
+    return context;
+  }
+}
diff --git a/iam-login-service/src/test/java/it/infn/mw/iam/test/util/multi_factor_authentication/WithMockPreAuthenticatedUserSecurityContextFactory.java b/iam-login-service/src/test/java/it/infn/mw/iam/test/util/multi_factor_authentication/WithMockPreAuthenticatedUserSecurityContextFactory.java
index 5fbf8249f..5a11f8f27 100644
--- a/iam-login-service/src/test/java/it/infn/mw/iam/test/util/multi_factor_authentication/WithMockPreAuthenticatedUserSecurityContextFactory.java
+++ b/iam-login-service/src/test/java/it/infn/mw/iam/test/util/multi_factor_authentication/WithMockPreAuthenticatedUserSecurityContextFactory.java
@@ -15,13 +15,19 @@
  */
 package it.infn.mw.iam.test.util.multi_factor_authentication;
 
-import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
-import org.springframework.security.core.Authentication;
+import static it.infn.mw.iam.authn.multi_factor_authentication.IamAuthenticationMethodReference.AuthenticationMethodReferenceValues.PASSWORD;
+
+import java.util.Arrays;
+import java.util.HashSet;
+import java.util.Set;
+
 import org.springframework.security.core.authority.AuthorityUtils;
 import org.springframework.security.core.context.SecurityContext;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.security.test.context.support.WithSecurityContextFactory;
 
+import it.infn.mw.iam.authn.multi_factor_authentication.IamAuthenticationMethodReference;
+import it.infn.mw.iam.core.ExtendedAuthenticationToken;
 import it.infn.mw.iam.test.util.WithMockPreAuthenticatedUser;
 
 public class WithMockPreAuthenticatedUserSecurityContextFactory
@@ -31,9 +37,16 @@ public class WithMockPreAuthenticatedUserSecurityContextFactory
   public SecurityContext createSecurityContext(WithMockPreAuthenticatedUser annotation) {
     SecurityContext context = SecurityContextHolder.createEmptyContext();
 
-    Authentication authentication = new UsernamePasswordAuthenticationToken(annotation.username(),
-        "", AuthorityUtils.createAuthorityList(annotation.authorities()));
-    context.setAuthentication(authentication);
+    IamAuthenticationMethodReference pwd =
+        new IamAuthenticationMethodReference(PASSWORD.getValue());
+    Set refs =
+        new HashSet(Arrays.asList(pwd));
+
+    ExtendedAuthenticationToken token = new ExtendedAuthenticationToken(annotation.username(), "",
+        AuthorityUtils.createAuthorityList(annotation.authorities()));
+    token.setAuthenticated(false);
+    token.setAuthenticationMethodReferences(refs);
+    context.setAuthentication(token);
     return context;
   }
 }

From 958082caca1a0fdb591a889ca5768c12fd8ca06a Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Thu, 10 Mar 2022 17:09:01 +0000
Subject: [PATCH 75/76] Adding license header for IamTotpMfaServiceTests

---
 .../IamTotpMfaServiceTests.java                   | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/IamTotpMfaServiceTests.java b/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/IamTotpMfaServiceTests.java
index 89a18b2de..2ce503607 100644
--- a/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/IamTotpMfaServiceTests.java
+++ b/iam-login-service/src/test/java/it/infn/mw/iam/test/multi_factor_authentication/IamTotpMfaServiceTests.java
@@ -1,3 +1,18 @@
+/**
+ * Copyright (c) Istituto Nazionale di Fisica Nucleare (INFN). 2016-2021
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 package it.infn.mw.iam.test.multi_factor_authentication;
 
 import static org.hamcrest.CoreMatchers.instanceOf;

From 469ac8e7fb046c7041851183c36c390a63175dd8 Mon Sep 17 00:00:00 2001
From: Sam Glendenning 
Date: Fri, 11 Mar 2022 10:33:44 +0000
Subject: [PATCH 76/76] Fixing bugs with MFA verification

CodeDTO objects were not being verified properly

MFA was not being properly checked for in verification stage
---
 .../DefaultIamTotpMfaService.java              | 14 +++++++-------
 .../AuthenticatorAppSettingsController.java    |  4 ++--
 .../{TotpDTO.java => CodeDTO.java}             | 18 +++++++++---------
 3 files changed, 18 insertions(+), 18 deletions(-)
 rename iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/{TotpDTO.java => CodeDTO.java} (75%)

diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/DefaultIamTotpMfaService.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/DefaultIamTotpMfaService.java
index ddad5ffc8..dbfa34fce 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/DefaultIamTotpMfaService.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/DefaultIamTotpMfaService.java
@@ -97,9 +97,13 @@ public void setApplicationEventPublisher(ApplicationEventPublisher applicationEv
   @Override
   public IamTotpMfa addTotpMfaSecret(IamAccount account) {
     Optional totpMfaOptional = totpMfaRepository.findByAccount(account);
-    if (totpMfaOptional.isPresent() && totpMfaOptional.get().isActive()) {
-      throw new MfaSecretAlreadyBoundException(
-          "A multi-factor secret is already assigned to this account");
+    if (totpMfaOptional.isPresent()) {
+      if (totpMfaOptional.get().isActive()) {
+        throw new MfaSecretAlreadyBoundException(
+            "A multi-factor secret is already assigned to this account");
+      }
+
+      totpMfaRepository.delete(totpMfaOptional.get());
     }
 
     // Generate secret
@@ -201,10 +205,6 @@ public boolean verifyTotp(IamAccount account, String totp) {
     }
 
     IamTotpMfa totpMfa = totpMfaOptional.get();
-    if (!totpMfa.isActive()) {
-      throw new MfaSecretNotFoundException("No multi-factor secret is attached to this account");
-    }
-
     String mfaSecret = totpMfa.getSecret();
 
     // Verify provided TOTP
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppSettingsController.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppSettingsController.java
index 2f7fe526d..463dd9139 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppSettingsController.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/AuthenticatorAppSettingsController.java
@@ -117,7 +117,7 @@ public SecretAndDataUriDTO addSecret() {
   @RequestMapping(value = ENABLE_URL, method = RequestMethod.POST,
       produces = MediaType.TEXT_PLAIN_VALUE)
   @ResponseBody
-  public void enableAuthenticatorApp(@ModelAttribute @Valid TotpDTO code,
+  public void enableAuthenticatorApp(@ModelAttribute @Valid CodeDTO code,
       BindingResult validationResult) {
     if (validationResult.hasErrors()) {
       throw new BadMfaCodeError("Bad code");
@@ -155,7 +155,7 @@ public void enableAuthenticatorApp(@ModelAttribute @Valid TotpDTO code,
   @RequestMapping(value = DISABLE_URL, method = RequestMethod.POST,
       produces = MediaType.TEXT_PLAIN_VALUE)
   @ResponseBody
-  public void disableAuthenticatorApp(@Valid TotpDTO code, BindingResult validationResult) {
+  public void disableAuthenticatorApp(@Valid CodeDTO code, BindingResult validationResult) {
     if (validationResult.hasErrors()) {
       throw new BadMfaCodeError("Bad code");
     }
diff --git a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/TotpDTO.java b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/CodeDTO.java
similarity index 75%
rename from iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/TotpDTO.java
rename to iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/CodeDTO.java
index 17b193abf..5264458f9 100644
--- a/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/TotpDTO.java
+++ b/iam-login-service/src/main/java/it/infn/mw/iam/api/account/multi_factor_authentication/authenticator_app/CodeDTO.java
@@ -23,26 +23,26 @@
 /**
  * DTO containing a TOTP for MFA secrets
  */
-public class TotpDTO {
+public class CodeDTO {
 
-  @NotEmpty(message = "Totp cannot be empty")
-  @Length(min = 6, max = 6, message = "Totp must be six characters in length")
-  @Min(value = 0L, message = "Totp must be a numerical value")
-  private String totp;
+  @NotEmpty(message = "Code cannot be empty")
+  @Length(min = 6, max = 6, message = "Code must be six characters in length")
+  @Min(value = 0L, message = "Code must be a numerical value")
+  private String code;
 
 
   /**
    * @return the code
    */
   public String getCode() {
-    return totp;
+    return code;
   }
 
 
   /**
-   * @param totp new code
+   * @param code new code
    */
-  public void setTotp(final String totp) {
-    this.totp = totp;
+  public void setCode(final String code) {
+    this.code = code;
   }
 }